How Boards can Ensure Responsible AI Use

AI in the Boardroom: What Charity Trustees Need to Do Now 🚨 Too many boards are sleepwalking into the risks, while missing the opportunities. I've just finished reading the new Institute of Directors (IoD)’s 'AI Governance in the Boardroom report' and it makes one thing clear: trustees can’t delegate this. AI is a board-level issue. Here are the key takeaways from the report every charity board should act on: 🧠 Stay Curious. Stay Learning. Boards don’t need to be technical experts, but they must understand enough to ask the right questions. Build a culture of digital curiosity at board level. ⚖️ AI = Risk AND Opportunity. Don’t just see AI as a shiny tool to save time. Trustees must weigh efficiency gains against bias, privacy, reputational harm, and compliance risks. ❓ Governance Starts with Questions. Who owns AI in your organisation? How is data being used? What safeguards are in place? Boards need simple checklists and regular oversight, not a one-off discussion. 📜 Know the Law. Regulation is tightening. - The EU AI Act is rolling out, with obligations on transparency, risk classification, and human oversight. - The UK is moving towards sector-led regulation, but trustees are still on the hook for data misuse under GDPR and the ICO’s guidance. - Trustees should be clear: ignorance won’t protect your charity from fines, reputational damage or, worst of all, harm to beneficiaries. 🎯 Impact Before Hype. Does this AI tool align with our mission, or is it just a gimmick? Focus on how tech helps people - service users, staff, and volunteers. 🛡️ Build Oversight Structures. Some boards are creating AI subcommittees or ethics groups. At the very least, AI should be a standing agenda item. Oversight isn’t optional anymore. 🔐 Data is Everything. AI governance is data governance. If your board isn’t confident on data protection, cybersecurity, and safeguarding sensitive information, that’s the place to start. The report is blunt: AI governance is now a fiduciary duty. Trustees don’t get a free pass. ✅ If you sit on a charity board, make AI part of your next meeting agenda. ✅ If you’re a Digital Trustee, help your board translate principles into practice. ✅ If you’re a CEO, empower your trustees to ask the hard questions. This is about safeguarding the people we serve, and making sure technology works for charities, not against them. 👉 If you need to find an AI, data or cyber expert for your board check out the funded Digital Trustees programme from Third Sector Lab. 👏 Thanks to all the authors of the report, including: Michael Ambjorn Phil Clare Paul Corcoran Pauline Norstrom LLB (Hons) FRSA FIoD FBCS Niran Olarinde Institute of Directors (IOD), India Institute of Directors (IoD) ❓What's your simple advice for boards looking to start their AI conversation?

To perform their duties responsibly, boards must function as Humans + AI. Adopting new working structures and evolved governance structures incorporating AI can lead to substantial performance improvement. Much of my current work with boards is on strategic framing for AI and in AI-augmented decision-making, but there is considerably more potential. A very nice HBR piece brings real-world insights to bear. The first finding was that directors and chairs largely failed to recognize the value and potential of AI in their work. However still many boards and directors are using AI in useful ways. MEETING PREPARATION Directors who use LLMs reported significantly improved understanding of agenda items and reduced workload. One director across five Danish boards uses AI to structure presentations and run simulations; another in Switzerland uses it to refine board discussion questions from the board book. SCENARIO PLANNING GenAI, used well, can be an excellent tool for rapid scenario planning. One board in Austria used an LLM to analyze geopolitical risk in an acquisition proposal. This led to it rejecting the deal, and resulted in management attaching scenario analyses to future proposals. ADDITIONAL PERSPECTIVES Boards in Finland and the Netherlands used AI to test their own strategic conclusions, finding significant overlap between AI-generated insights and their human decisions. This boosted both their confidence in the decisions and their trust in AI’s utility, particularly for validating or challenging complex judgments. IMPROVING BOARD DYNAMICS AI can offer real-time feedback on boardroom dynamics. For example, a Swiss industrial company uses AI to analyze speaking time, tone, and engagement during meetings, creating recommendations for better group engagement. The article addresses potential risks: 🔐 Information leaks. These stem not from AI itself but from poor data governance, which can be mitigated with proper access controls and security training. ⚖️ Sample bias. Regular audits and user awareness are key to avoiding flawed, discriminatory, or incomplete insights. 🧭 Anchoring in the past. AI can be overly reliant on historical data. Scenario simulations and reasoning models can help boards anticipate and adapt to future shifts. And concludes with recommendations on learning to use AI well: 1️⃣ Create engagement. Chairs should start with one-on-one conversations to assess AI literacy and follow up with tailored training to build confidence and interest. 2️⃣ Practice collective experimentation. Boards should test AI tools together in low-stakes settings, debrief their experiences, and gradually integrate AI into governance processes. 3️⃣ Maintain momentum. Chairs must lead by example, celebrate AI use regardless of outcomes, and embed AI progress into board evaluations. I am currently working on a 'GenAI in the Boardroom' mini-report that I will be sharing soon, addressing these and a range of other issues and possibilities.

