AI is now a leading topic in boardrooms, promising great benefits but also bringing new risks and an unprecedented ability to scale results in both directions. The timeline is amazing. Chat GPT-4 put AI on the boardroom map in 2023, followed by two years of pilots and proofs of concept. Now in 2026, AI is embedded in the production of most industries, and at Davos last month, technology leaders emphasized that we are entering a new phase: agent AI systems that not only assist but operate autonomously. Anthropic CEO Dario Amodei warned that the coming years will be critical to how these systems are regulated and governed before they evolve beyond human control.
The board is approving implementation faster than expanding oversight. 88% of companies regularly use AI in at least one business function, and AI is becoming fundamental to operations. Every use case requires governance. Boards are catching up not only on what AI can do, but also on what damage it can do if it fails. Massachusetts fined a lender $2.5 million for AI misconduct. Deloitte has reimbursed the Australian government for AI-generated errors. Cigna is facing a class action lawsuit over an algorithm that denied more than 300,000 Medicare claims.
And it's broader than the headline. EY's Responsible AI survey found that 99% of organizations reported AI-related financial losses, with 64% exceeding $1 million. Most boards are unable to answer important audit questions about how AI systems make decisions. When regulators ask to see how a model arrived at its decisions, the evidence trail is rarely clear. Illustrating the scope of the risk, 72% of S&P 500 companies report AI as a material risk in their financial disclosures.
The question is why audit trails are so elusive to AI. As deputy chief auditor at IBM, where I supported AI governance and served on the AI Ethics Committee that evaluated client use cases, I watched this regulatory gap widen while boards felt competitive pressure to approve deployments faster.
Audit evidence gap
Therein lies the core issue. Traditional auditing assumes that decisions can be traced back. With AI, that's often not possible. AI models make thousands of decisions a day. Some provide human approval for critical calls, but the rigor of that review varies widely. In many cases, human reviewers are simply confirming what the algorithm has already decided. The logic behind AI's choices resides in statistical patterns across millions of data points that even the model's own developers have a hard time articulating. And unlike traditional processes, AI can produce different outputs with each run, even when working as designed.
This is why AI is labeled as a “black box.” You can tell what went in and what came out, but the inferences between remain hidden. For audit teams, this represents a fundamental shift from asking, “Did the process be done correctly?” “Is this output within the acceptable range?”
agent inflection point
Governance challenges are about to intensify. The AI system approved by the board last year was supportive, recommending actions that a human would take. The systems currently in place are agent-based and operate autonomously. At Davos last month, leaders grappled with AI that operates at what cybersecurity experts call “machine speed” — autonomous agents that make decisions, trigger workflows, and interact with other systems without waiting for human approval.
These are not hypothetical concerns. Salesforce has demonstrated autonomous agents to book meetings and manage meeting attendee schedules, and enterprises are deploying agents for IT operations, customer service, and procurement. This further widens the governance gap. Traditional quarterly audits cannot keep up with systems that are evolving and making thousands of autonomous decisions every day. Boards need real-time monitoring rather than traditional periodic reviews.
What regulators want
Regulators are noticing and responding to the new challenges posed by AI. US states enacted 159 AI laws in 2025, up from 107 in 2024. The EU AI law begins enforcing high-risk system requirements on August 2, 2026, and the FTC has issued enforcement orders requiring comprehensive AI audit documentation from seven companies. With this type of proactive outreach and activity, audit committees must be prepared for regulators to require:
- Can you identify all AI systems in production along with their risk classification?
- How do you verify the accuracy and fairness of your model?
- What is the process for dealing with model failures, or when model failures result in biased results?
- Who will take responsibility if AI makes a wrong decision?
- How do you ensure that AI decisions comply with existing regulations such as fair lending and anti-discrimination laws?
The new landscape is that regulators will demand the same rigor towards AI that exists in financial controls. The good news? We've been here before. Sarbanes-Oxley felt daunting at first, but now it's just part of how companies operate. The bad news? Time is running out this round. Sarbanes-Oxley took years for companies to comply. The EU AI law provides several months, and the FTC is now issuing orders. AI governance will follow the same trajectory, but for now standards are still being developed, which is both a challenge and an opportunity.
Supervisory duties of the audit committee
In most organizations, AI governance sits on the audit committee, at the intersection of risk, compliance, controls, and financial reporting. However, this is not the only responsibility of the audit committee.
The dual mission of boards: reducing risk and creating value
AI governance is about more than just avoiding fines. It's about unlocking long-term competitive advantage. Companies with mature governance frameworks can move from pilot to production more quickly because they already have risk assessment processes and approval workflows in place. The board oversees both aspects.
For audit committees:
- AI inventory and risk classification: Requires visibility into all AI systems in production, including shadow AI deployed through third-party tools and browser copilots. Require administrators to assign clear risk tiers and decision-making authority to each application.
- Governance framework: Extend existing change management and testing processes to cover AI systems and treat them as part of a broader management environment. Recognizing that AI rarely stays within one business function, CEO and CFO sponsorship ensures cross-functional accountability.
- Real-time guarantee: Move beyond quarterly audits to a continuous monitoring system that captures algorithmic drift and bias as they occur. Require results to be reported directly to audit committees, allowing them to intervene before small issues become regulatory issues.
For full board:
- Strategic AI Portfolio: Apply the same rigor to review AI investments alongside M&A and R&D decisions. Require clear ROI hurdles, risk-adjusted returns, and termination criteria for underperforming AI initiatives.
- Reliability and speed metrics: Track whether AI governance is accelerating or constraining your business through customer trust scores, partner trust metrics, and speed of adoption compared to industry benchmarks. Recognize that strong governance builds trust and allows you to close deals that your competitors can't.
- Preparing the agent: Consider which systems are moving from assisted to autonomous, what guardrails exist for autonomous decision-making, and whether your organization can demonstrate control as required by regulators and customers. Position your board ahead of the next wave of AI governance challenges.
the window closes
The pace hasn't slowed down. Agentic AI is already here, and companies rushing forward without governance are exposing their stakeholders to real risk. Multi-million dollar settlements and FTC enforcement signals that we are at a tipping point for AI surveillance. As in the early days of Sarbanes-Oxley compliance, early adopters will do well to embed governance into their culture before regulations force a hasty and costly implementation. Boards that act now will avoid a scramble when federal regulations are finalized, new state laws are passed, or customers file complaints with the FTC.
As I have built Fortune 50 audit programs and governance frameworks, I have seen the initial investment in governance infrastructure pay dividends when regulatory oversight arrives. Boards that lead with AI governance will discover something unexpected. Mature governance is an accelerator, not a constraint, to innovation. If you can demonstrate robust AI governance to your customers, partners, and regulators, you can close deals that your competitors can't. It's not a burden. Seat belts allow you to drive faster.
