As artificial intelligence moves deeper into operations, strategy and infrastructure, directors are being asked to provide oversight on systems that didn’t exist when most board structures were built.
During CBM’s recent Directors Forum, Sheila Bangalore, director at Games Global, Paloma Health and StoneAge Waterblast Tools, and Samantha Kappagoda, director at Credit Suisse Funds and chief data scientist at Numerati Partners, shared strategies for adapting to this moment of AI oversight. Some practices worth considering:
Be deliberate with oversight. AI oversight doesn’t always fit neatly into existing committees. Some boards are moving AI into audit or risk, but others are creating standalone oversight channels. What matters most is intentionality and coordination.
“In one of our boardrooms, we were pretty intentional about designing a risk and compliance committee that was distinct from audit because we have big aspirations,” said Bangalore. “We designed a full risk framework that is specific to our business. The framework not only addresses quantitative but qualitative components because reputational risk is a serious issue.”
Avoid silos. Because AI touches multiple risk domains—technology, operations, reputation, talent—oversight should not be siloed. Cross-committee membership and coordinated reporting cycles help create alignment and reduce gaps.
“My audit committee chair sits with me on my committee. I chair the risk and compliance committee, and I sit on audit. And this also ensures fluid communication between the board.”
Anchor oversight in the business. Oversight needs to be tailored to the company’s size, regulatory exposure and strategic objectives. For some, AI is core to the business model; for others, it’s a tool for efficiency. Risk tolerance, data sensitivity and sector maturity all factor in. “It is very context-specific,” said Kappagoda. “There is no one size fits all here.”
Press for an AI talent and compensation strategy. Boards don’t hire technical staff—but they are responsible for ensuring that resource allocation aligns with strategic goals. That includes understanding how technical talent is being sourced, managed and retained—especially in a hyper-competitive AI labor market.
“The board is not going to get granular into all the details, but what we do need to understand is the series of questions to be asking,” said Bangalore. “How is it that you’re thinking about the talent management strategy around the AI team that we’re hiring? Why are we ready to spend that kind of money? Because guess what? It’s a very significant investment.”
Kappagoda agreed. “The board can ask questions about key metrics and KPIs for that.”
Understand the tools yourself. As generative AI proliferates, boards—and board members themselves—need to understand how to use those tools correctly and how they may be being used inside their organizations, including by directors and executives. Use policies should address IP, confidentiality, data handling and training risk.
Kappagoda knows peers who have put proprietary information into ChatGPT without really thinking through the potential risks. “I’ve asked the question, is that the version on your phone? Is it an enterprise version? Are there any guardrails, or is it just like the free version? What is it? This is material non-public information you’re putting in. What happens to it? You have no idea. That’s like leaving a board document binder on the plane.”
Ask the biggest question of all. The most important question boards should be asking management about AI oversight is the most fundamental one, said Bangalore: Why are we using it? “Is it a lever to try to compete? Is it to disrupt? What are you using it for?” said Bangalore. She stresses doing tabletop exercises and war gaming, “particularly if you’re about to spend significant dollars around AI deployment.”
“There’s so much opportunity,” said Kappagoda, “but every company has to take small bites. Not every company is a large behemoth technology company. Everyone else can start and test and have sandboxes and proofs of concept. There has to be consideration for the risks. But this space is moving very fast, and we don’t want to get left behind.”
