Governing AI at Scale: 7 Insights from Our Stockholm Boardroom Panel

On 30 September, general counsels, company secretaries, privacy and governance leads, and board directors came together at the Grand Hôtel Stockholm for Governing AI at Scale: The Boardroom Accountability Challenge, which we hosted with the AI Center. The afternoon centred on a panel about a question most boards now face in some form. As AI spreads through the organisation, who is accountable for it, and how should the board oversee it? 

The panel brought together: 

• Miranda Espenäs, President and Chair of the Board of the Swedish Company Lawyers Association and Legal Counsel at Spotify 
• Reza Moussavi, Director General of the Swedish AI Association 
• Jeanette Jäger, Non-Executive Director and Audit Committee member at Telia 
• Johan Harvard, Global AI Advisory Lead 
• Tomas Hedman, Head of Privacy and AI Governance 
• Sofie Ohlsson, Sales Director (Nordics) at Sherpany, moderated. 

It was a lively, candid conversation, and plenty of it carried on over the apéro afterwards.

Here are seven insights that stood out:  

1. Accountability sits with people, at every level 

When the panel was asked where responsibility for AI should sit, the answer arrived quickly: at all three levels. The person using the tool, management and the board each own a part of it. 

For the user, that means knowing what they can and can't do with AI and which tools are allowed. It also means checking what comes out and asking whether it's good enough to put your name to. One panellist pointed out the one thing missing from that list of three, clearly stating that "the AI isn't responsible, it's you." 

Management's share is providing the right tools and clear rules. The board's share is making accountability real. That means follow-up, reporting that reaches the board, and directors going to get the information themselves when it doesn't arrive. 

2. Shadow AI is a symptom of the right tools arriving too late 

Like the internet and the first smartphones, AI reached people at home before it reached them at work. Once someone has used a capable tool in their own life, doing without one at the office is frustrating, so they bring their own. Controlling that through rules alone, one speaker admitted, is very difficult. 

What has worked better is giving people something good to use. "Deploying powerful, already vetted governance quality tools and allowing our employees to use that is super efficient in eliminating shadow AI," one panellist said, describing their own organisation's experience. Consistency matters as well. As another put it, "We can't afford having 50 different governance moments. It just isn't practical." 

For governance teams, that's an encouraging message. Most shadow AI comes from people trying to do their jobs well, and the fix starts with approved tools that are easy to reach for. 

3. No free pass for AI 

The panel discussed the placement of AI within the context of organisations at length, with one panellist arguing against treating AI as an exotic new category. Organisations already have decades of experience governing things that cause serious harm when misused, from laboratory equipment to power tools. Nobody working underground on a city construction project would turn up with a cheap tool bought from an online marketplace and expect to use it on the job. 

AI deserves the same discipline: approved equipment, trained people and clear lines of responsibility. Their conclusion was simple. AI shouldn't get a free pass. 

4. AI literacy doesn't have to be boring 

The first thing organisations need is AI literacy. As the panellist put it, "that everyone understands the basics of basics, what an AI is, what is an agent." 

Later, an audience member who works as legal counsel and board secretary raised the practical problem behind that. Everyone wants to build with AI. The regulatory side (NIS2, DORA, GDPR and the new AI rules) can feel to colleagues like a list of things legal says no to. How do you make people want to understand the whole picture? 

The panel was upbeat on this. Make it easy to do the right thing, one speaker said, and a short slogan in Swedish carrying that idea had worked well for their teams. “It doesn't have to be boring," they said.  

5. Rethink the process before adding the tool 

The panel warned that many organisations have simply laid AI over the processes, roles and habits they already had. Often the result is more emails and more meetings without better work. 

The bigger gains come from going back to core processes and asking which parts technology can now change. Their example was a product specialist who writes up requirements so that a developer can turn them into code: two people doing much the same job. 

They contrasted this with China's long-term approach, where national goals aim for fully optimised core processes across business by the end of the decade: "They go not for adoption, they go for effect." 

6. More output from the same teams 

Is AI behind the recent wave of job losses? The panel took a more measured view than the headlines. One panellist's association had discussed it with member companies, and found that recent cuts had many causes that happened to coincide with AI, including tariffs, production moving between countries, and restructuring. "AI had some effect, but not at all enough to be the main force for redundancy." 

Another described how production cycles for big-budget titles in their industry were shrinking from around seven years to four, perhaps three. That means more releases from the same team. The argument one panellist makes to companies is to "use the same people and tools that you have to increase production" and improve margins that way, rather than by cutting headcount. Some companies that cut quickly have since ended up rehiring. 

Not everyone was so relaxed. One speaker pointed to job losses in parts of the legal industry in London. They also raised a sharper risk for companies that don't adapt: a competitor starting from a clean slate, with very little overhead, can do the same work. 

7. Where should a board start? 

The last question was practical. If a board isn't yet mature on AI, what are the first steps? A panellist who advises several boards said training on its own won't get them there. Courses have their place, but "sitting in a classroom or getting video recordings and everything. That's never going to be enough." 

Directors need to get hands-on. That means using AI for real tasks with some guidance, then moving on to the use cases that matter most to the business. There are no shortcuts. "It's like learning a language," they said. "You cannot just read the book about how to learn a language. You need to use it." This is precisely the insight that our recent guide builds upon.  

What it means for governance leaders 

• General counsel and company secretaries: literacy and approved tools do more to rein in shadow AI than restrictions do. A consistent governance approach, with one set of expectations instead of fifty, is easier for everyone to follow. 
• Boards: accountability for AI ends with people, and the board's part is making sure reporting reaches it and gets followed up. Directors who use AI themselves will ask better questions about it. 
• Executives: the payoff comes from redesigning core processes. Adding tools to existing ones tends to add work. Measured that way, AI looks more like a route to growth than a cost-cutting exercise. 

Join us for more forward-looking governance  

This event in Stockholm is just one example of events that we host across Europe each year. Each one brings together practitioners who deal with these questions every day, and the conversations in the room are often the best part. 

To be the first to hear about Sherpany events, subscribe to our newsletter today. 

Want to see how Sherpany helps boards prepare, decide and follow up in one secure place? Start your free trial.