Memorandum
- From
- Delaney Sawyer via Fast Company
- Date
- Filed
- Business·5 min to read
- Re
Boards Face Growing AI Oversight Gap as Risk Disclosures Surge
ReBoards Face Growing AI Oversight Gap as Risk Disclosures Surge
The share of S&P 500 companies flagging AI as a risk jumped from 12% to 83% between 2023 and 2025, yet fewer than 3% of directors have AI expertise and only 23% of executives describe their board as highly fluent in the technology. Governance experts argue that recruiting AI specialists is not enough: oversight must be distributed across the board and measured by what directors actually do, not what they know.
The share of S&P 500 companies that disclose artificial intelligence as a risk factor climbed from 12% to 83% between 2023 and 2025, according to company filings. Over the same period, fewer than 3% of directors have acquired AI expertise, and only 23% of executives described their board as highly fluent in AI, with a quarter saying it had low fluency or none at all.
The figures point to a widening gap between what boards are required to oversee and what they actually understand. As AI spreads through hiring, pricing, customer service, credit and operations, directors are being asked to vote on matters shaped by the technology whether or not they realize it. Governance researchers argue that gap is untenable and that closing it requires more than a single expert seat at the table.
Recruiting directors with AI credentials is the obvious response, but it is not sufficient on its own. AI is not siloed in one department, so there is no single agenda item for one expert to own. Oversight must be distributed across the full board rather than concentrated in a limited number of specialist seats. Expertise is also not the same thing as competent oversight: expertise is what a director knows about AI, while oversight is what a director does about it. Someone can understand exactly how a large language model works without ever asking who in the company is accountable for one, or what an AI agent is permitted to spend.
Boards therefore face two separate questions. The first is whether the board collectively knows enough about AI. The second is whether each individual director is competent at oversight. Answering the first does not answer the second, and while attention focuses on the first, the second is largely neglected.
Research into how directors oversee AI identifies several foundational areas where the technology can do real damage to a company. Boards need to know which individual is accountable for each AI matter and whether that person is actually held accountable. They need evidence of what data the company's AI uses, where it goes and on what legal basis, rather than a vendor's assurance. They must ensure the company can explain an AI decision to the person it was made about, and that public claims about AI match what the company does.
Directors also need to know which groups a system could disadvantage, when it was last tested and whether problems were fixed rather than merely recorded. They should understand what the company's AI can do that cannot be undone, and how the board would hear about a failure. They must confirm that a person can overrule a system in practice, not just on paper, and that workers whose jobs AI changes are part of the plan. And they need to know what AI agents may do, spend and commit on their own, with limits and a way to stop each one.
Three principles can help boards build competent oversight. The first is to measure what directors do rather than what they know. The strongest evidence of ability is regularly performing a task to a high standard, so boards should ask whether directors have actually carried out basic AI oversight recently, how often, and whether it is a systematic part of the process. In PwC's 2025 survey of public company directors, two-thirds said their board should spend more time on AI, but fewer than half said their board had an approach to overseeing it. Almost every director would agree the board should know which AI systems the company uses; far fewer have asked to see the list, and fewer still request it at every review of AI risk.
The second principle is to assess the floor rather than the average. A director's level is set by their weakest competency, not their average, a logic boards already accept for financial controls. Under U.S. auditing standards, a single material weakness means internal control over financial reporting cannot be considered effective, however strong everything else is. AI oversight deserves the same standard. Directors gravitate to the questions they are comfortable asking, and depth in one area can become a reason to skip the others. The floor is not a demand that every director become an expert in everything, but a minimum standard every director clears in every area.
4
