Governance of AI: A critical imperative for today’s boards

Scaling up board engagement to bolster oversight

The survey reveals that, so far, board-level engagement with AI has been limited: Across industries and geographies, AI is not a topic of discussion that comes up often at board meetings. Only 14% of respondents say their board discusses AI at every meeting, 25% say it’s on the agenda twice a year, and 16% say AI is discussed annually. Nearly half (45%) of respondents say AI hasn’t yet made it onto their board’s agenda at all (figure 1). 

Alongside this board research, each quarter, Deloitte US’s State of Generative AI in the Enterprise report³ surveys C-suite executives and board members from organizations that are actively implementing gen AI technologies to continuously track progress and challenges leaders face. Its third-quarter 2024 report, which surveyed over 2,500 respondents, finds that while “promising pilots have led to more investments . . . many generative AI efforts are still at the pilot or proof-of-concept stage.” Much like the use cases many organizations are experimenting with, the survey shows that it’s still early stages for AI board governance, too.

While AI may not be on the board agenda itself, some boards are talking about AI as part of the broader technology discussions they’re having with management. “Rather than AI specifically, boards often see digital transformation on their agenda, of which AI is a part,” says Chikatomo Hodo, external director on the board of directors at ORIX Corporation, KONICA MINOLTA Inc., Mitsubishi Chemical Group Corporation, and Sumitomo Mitsui Banking.

When AI is on the board agenda, nearly half of respondents (46%) say it is discussed at the full board level. Among those who say a committee has been tasked with AI-related matters, it’s most frequently delegated to the committee responsible for risk: either the risk and regulatory committee (25%) or the audit committee (22%).

However, where broader AI oversight or specific gen AI oversight may ultimately land is still an open question, Hodo says: “It’s still unknown whether governance of gen AI should be a matter for the entire board of directors or its audit committee, or [how the board will oversee] management.” Some aspects of AI oversight and governance might be relevant for the full board—those topics that are generally more pervasive—while some might be more appropriate for a committee to handle. Boards may also need to consider how oversight will be shared when some topics transcend committees, and some may choose to establish an AI-specific committee.

We also asked respondents to comment on which C-suite roles are primarily responsible for engaging with the board about AI and gen AI. Most (69%) say they’re engaging with technology leaders, such as the chief information officer (CIO) or chief technology officer (CTO). Half of respondents say they are talking with their CEO about these topics, while about a quarter (26%) of respondents say they are engaging with the chief financial officer (CFO).

Boards are eager to devote more time to AI-related discussions

Many respondents are cognizant that their board’s current level of engagement may not be enough to oversee the opportunities and risks that could manifest by using AI, particularly gen AI. Nearly half (46%) say either they’re not satisfied with or they are concerned about the amount of time devoted to discussions on AI (figure 2). 

However, most respondents do not believe their organization is ready for broader AI deployment. Only 3% of respondents think their organizations are very ready, while 41% say their organizations are not ready. This perception of a low state of readiness could also be responsible for the growing sense of urgency as AI capabilities continue to be developed.

Many respondents would like to see quicker progress: Only 16% say they’re satisfied or very satisfied with the current pace of adoption (figure 3), and 44% say the pace needs to accelerate. These findings, combined with the lack of time devoted to AI on board agendas thus far, emphasize the opportunity boards have to contemplate, define, and scale AI oversight. 

AI adoption is a journey, not an instant solution

While many are eager to implement AI, some boards and non-tech leaders may not fully appreciate how difficult it can be to scale AI across the enterprise. Deloitte US’s State of Generative AI in the Enterprise Q3 2024 report explains how this challenge is currently playing out: “Leaders grasp how essential governance, risk, and compliance are for responsible generative AI adoption. However, there still seems to be a ‘knowing’ versus ‘doing’ gap for most organizations.”

Daniela Weber-Rey, independent director at Fnac Darty and, until recently, HSBC Trinkaus & Burkhardt AG, explains that organizations need to ensure they have a strong foundation in place to support AI implementations. “If you don't have the proper data management system in place, you cannot really make full use of AI or gen AI. The data infrastructure must be established and there must be a proper data management system in the company.”

Harder still, there’s also the challenge of getting employees to buy in and actually use the tools once they are available. “Adoption by the employees is really important,” Weber-Rey says. “You need the employees to be willing to adopt it because many of the areas in which you employ AI or gen AI are where there are a lot of employees, like marketing, sales, risk, audit, and financial reporting.”

Deloitte US's State of Generative AI in the Enterprise report further emphasizes that both data and people are essential elements for scaling gen AI initiatives from pilot to production.⁴ They are part of a critical suite of foundational elements including strategy, processes, risk management, and techonology. Getting all of these right as part of an organization’s strategy will be necessary in the major transformations that AI and gen AI will likely enable over the next few years and beyond.

