AI Governance Is Now a Board-Level Responsibility, Not an IT Problem
For years, boards treated artificial intelligence as a technical matter best left to the IT function. That assumption no longer holds. AI systems now make or heavily influence decisions that shape the financial health and public standing of the organisation. When an algorithm decides who receives credit, what price a customer pays, or which candidates progress through a hiring process, the consequences reach far beyond the server room. They reach the balance sheet, the regulator's desk, and the front pages. These are board-level outcomes, and they demand board-level ownership.
Consider the risks in concrete terms. A credit model that quietly discriminates against a protected group exposes the firm to enforcement action, litigation and remediation costs that run into millions. A pricing engine that charges vulnerable customers more triggers regulatory scrutiny and lasting reputational damage. A recruitment tool that filters out qualified applicants on biased grounds invites employment tribunals and public criticism. In each case the harm is not merely operational. It strikes at the trust that underpins the entire enterprise, and rebuilding that trust takes years. Directors who dismiss these matters as technical detail misunderstand where accountability ultimately rests.
The regulatory direction of travel reinforces this point. Supervisors across financial services, employment and consumer protection increasingly expect senior leaders to demonstrate that they understand and control the automated systems operating in their name. Saying that the model was too complex to oversee will not satisfy a regulator, and it will not satisfy shareholders. The board carries the duty to ensure that the organisation deploys AI responsibly, that it can explain how key decisions are reached, and that appropriate controls exist to catch failures before they cause harm.
To meet this duty in a structured way, boards should adopt the three lines of defence model, a framework risk officers already know well from other domains. The model brings clarity to who does what, and it prevents oversight gaps where everyone assumes someone else is watching. Applied to AI, it turns a vague sense of concern into a disciplined system of accountability.
The first line of defence sits with the business and technical teams that build and operate AI systems. These are the model developers, data scientists and product owners who make daily decisions about design, training data and deployment. They own the risk at source, and they must embed controls into their work, document their choices, and test their systems for bias, accuracy and stability before and after launch. Good governance begins where the models are actually built.
The second line of defence provides independent challenge and oversight. This is the domain of risk and compliance functions, which set the standards, review the models against those standards, and hold the first line to account. They ask the difficult questions that operational teams may overlook under commercial pressure. They maintain an inventory of AI systems, assess each one for its risk profile, and ensure that high impact models receive the scrutiny they deserve. Crucially, this line reports in a way that gives the board a clear and honest view of where problems lie.
The third line of defence is internal audit, which offers independent assurance that the first two lines are working as intended. Audit does not run the models or set the standards. Instead it verifies that the controls exist, that they operate effectively, and that the governance framework is more than a document on a shelf. When internal audit reports to the board on AI, directors gain confidence that the assurances they receive from management can be trusted.
For this model to work, the board must actively engage rather than passively receive. Directors should ensure that a named executive owns AI risk, that the board sees a regular and honest picture of the organisation's most significant AI systems, and that the necessary skills exist around the table to interrogate what they are told. This does not require every director to become a data scientist. It requires them to ask sharp questions, to insist on clear answers, and to treat AI risk with the same seriousness they apply to capital, liquidity and conduct.
The message for boards and risk officers is straightforward. AI is no longer an experimental tool confined to the technology team. It is a driver of core commercial decisions with real financial and reputational stakes, and responsibility for those stakes cannot be delegated away. By owning AI governance directly and structuring it through the three lines of defence, boards can harness the value of these systems while keeping the organisation safe. The firms that act now will be the ones that avoid the costly failures others are yet to discover.