Directors’ Duties and Technology Risk Oversight

Boards are increasingly asked what they knew about their organisation’s AI deployment and when they knew it. The oversight record is what answers that, and it is usually thinner than the discussion that produced it.

The duty being engaged

Directors are not required to be technologists. They are required to exercise reasonable care, skill and diligence, and to promote the success of the company having regard to the likely consequences of decisions in the long term, the interests of employees, and the impact of operations on the community and the environment. Applied to technology risk, that means an informed oversight process rather than technical expertise.

What an informed process looks like

• Visibility. The board knows what systems are deployed in material processes, who owns them, and what happens if they fail or produce wrong output.
• Reporting cadence. Technology and AI risk appear on the agenda at a defined frequency, with a written report rather than an oral update.
• Defined risk appetite. A statement of what the organisation will and will not do with automated decision-making, approved at board level and referenced in operational policy.
• Escalation thresholds. Agreed triggers — an incident of defined severity, a regulatory inquiry, a deployment in a defined high-risk category — that bring a matter to the board rather than leaving it to management judgement.
• Independent assurance. Periodic review by someone other than the team that built the system.

The record

Minutes should show the information the board received, the questions asked and the decision taken, including where the board accepted a risk deliberately. A minute recording that a report was noted is evidence of an agenda item, not of oversight. This distinction matters most in exactly the circumstances where the minutes will be read closely.

Practical first step

Ask management for a one-page inventory of automated systems that materially affect customers, employees or financial reporting, with an owner and a failure mode for each. The quality of the answer — and how long it takes to arrive — tells the board most of what it needs to know about the maturity of the underlying governance.