The challenge of scaling the use of AI while remaining aligned to the organization’s integrated strategy is an area boards will need to deeply understand. Jean-Dominique Senard, chairman of the board of directors at Renault, emphasizes, “There should be a close link between the board and management—one that is transparent, candid, and open.” Having a clear ambition for AI and an understanding of the intended value it can create will be key to realizing long-term value.

Many boards are still getting up to speed on AI

Balancing the desire for rapid progress with the patience to scale effectively will be an important line for organizations to walk. But to do that, their boards will need to stay up to speed. According to the survey, most boards have limited understanding of the “art of the possible” in the use of AI in the enterprise. Reflecting on the current level of understanding of AI in the boardroom, over three-quarters of respondents (79%) say their boards have limited, minimal, or no knowledge or experience with AI (figure 4). Just 2% said their boards were highly knowledgeable and experienced.

“Digital literacy needs to be elevated both within the board and management, but we need to consider that there should be a division of roles,” Chikatomo Hodo says. “In reality, there are not many external directors with an IT background, and many companies are prioritizing bringing a diverse range of skills and backgrounds to their boards, rather than solely focusing on bringing digital transformation and AI knowledge and experience.” 

When considering board composition, our interviews highlighted the importance of making sure the board has the right mix of skillsets, which could include skills in AI. Some boards are turning to external experts to add to their AI literacy and fluency. Others are referring more to operational teams in their business to understand the potential opportunities and challenges presented by AI.

This survey shows boards are aware of the need to upskill and are taking action to increase their knowledge of AI in the boardroom (figure 5).

In many countries, board education is recommended or mandated in corporate governance codes or other related regulations or guidelines. “There is a binding recommendation in the French and German corporate governance codes that board members need to educate themselves. But there is also an obligation for the company to assist them in such training,” Weber-Rey explains. “This certainly applies to gen AI or any technological changes, such as digitalization. In the past, perhaps board directors could have gained a lot of knowledge of operations by walking through the factory floors in certain companies. Nowadays, you definitely need to have a classroom-type training for gen AI, even just to get a high-level understanding.”

One approach to help boards achieve AI fluency is for participants to use and experience AI—to “show rather than tell.” Digital avatars, demos, and hands-on experiences can be used as learning tools to help boards to understand “the art of the possible” for AI in their organizations.⁵ These experiences can also be tailored to industry or sector, allowing an organization to mirror the most relevant opportunities and challenges in their operating environment.⁶

While these immersive experiences can play a critical role in helping boards build AI fluency, some organizations might also wonder if education alone will ever be enough. Perhaps the composition of the board should change? Notably, 8% of respondents indicated their boards are starting to include AI specialists among their new board directors (figure 5). This may highlight a growing recognition that while board education is essential, having bona fide digital expertise, particularly in AI, is increasingly seen as critical for effective governance in today’s business landscape.

Regardless of the approaches boards pursue, it will be vital to continuously educate board members by bringing multidisciplinary and cross-industry perspectives to inform decision-making.

Near-term AI use in organizations is primarily focused on productivity and efficiency

The board survey asked respondents the degree to which their organizations have been incorporating AI into their business and operating plan. For their plans over the next 12 months, about a third of respondents (31%) have focused efforts to incorporate AI in certain areas; 33% say they’re experimenting; and another 32% say AI hasn’t yet been incorporated into their organization’s business and operating plan over the next 12 months. Only 4% say AI is incorporated throughout their near-term (next 12 months) business and operating plan (figure 6). 

Among organizations that have started to use AI in some capacity, respondents point to a number of strategic areas aligned with these investments (figure 7).

Perhaps not surprisingly, enhancing productivity and efficiency is the top strategic area (66%), followed by improving the customer experience (50%) and developing new products or other innovations (46%). 

These strategic priorities largely align with the planned areas for future AI investment. Top areas for future investment include technology (63%), customer experience (46%), and core operations (40%) (figure 8).

Jean-Dominique Senard says the evolution to AI at Renault was a natural one, and they have already seen its benefits as a tool for productivity and quality. “AI is everywhere in the company, and it’s quite visible when you go across a Renault plant. We leverage it in the design department, engineering, customer relationships, and, of course, in our vehicles. It was a normal evolution for us and has proven to be incredibly powerful.”

Building a board governance model for AI

In a complex environment in which opportunities, challenges, and priorities frequently emerge, it’s critical for organizations to govern at scale. Whether related to AI oversight or any other emerging issue, this means challenging orthodoxies while implementing balanced processes that allow the board to operate efficiently, transparently, and in the best interests of the organization as a whole—supporting growth, creating long-term value, and sustaining the organization.

