Artificial intelligence is rapidly becoming a fixture in the boardroom. Directors are using generative AI to review and summarize materials, prepare for meetings and develop and sharpen questions for management, but governance frameworks addressing directors’ own use of these tools often lag behind.
Public company governance documents increasingly address board oversight of a company’s AI strategy and related risks, but formal guidance governing directors’ use of AI remains uncommon and underdeveloped. In a recent survey of 104 U.S. public company directors, 82% reported using generative AI for board work during the previous six months, yet more than half of these directors said their companies had no guidance concerning directors’ use of AI. Nearly one-third reported using AI to summarize board materials, and only 6% reported a formal policy specific to the board.
Directors’ use of AI raises particular considerations because board materials frequently contain confidential, privileged and market-sensitive information. AI tools may also generate or retain additional records, including prompt histories, transcripts and draft work product, raising records-retention and legal-hold considerations. These concerns support the development of clear company guidance for such use
Governance Considerations
For companies considering board-specific guidance, the goal may not be to create new director obligations but to apply existing responsibilities in a new technological context and to highlight for directors the potential risks attendant to the use of AI tools.
Key considerations include:
- Approved tools and permitted uses. Companies may wish to limit board-related AI use involving nonpublic information to approved, enterprise-grade and company-controlled platforms, and to prohibit the use of personal accounts or consumer-facing AI tools for confidential board materials.
- Protection of confidential and privileged information. Policies should consider limitations on information that may be entered into AI systems, establish role-based access controls, and provide additional safeguards for executive-session materials and privileged communications. Processing protected information through third-party AI tools can jeopardize confidentiality and, depending on the circumstances, attorney-client privilege or work-product protection.
- Human judgment and verification. AI may be a tool to assist directors, but it should not replace a director’s independent judgment. AI-generated summaries, analyses and drafts should be reviewed and verified by directors or management before they are relied upon in board deliberations or incorporated into company records.
- Records management. Companies may also consider protocols governing AI-generated drafts, meeting recordings, transcripts, retention periods and legal-hold requirements.
Attention should be given to AI-enabled note-taking and transcription tools, including providing advance notice to participants, reviewing vendor security and retention practices, and conducting prompt human review of transcripts.
Rather than incorporating detailed operational requirements into publicly disclosed corporate governance guidelines, companies may prefer a principles-based approach. Governance guidelines could include a high-level expectation that directors use AI responsibly and protect company information, while more detailed requirements are addressed in a separate board AI-use policy or an enterprise AI policy expressly applicable to, and reviewed annually by, directors. This approach allows companies to adapt to evolving technology without repeatedly revising public governance documents.
Practical Next Steps
Before adopting public-facing AI governance language, companies should assess their current practices and policies. Questions to consider include whether directors have access to an approved secure AI environment, whether existing enterprise AI policies apply to directors, what uses are permitted or prohibited, which board committee or other body oversees AI governance, and whether any public disclosure would accurately reflect the company’s current controls and practices. As director adoption of AI continues to grow, companies may benefit from establishing clear expectations around approved tools, confidentiality, records management and human oversight. Doing so allows boards to capture AI’s efficiencies without treating the technology as a substitute for director judgment or overlooking the legal and governance risks created by its use.
