How AI Regulation Is Changing Board Governance
Imagine a letter arrives from a regulator. It's polite and fairly short, and it asks how the board oversees the company's use of AI in claims handling. Nobody panics. The company has an AI policy, IT signed off the claims tool through its usual process, the risk team logged it in the register and the audit committee discussed it twice last year. The trouble is that all of this lives in different places, written for different readers, and the Company Secretary is about to spend a good chunk of next week stitching it together into something the board can stand behind.
That stitching job, in a nutshell, is what AI regulation is asking boards to get better at.
It's turning up in annual reports, too. When Arize AI went through Fortune 500 filings, it found 281 companies flagging AI as a possible risk factor, up from 49 the year before, as Fortune reported. The reasons are a mixed bag. Media companies worry about rivals using AI to steal a march. Others cite unsettled rules on intellectual property, models that don't behave as expected, data leaks, or the reputational hit from a use that goes down badly with the public. A few years ago, most of that would have stayed with the legal team. Now it's landing on the board's desk.
Read the rules closely and they describe something boards already know how to do: work out who's accountable, make sure a person looked properly, and keep a record that still makes sense later. Treat it as a filing exercise and you'll miss what a regulator, or eventually a court, is looking for.
In this article:
The changing AI regulatory landscape
You don't need to be a regulatory lawyer to notice that the big regimes are drifting in the same direction, even if they're taking very different roads to get there. As Mark Williams, Chief Revenue Officer at Datasite Group, observed on Boardroom Confidential podcast: “Those AI privacy and data policies will be forced to acknowledge capabilities that are as yet unimagined.”
Europe is furthest ahead. The EU AI Act came into force in August 2024 and has been switching on piece by piece ever since. AI literacy duties arrived in February 2025 and rules for general-purpose models that August. The obligations most likely to matter to boards, the ones for high-risk systems, follow from August 2026, although a proposed deferral could push some of them into 2027. If you provide or deploy one of those systems, you need a risk management process, proper records and human oversight designed in. Get it badly wrong and the fine can reach €35 million or 7% of global turnover, whichever is higher. That's competition-law territory, and boards tend to pay attention accordingly.
Britain has gone the other way, at least on paper. There's no AI Act. Instead the ICO, the FCA, the CMA and other regulators apply five principles from government guidance (safety, transparency, fairness, accountability and contestability) within their own patches. It looks very different from Brussels. Scratch the surface, though, and the expectation is much the same: be able to explain, in plain English, how you're using AI.
For most boards, that shared direction matters more than the detail. The detail, which systems count as high-risk and where exactly the regulatory lines fall, is where a strong general counsel and Company Secretary come into their own, and boards rightly lean on them for it. The board's own job is simpler to describe and harder to do. It needs to know where AI is being used, who owns the risk, and whether somebody is in a position to spot trouble early.
What regulation means for boards
Regulators keep coming back to accountability, oversight and transparency. It's easier to see what they mean with an example, so let's stick with the claims tool.
Who is accountable if it starts turning down legitimate claims? "The CIO" won't quite do, and neither will "the business". A board should be able to name the person who owns that outcome in that process. Writing for the Harvard Law School Forum on Corporate Governance, Tara Giunta, a litigation partner at Paul Hastings, and Lex Suvanto of Edelman Smithfield put the board's position neatly as "Noses In, Fingers Out": close enough to understand where the risk sits, without ending up running the thing. If no name comes to mind, the policy probably isn't doing as much as everyone hopes.
Oversight comes next. Somewhere in the claims process there should be a person with the authority, the knowledge and the time to look at what the model recommends and overrule it when it's wrong. Most large companies have exactly that, and take it seriously. What's changing is that regulators want to see it. The EU AI Act expects the people overseeing a high-risk system to understand what it can and can't do, and to be able to override its output. So the board's question is whether that oversight is defined, written down and easy to show, rather than simply assumed.
Transparency starts closer to home than people expect. The claims tool went through a proper approval process. The director who drops a board paper into a public chatbot at eleven o'clock at night to get a quick summary did not. That kind of individual, unofficial use, usually called shadow AI, is more widespread than most leaders think. McKinsey found that executives guessed 4% of employees used generative AI for at least 30% of their daily work, when the true figure was 13%. Depending on its terms, a public tool may hang on to what it's given or use it for training, and Skadden has reminded directors that AI chats can be discoverable. Before a board can be open about how it uses AI, it needs to be clear about which tools are approved for board material. It helps enormously if the approved option is also the convenient one.