Given this pivotal phase in gen AI experimentation and adoption, what kind of role should the board play as they build their governance models? This research showed a few considerations to keep top of mind as boards govern at scale: identifying and engaging with relevant stakeholders, refining the board’s responsibilities, and managing risk through appropriate guardrails.

As organizations consider how boards can approach their AI-related responsibilities, it’s vital to first understand the organization’s key stakeholders. Right now, respondents regard customers and employees as their top two stakeholders to consider in AI governance (figure 9). But as AI scales, other stakeholder groups will become more of a factor in board decision-making.

Daniela Weber-Rey explains: “Regulators are interested particularly around the risk and control aspects. But recent EU regulations on AI are new, and have not come fully into effect yet.” Interviewees echoed that as the regulatory landscape expands, particularly in heavily regulated industries like financial services, regulators will likely become an even more important stakeholder for boards in the future.

Which governance areas will be within the board’s purview moving forward? Respondents to this board survey pointed to several areas they believe will be critical tenets of effective board oversight in the near future. These include overall governance and oversight, including ethics (57%); strategy development, including policy on AI (44%); risk and opportunity management (35%); and oversight of implementation (14%) (figure 10).

But while boards develop their oversight models, they shouldn’t wait to start putting guardrails around risk management of AI. There is a danger people might not understand the risks associated with gen AI. Close to three-fourths (72%) of respondents from Deloitte’s State of Generative AI in the Enterprise Q3 report estimate that less than 40% of their overall workforce has access to their organization’s approved gen AI tools. Considering that employees may still be able to access some other tool on their own, the organization’s data may be at risk if employees are using unsanctioned tools. As a result, the organization may have less control over how the company is integrating gen AI.

Daniela Weber-Rey agrees: “I love this phrase: ‘The biggest risk of gen AI is not taking the risk of gen AI.”

Steps boards can take now to bolster AI oversight

The data shows that boards are eager to spend more time on AI and gen AI, enhance their knowledge and experience, and accelerate the pace of adoption in their organizations. But how can boards best navigate these opportunities and challenges? The following are a few immediate actions boards can consider taking to bolster AI governance.

1) Put AI on the board agenda—and make it strategic. Boards that aren’t yet discussing AI should consider adding it as an agenda item. Areas to consider include:

a. Cadence of discussions: How often should AI be on the board agenda?

b. Special sessions: Would the board benefit from a special session on AI or a board strategy retreat?

c. Strategy and scenario planning: Has the board scheduled an initial discussion with management to hear their analysis on risks and opportunities related to AI and the AI ambition of the organization?

d. Management oversight: How will the board assess, support, and, if necessary, challenge management’s point of view?

e. Risk appetite: Has the board had a discussion about risk appetite, both for the use of AI and, more broadly, for the organization, given the more uncertain environment that AI creates?

f. Regulatory scanning: How will the organization review AI’s regulatory and compliance landscapes across the geographies and jurisdictions in which it operates?

g. Measurement: When and how will the organization review the measurement of the progress and benefits of using AI in a way that ensures robust oversight of investments without stifling innovation?

2) Define the governance structure. To effectively exercise oversight, boards will likely also need to delineate and assign AI-related responsibilities. Considerations include:

a. Ownership of AI on the board: Which matters should be discussed as a full board? Can some be delegated to a committee—and if so, which committee?

b. Receiving robust and beneficial information from management: Is the board getting sufficient and appropriate information from management about AI-related matters, including risk management and internal controls, to exercise oversight?

c. Having access to more leaders: Given the wide range of impacts across all areas of the business, is the board connecting to other key members of the C-suite and business leaders beyond the CEO or CTO?

d. Striking the right balance: Is board involvement too high-level to effectively govern the use of AI? Will deeper board education and engagement result in too much oversight?

3) Evaluate and enhance AI literacy. To effectively oversee the opportunities and threats AI can introduce, boards should ensure they and their management teams are AI literate. They may consider:

a. Finding opportunities for education to fill gaps in knowledge: What training and educational opportunities are available to help the board upskill on AI and emerging technologies? Would the board benefit from bringing in internal or external experts to inform discussions?

b. Reevaluating the skills matrix: Does board composition need to be adjusted to recruit board members with more experience with AI and emerging technologies? What about in the C-suite?

c. Revamping succession plans to be more tech-forward: Have succession plans for the board and management been updated to focus on leaders who have experience with emerging technologies, including AI? Have learning opportunities been developed to help the pipeline of future leaders expand their skills and expertise in these technologies?

d. Staying in the flow of action: How can the board ensure it remains actively engaged in the evolving landscape of AI, guarding against complacency and outdated perspectives and remaining agile and responsive to AI’s evolving capabilities?