AI Is a Governance Question... and Boards Should Treat It Like One.
When boards I sit on talk about AI, the conversation almost always begins with vendors. Which models. What capabilities. How much they cost. What they automate. These are useful questions, but they are the wrong ones to start with.
The boards getting this right are starting somewhere else. They are asking: what changes about how this organisation makes decisions, manages risk and proves it is fit for purpose, if AI is doing some of the work? The technology questions are downstream of those.
I have had reason to think about this from several angles over the past year. At Mishcon de Reya, where I serve as Chair, our Vision 2030 strategy puts AI at the centre of how legal services will be delivered over the rest of the decade. The strategy is unusually direct in saying that it is no longer a question of if AI will change legal services, but how much, how fast and who will lead. At FNZ, where I chair the UK business, we operate one of the largest wealth management platforms in the world by assets under administration, in a regulatory environment that scrutinises every consumer-facing decision. At GRESB, we maintain the benchmark institutional investors use to evaluate ESG performance across real estate and infrastructure, and the quality of the data we benchmark is increasingly being shaped by AI tools at the asset level. At Charterhouse, the European private equity firm where I am Senior Partner, the question of how AI changes the operations of portfolio companies sits inside every meaningful investment review.
These are very different businesses. The governance questions are not.
What is actually being asked of boards
The framing I find most useful is this. AI changes three things about an institution at once: who is accountable for decisions, what evidence proves a decision was sound and how external stakeholders form a view of whether the institution can be trusted. Governance has been asking these questions for as long as institutions have existed; what AI changes is the context they are being asked in.
Take accountability first. If an underwriter, a paralegal, a portfolio analyst or a data steward is using an AI tool to draft, summarise, score or recommend, the human is still accountable. But the moment the tool’s output is treated as a finished product rather than a draft, accountability quietly shifts. Boards that have not been deliberate about where that line sits are, in practice, accepting that the tool is the decision maker. That is usually not what they intended.
Then evidence. Every regulated business already produces evidence that its decisions were sound: documented rationale, an audit trail, a record of what information was available and what was considered. AI changes the inputs in that record, and in some cases obscures them. A model output is not the same as a documented rationale. If the only answer to “why did we do this” is “the model suggested it,” that is a governance problem before it is a technology one.
The third question is trust. Customers, clients, investors and regulators are increasingly attentive to where AI sits in the chain of decision. The institutions that handle this well are clear and specific about it. The ones that handle it badly default to one of two failure modes: silence, which reads as evasion, or marketing, which reads as overreach. Neither builds confidence.
How the conversation shifts when this is taken seriously
When boards engage with AI as a governance question rather than a procurement one, three things tend to happen.
First, the conversation moves earlier in the cycle. Decisions about where AI sits in a workflow get discussed before the contract with the vendor is signed, not after. The cost of changing course at that stage is a fraction of what it becomes once a tool is embedded.
Second, the right people are in the room. AI procurement decisions made in isolation by a chief technology officer or chief operating officer often miss the perspectives of the people whose accountability is changing. Risk, compliance, internal audit, the general counsel and operational leaders need to be present, not consulted afterwards.
Third, the institution produces something useful for stakeholders. A board that has thought clearly about its AI position can articulate it: where AI is used, what humans remain accountable for, what evidence is kept and what changes for customers. That clarity is itself an asset.
A few questions I have found useful
I have started to use a small number of questions across the boards I sit on, regardless of sector. They are not exhaustive, but they tend to surface the issues quickly.
Where in our work is AI now part of the decision, and where is it part of the draft? The difference is the difference between a tool and an authority. Most institutions have moved further along this scale than their governance documents reflect.
What evidence would we want a regulator, a client or a court to find? Working backwards from what a future inquiry would need is one of the most clarifying exercises a board can do. It forces explicitness about what is being recorded and why.
If a model failed in a way that harmed a customer, who would be accountable and what would we do? If the honest answer to either half of that question is unclear, the accountability framework needs work before the tool is deployed more widely.
How are we training the people whose judgment we still rely on? AI tools change what skills matter. The institutions that handle this well invest in their people’s ability to interrogate, override and improve what the tools produce. The ones that do not are quietly de-skilling.
What do our customers and clients actually know, and what would they reasonably want to know, about how AI is used in our service to them? For most institutions, disclosure has moved from a compliance exercise to a core trust signal.
None of these questions require deep technical expertise to ask. They do require time, attention and a willingness to make decisions that have consequences for cost and pace.
What boards owe the moment
There is a pattern I have seen too often. Senior leadership wants to be seen to be moving quickly on AI. The board signs off on a strategy without interrogating the governance implications. A year later, the institution discovers it has accumulated obligations it did not consciously take on, and undoing them is painful.
The alternative is deliberation. Boards that treat AI as a governance question from the start move at a pace they can defend. They build the documentation, the accountability frameworks and the disclosure habits that mean the harder questions, when they come, can be answered with confidence.
This is, in the end, what stewardship looks like in 2026. The institutions that lead through this period will be the ones whose boards understood, early, that the deepest questions about AI are questions about trust: the trust an institution holds with the people who rely on it, and how that trust is renewed when the way the work gets done is changing underneath everyone.
That is the work of a board. It has not become any less important. It has only become harder to do without thinking carefully.