Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
Board Members Adopt GenAI Without Policies or Oversight
Your board members may not understand the inner workings of large language models, but that doesn’t mean they aren’t using artificial intelligence to do their board work.
See Also: Accelerate Vector Search for enterprise-scale AI with Elastic and NVIDIA
In fact, 82% of board directors are now using generative AI to help with board-related work, up from 66% just nine months ago. Yet 69% of board members say they have no formal AI policy governing how they should, or should not, be using AI to handle corporate work.
Only 6% say they have a policy specific to board AI use, according to the latest Director Confidence Index, a quarterly survey of U.S. public company directors by Diligent Institute and Corporate Board Member.
For CIOs, this means that the shadow AI problem isn’t just proliferating through your employees. It’s showing up in boardroom too, potentially exposing corporate intelligence and other sensitive information to AI systems the company doesn’t control.
“Shadow AI exists in the boardroom too, and we can’t pretend it doesn’t,” said Dottie Schindlinger, executive director at the Diligent Institute. “We don’t know what they’re doing with GenAI, because we don’t have a policy in place, and we don’t train them. We don’t provide them the right tools. That’s the problem.”
Nearly half of the directors surveyed – 49% – said that they are aware of fellow board members who have used consumer-facing AI tools for board work, and 30% reported using AI themselves to summarize board books and meeting materials, documents that routinely contain proprietary and confidential corporate information.
Board materials are corporate property that could be subpoenaed in the event of a lawsuit, creating further risk. “Any information the board creates is subpoena-able in the event of a lawsuit,” she said. “That’s going to include prompts put into public-facing GenAI tools.”
Schindlinger said this misalignment isn’t because CIOs and IT teams are indifferent to the board’s concerns but rather because they have been too cautious about the privacy and data security risks that giving AI tools to boards could create. But in that information gap, boards have taken the matter to Claude and ChatGPT.
“They’re not providing AI to their board because they’re concerned about privacy risks,” Schindlinger said, “and by not providing their board with understood, known tools, the board is using whatever it wants.”
To correct the problem, CIOs need to partner with legal leadership and boards to create policy, give board members AI tools and teach them how to use them in secure and responsible ways. Typically, board members aren’t using corporate-owned devices to do board work.
Schindlinger outlined a three-step approach for CIOs who want to create AI policies and governance frameworks for the board.
First, IT and legal teams should have a direct conversation with board members to understand what they’re using and how they’re using it. “Just have a no-blame, no-judgment conversation with the board,” she said. “Find out how it’s being used.” For boards where candor feels unlikely in an open setting, Schindlinger recommends using an anonymous survey and asking directors what AI tools they have tried – as well as other board members.
Once CIOs have a clear picture of how the board is using AI, they can select tools that will meet the board’s needs and find solutions that are purpose-built for governance, ring-fenced from public AI models and designed to handle the unique data security requirements of board work.
“Pick tools that are used for governance, built for use in the boardroom, that handle data appropriately, that are completely segregated from public models,” Schindlinger said.
The final piece of the puzzle is creating policy frameworks and training boards on how to use the tools. Policies don’t need to be long, but they should be specific to the board context, Schindlinger said. And training needs to be offered to help directors understand not just what the rules are, but why they exist. “Train everybody on what’s in the policy, why it’s in the policy, what’s not in the policy, why it’s not in the policy,” she said.
For reluctant boards, whether it’s because of AI skepticism or if board members feel secretly guilty about their covert AI use, CIOs should make sure they ask questions and don’t assume they know why board members are hesitating, Schindlinger said. It could just be a lack of confidence.
“Board members are meant to be expert advisors,” she said. “To be caught not knowledgeable on something is uncomfortable.”
Offering simple and straightforward training on basic AI literacy, like how GenAI works, and what it can and can’t do, can help diffuse tension before it arises. And for those who have compliance or regulatory concerns, she said to err on the side of providing more information. “The more detail you can get about any kind of concern or fear or discomfort,” Schindlinger said, “you can address it.”
For CIOs who aren’t sure how to frame the conversation at all, Schindlinger said framing the conversation around the board’s role and playing to egos may help, as well as mentioning the fact that proxy advisors, institutional investors and shareholders are all using AI tools. “You do not want to be behind investors and proxy advisors,” she said. “You don’t want to be behind the market.”