4 AI Governance Frameworks To build trust and confidence in AI. In this post, I’m sharing takeaways from leading firms' research on how organisations can unlock value from AI while managing its risks. As leaders, it’s no longer about whether we implement AI, but how we do it responsibly, strategically, and at scale. ➜ Deloitte’s Roadmap for Strategic AI Governance From Harvard Law School’s Forum on Corporate Governance, Deloitte outlines a structured, board-level approach to AI oversight: 🔹 Clarify roles between the board, management, and committees for AI oversight. 🔹 Embed AI into enterprise risk management processes—not just tech governance. 🔹 Balance innovation with accountability by focusing on cross-functional governance. 🔹 Build a dynamic AI policy framework that adapts with evolving risks and regulations. ➜ Gartner’s AI Ethics Priorities Gartner outlines what organisations must do to build trust in AI systems and avoid reputational harm: 🔹 Create an AI-specific ethics policy—don’t rely solely on general codes of conduct. 🔹 Establish internal AI ethics boards to guide development and deployment. 🔹 Measure and monitor AI outcomes to ensure fairness, explainability, and accountability. 🔹 Embed AI ethics into product lifecycle—from design to deployment. ➜ McKinsey’s Safe and Fast GenAI Deployment Model McKinsey emphasises building robust governance structures that enable speed and safety: 🔹 Establish cross-functional steering groups to coordinate AI efforts. 🔹 Implement tiered controls for risk, especially in regulated sectors. 🔹 Develop AI Guidelines and policies to guide enterprise-wide responsible use. 🔹 Train all stakeholders—not just developers—to manage risks. ➜ PwC’s AI Lifecycle Governance Framework PwC highlights how leaders can unlock AI’s potential while minimising risk and ensuring alignment with business goals: 🔹 Define your organisation’s position on the use of AI and establish methods for innovating safely 🔹 Take AI out of the shadows: establish ‘line of sight’ over the AI and advanced analytics solutions  🔹 Embed ‘compliance by design’ across the AI lifecycle. Achieving success with AI goes beyond just adopting it. It requires strong leadership, effective governance, and trust. I hope these insights give you enough starting points to lead meaningful discussions and foster responsible innovation within your organisation. 💬 What are the biggest hurdles you face with AI governance? I’d be interested to hear your thoughts.

7 questions every board should ask before claiming AI readiness. Spoiler: It’s not “Do we have the tech?” Most AI failures aren’t technical. They’re cultural, political, and invisible. Boards have to lead the change, not the tools. 1️⃣ Is our culture ready for AI-scale change? About 70% of transformations stall or underdeliver. AI is even more fragile without cultural readiness. If the middle stalls, strategy dies before delivery. Fund the change, not just the tools and pilots. Reward behaviors that ship AI, not status reports. 2️⃣ Do employees trust our AI intentions? Up to 60% of employees distrust internal AI plans. Fears: layoffs, surveillance, biased decisions, errors. Distrust drains adoption, output, and brand goodwill. Give clear intent, guardrails, and shared upside. Let teams co-design workflows before rollout. 3️⃣ Can we prove our AI data is secure? 78% of breaches trace to weak controls and handling. GDPR and the EU AI Act raise the price of failure. Fines can reach 7% of global turnover. And headlines. Prove lawful data use, retention, and vendor paths. Be audit-ready before the first use case ships. 4️⃣ Will our AI use stand up to ethics tests? 56% of customers walk over perceived unethical AI. Ethics is a market signal, not a press release. Bias and opacity create legal and trust exposure. Build red lines, testing, and escalation paths. Hold the line when targets tempt shortcuts. 5️⃣ Who owns an AI mistake when it happens? Who signs their name to AI decisions that go wrong? Personal liability is moving toward executives. ‘The vendor did it’ will not survive scrutiny. Name owners, forums, and incident playbooks. Run failure drills before the real incident. 6️⃣ Can we explain any AI decision clearly? Explainability is now an investor and regulatory ask. Boards must defend a hard AI call in plain words. If you can’t explain it, you can’t defend it. Log decisions, data, and model versions by default. Practice the briefing before you need the briefing. 7️⃣ Do we control AI risk in our supply chain? About 65% of AI risk rides on third parties. Opaque models and weak clauses become your liability. Audit the stack: data, models, and human review. Contract for transparency, testing, and remedies. Replace vendors who won’t meet your standard. AI readiness is not a project. It’s a habit. Governance is a daily practice, not a deck. Lead before regulators and headlines do. Is your firm AI-ready?