Translating regulation into board practice
So what does this look like from one meeting to the next? The easiest way in is through the board's own routines: the agenda, the reading beforehand, the record afterwards and, finally, where AI should sit in the decision itself.
Agendas
On plenty of boards, AI governance still turns up only now and then. According to McKinsey, a third of directors say AI doesn't feature on their board agendas at all, and when Protiviti and BoardProspects surveyed 772 directors and executives, only 26% said they discuss AI at every meeting. Where it does appear, it's often tucked into a periodic compliance update. That suits the audit calendar. It doesn't keep up particularly well with rules that keep changing, or with a business that keeps finding new uses for AI.
Bringing it round more often helps, and so does phrasing it as a question. "Which AI-related regulatory change affected our exposure this quarter, and does our governance still cover it?" asks directors to come to a view. "AI compliance update" mostly asks them to listen. A question gives people something to chew on before the meeting, too.
None of this means AI should crowd out everything else. It just needs to come up often enough that a new deadline or a changed obligation gets spotted in the quarter it happens.
Preparation
A director can't do much with a regulatory question they're seeing for the first time in the room. Whoever looks after AI governance internally should get updates out early and through a secure channel, whether it's a deadline that's moved or a system that's been reclassified.
There's a decent case for using AI at this stage, as it happens. Condensing a forty-page regulatory note into something a director can read on the train is exactly the kind of job it does well, and one of the more practical ways AI can help boards avoid information overload. The summary is only a starting point, mind. What directors want to walk in with is a sense of which bits deserve a harder question, and that needs some thinking time on top of the reading.
Documentation
Regulators are starting to assume that a board's reasoning can be reconstructed later, as well as its conclusions. Suppose someone asks, eighteen months on, why the board approved an AI-assisted decision. "We discussed it and agreed" is unlikely to satisfy them. They'll want to know what was considered, what was challenged and how the board got to its answer.
The same applies when the board changes its AI policy, approves a new use case or moves accountability for a system from one executive to another. Those changes, and the thinking behind them, belong in the formal record. Most boards are careful about their minutes, so this is rarely about discipline. The harder part is that AI governance is spread across several committees, policies and systems, and pulling it together after the fact is slow work unless the infrastructure makes it easy at the time.
Decision-making
By the time a decision is ready for a vote, what regulators expect is fairly simple to say: somebody has looked properly at the risks and the assumptions, and everyone knows who that was.
Most boards do this without being asked. It's still worth saying out loud before the vote, partly because a tight agenda and a confident recommendation can make it tempting to move on, and partly because a check that's been stated is far easier to point to later. Settling in advance on the questions boards should ask AI before a strategic decision gives that check something to bite on.
How Sherpany supports responsible AI governance
Much of what's described above depends on the plumbing of board work: how information reaches directors, how decisions get recorded and whether the record holds up when someone comes looking.
Sherpany's AI Meeting Minutes record the discussion behind a decision as well as the decision itself, including the assumptions people raised and the points they challenged. That's the sort of reasoning regulators increasingly expect to be able to find. Document Management keeps AI policies, regulatory updates and earlier governance decisions in one secure place designed for board work, so when a director or an auditor needs to work out what the board knew and when, nobody has to rely on memory.
Neither of these makes decisions for the board, and neither replaces the human oversight the rules require. What they do is make the routine parts easier: papers that reach directors securely and in good time, and a record that can answer a regulator's question, or a new director's, a year or two down the line. Those are the same habits that sit behind building an AI-ready board.
The Regulators Are Just Describing Good Governance
Strip out the legal detail and AI regulation is asking boards for things they already value: oversight from people who understand the issue, accountability you can put a name to, and decisions you can explain afterwards. What's different is how openly regulators now expect to see those things, and how specifically they're applying them to AI.
A board that builds this into its agendas, its preparation, its minutes and its decisions will find it has more than a compliance answer. It will have a way of working that holds up whether or not the regulator's letter ever arrives. Who's accountable, did a person look properly, and would the reasoning survive being written down? If the board can answer those without a scramble, the compliance side tends to follow.
If you would like to see how Sherpany supports responsible AI governance across agendas, preparation, documentation and decision-making, book a free demo and find out how Sherpany can help.