Surveyed directors say boards lack clear responsibility for AI oversight

Corporate directors are using AI to research markets and prepare for meetings, but their boards often lack clear rules for overseeing it. In findings published by Stanford Business on November 10, 70% of 20 interviewed directors said responsibility for AI governance was unclear—a gap between learning the technology and holding its use accountable.

The study used semi-structured interviews with directors of public and private companies in highly regulated industries, including healthcare and finance. It was conducted by Karen Ebert Matthys, a Stanford executive director in biomedical data science, and Ratna Saripalli, founder and CEO of AI governance assessment firm TAGC Assurance, with three coauthors.

That small interview sample offers a close look at directors’ experiences, not an estimate of conditions across all corporate boards. Respondents themselves gave their boards’ readiness to oversee AI an average score of 4.7 out of 10.

Discussion has not become a system

The missing structures went beyond an unclear division of responsibility. Some 80% of respondents said their boards had no formal AI ethics or responsibility policies or scorecards. Directors described active discussion and use of AI, but without a systematic approach to governing it.

Matthys described the missing step as turning awareness into concrete plans: deciding how decisions get made, what information gets reported and where problems go when they need attention. Saripalli said AI efforts were distributed across companies, leaving boards with the task of bringing those efforts together.

Directors are users, too

AI was already part of respondents’ own work. Three-quarters said they used it for research and market analysis, while 55% used it for board preparation and summarizing materials. Other uses included generating strategic questions and comparing their companies with competitors.

Matthys said directors would like AI tools to help them track board materials and understand year-to-year trends without reading 80- to 100-page reports. Yet only 54% of respondents said management had given them clear guidance on what they could and could not do with AI.

That use raises security questions about access and private corporate data. Matthys pointed to firewalls and secure sandboxes—protected environments for using the tools—as possible safeguards. But she also noted hurdles in setting them up with appropriate security and privacy controls.

We discovered most boards don’t have a great picture of what AI solutions are being rolled out.

Karen Ebert Matthys, study coauthor, speaking to Stanford Business

Assign responsibility, then establish visibility

The researchers’ recommendations start with the overall governance structure, rather than a particular AI tool. Saripalli identified three questions boards need to settle:

• What is the company’s overall AI vision and strategy?
• Which responsibilities belong to the board, and which belong to management?
• What are the specific committee responsibilities and decision-making processes?

A full audit of current company AI use should come before boards try to assess AI investments as a portfolio, Matthys said. That inventory would provide the foundation for dashboards measuring progress, challenges and returns. Her proposed sequence starts with understanding what is already in use before judging the combined investments.

The researchers did not frame oversight simply as a brake on adoption. Saripalli warned that moving too slowly could mean missing opportunities. Matthys likewise argued that failing to keep up carries its own business risk. Although she expects AI agents eventually to become part of boardroom work, she said addressing governance should take priority now.