𝐓𝐡𝐞 𝐦𝐨𝐬𝐭 𝐞𝐱𝐩𝐞𝐧𝐬𝐢𝐯𝐞 𝐛𝐥𝐢𝐧𝐝 𝐬𝐩𝐨𝐭 𝐢𝐧 𝐭𝐨𝐝𝐚𝐲’𝐬 𝐛𝐨𝐚𝐫𝐝𝐫𝐨𝐨𝐦𝐬? Not cyber. Not ESG. 👉 It’s AI illiteracy. Boards spent the last decade learning that cybersecurity isn’t just an IT problem - it’s a governance issue. Now the same shift is happening with AI. Here’s what AI-literate directors now ask: 1️⃣ Where are AI tools being used (officially and unofficially)? Who owns them? 2️⃣ Does this system fall into the EU AI Act’s ‘high-risk’ category - and if so, who’s liable if it fails? 3️⃣ What metrics matter? (e.g., accuracy drift, bias test results, override rates, model lineage, audit logs). 4️⃣ Do our contracts protect us on IP, data rights, indemnities, and audit rights? 5️⃣ What’s our incident playbook if an AI tool makes the wrong call? The piece most boards still miss: AI adoption isn’t just about policies. 𝐼𝑡’𝑠 𝑎𝑏𝑜𝑢𝑡 𝑝𝑒𝑜𝑝𝑙𝑒. You need to see how your teams are really using AI - and then make good practice easy, and bad practice hard. Practical moves for this quarter: ✅ Map AI use cases across the business (in-house + vendor). ✅ Define your “red lines” - the AI uses your business will not allow. ✅ Upgrade key contracts with specific AI clauses on IP, data, and liability. ✅ Run a tabletop exercise: simulate an AI failure and test your response. ✅ Build literacy with one dedicated AI board briefing per quarter. ✅ Ask the ROI question: how can we maximise real value from AI (not just experiments)? 💡 If AI misfires, the headlines won’t name the algorithm. They’ll name the board. AI literacy is the new fiduciary hygiene. 👉 Directors know they need to catch up fast. 👉 AI experts - how can directors get AI literate? 𝐃𝐫𝐨𝐩 𝐲𝐨𝐮𝐫 𝐛𝐞𝐬𝐭 𝐭𝐢𝐩𝐬, 𝐫𝐞𝐬𝐨𝐮𝐫𝐜𝐞𝐬, 𝐰𝐞𝐛𝐢𝐧𝐚𝐫𝐬, 𝐞𝐯𝐞𝐧𝐭𝐬 𝐚𝐧𝐝 𝐩𝐞𝐨𝐩𝐥𝐞 𝐭𝐨 𝐟𝐨𝐥𝐥𝐨𝐰 𝐢𝐧 𝐭𝐡𝐞 𝐜𝐨𝐦𝐦𝐞𝐧𝐭𝐬 𝐛𝐞𝐥𝐨𝐰 ⬇️ #BoardGovernance #AILiteracy #RiskManagement #EUAIAct #CorporateStrategy

Stop debating #AI ethics. Start governing. If you work in boards, risk or tech, this new white paper captures where organisations truly stand today. It blends leadership insights with the Voluntary AI Safety Standard and turns ten abstract guardrails into practical action. Three takeaways that matter - Confidence and adoption still lag. The solution is not more hype. It’s accountable practice, risk clarity and capability uplift. - ESG is a powerful entry point. Use existing reporting muscles to stand up data governance, bias monitoring and human-centred design, then layer AI-specific risks on top. - Contestability is non-negotiable. Build responsibility, auditability and redressability into every AI workflow so people can challenge outcomes and you can fix issues fast. Quick guardrail checklist to start this quarter - Name an executive owner for AI, publish your approach and train your teams - Run impact-based risk assessments and test before and after deployment - Lock in data quality, provenance and cybersecurity across the supply chain - Disclose when AI is in the loop and give users clear ways to contest results - Keep an AI inventory and documentation that stands up to scrutiny If you are moving from slides to practice, this paper is worth your time. It’s practical, balanced and usable across both SMEs and large enterprises. I’ll ask for just one thing. If this piece gave you something to think about, please share it with your network or tap the like button. Your support helps me continue producing thoughtful, useful content on Responsible AI and Governance that truly serves this community. #ResponsibleAI #AIGovernance #AISafety #ESG #RiskManagement #Boards

The real AI threat is not the model - It’s the boardroom mindset! Most organisations don’t fail at AI because the technology disappoints. They fail because the foundations around it aren’t ready. Deloitte’s AI ROI: The paradox of rising investment and elusive returns (October 2025) shows that although AI spending keeps rising, many organisations still struggle to convert that investment into measurable results. MIT’s The GenAI Divide: State of AI in Business 2025 (August 2025) goes even further. It reports that almost 95 percent of generative AI pilots fail to deliver meaningful business value. The message is clear. Technology’s moving quickly. yet the organisational systems required to govern it aren’t keeping pace. If boards want AI to be safe, strategic and genuinely transformative, they’ve got to treat adoption as a core governance responsibility. Not a technical upgrade. Not a digital project. A leadership decision that starts at the top. That’s where the four L’s matter. Legacy Legacy isn’t just old systems. It’s the thinking that sits beneath them. Boards need the courage to identify where inherited assumptions, outdated risk appetites and old strategic narratives are blocking progress. AI exposes legacy thinking more quickly than any previous wave of technology. Leadership begins with noticing where we’re still anchored to a past that no longer fits. Lethargy AI moves at a pace that traditional governance wasn’t built for. Lethargy shows up when boards assume they’ve got more time than they do. McKinsey’s research consistently shows that early movers gain a measurable acceleration premium. The board’s role is to make sure momentum doesn’t stall under the weight of competing priorities or cautious comfort. Leadership Leadership here means clarity, alignment and oversight. Not sponsorship alone. Boards must set direction, shape guardrails and create the conditions for executives to deliver AI safely and confidently. Without leadership, AI becomes experimentation rather than transformation. Learning Learning is the L we rarely name and the one that determines whether the other three succeed. Boards can’t oversee what they don’t understand. Learning has to run across the organisation, not just at the top. The People and Culture committee should supervise this with the same seriousness it gives to risk and remuneration. MIT and Deloitte both highlight the same truth in 2025. Organisations with broad AI literacy create more value and deploy AI more safely. AI won’t fail because it’s risky. It’ll fail where boards don’t learn quickly enough, let go of legacy thinking, or provide the leadership and pace required to carry the organisation forward. Boards that embrace all four L’s will be the ones that turn AI from an idea into a strategic advantage.

Most boards are approving AI strategies they cannot challenge. That is not governance. It is exposure with a board resolution attached to it. KPMG and INSEAD just published AI Governance Principles for Boards. Every director should read it. Here is what it says and what it leaves unsaid. The report opens with a line worth sitting with. AI does not give boards the luxury of time to observe first movers and incrementally adjust. Boards were built for deliberate oversight. Quarterly reviews. Annual strategy sessions. Measured judgment over long time horizons. AI does not operate on that rhythm. And that gap is not a technology problem. It is a governance problem. The five principles. Here is how I read each one. 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲 𝟭. Strategic oversight for long-term value creation. The boards asking the wrong questions ask what AI can do. The ones that will look prescient in five years ask what AI makes irrelevant about the business they currently have. 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲 𝟮. Active technology and security oversight. When a critical AI vendor fails or is legally prevented from operating in your jurisdiction, can your organization continue? At most organizations I have worked with, the answer is no. Not because the risk was unknown. Because the dependency was never mapped at board level. 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲 𝟯. Workforce transformation and human accountability. An AI system making a consequential decision with no human in the chain does not remove liability. It relocates it. Usually to the board. 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲 𝟰. Building trustworthy AI. Governance is not the constraint on AI adoption. It is the architecture that makes sustainable scale possible. 𝗣𝗿𝗶𝗻𝗰𝗶𝗽𝗹𝗲 𝟱. The work of the board itself. A board that cannot interrogate an AI output cannot govern an organization that depends on them. Not a future gap. A present one. Here is my honest assessment after working inside Fortune 500 boardrooms and C-suites on AI transformation. The organizations losing ground on AI right now are not losing because they lack ambition. They are losing because the people at the top do not have the framework to govern what the people in the middle are building. That gap compounds every quarter it goes unaddressed. 💾 Save this before your next board meeting. ♻️ Repost this for a board member or executive treating AI as a management issue rather than a governance imperative. Follow Gabriel Millien to stay ahead in AI while everyone else plays catch-up.