本文目前仅提供英文版本。
What Boards Need to Know About AI Governance in 2026: Director Duties, Liability, and Oversight
AI governance is now a board-level responsibility. Directors who cannot demonstrate meaningful oversight face personal liability exposure, regulatory scrutiny, and institutional investor pressure.
Key Takeaways
Director duties of care and diligence apply to AI governance. ASIC has explicitly stated that deploying AI without understanding its risks could constitute a failure of the duty of care — this principle applies under equivalent statutes globally.
Institutional investors with ESG mandates are developing AI governance expectations. ISS and Glass Lewis are incorporating AI governance into director evaluation criteria, beginning to affect re-election votes.
Boards should understand what AI systems the organisation uses, for what decisions, and what the consequences of failure would be — as a governance-oriented risk view, not a technical inventory.
Board-approved AI governance framework is now expected: articulating principles, risk categorisation, oversight processes, monitoring, and ethics approach.
Regular AI risk reporting to boards should cover: significant AI incidents, new AI deployments, audit findings, regulatory developments, and material third-party AI changes. Quarterly is appropriate for most organisations.
The EU AI Act, APRA's CPS 230, and FCA's Senior Manager and Certification Regime all create documented board-level accountability for AI governance.
"仅供参考。本文不构成法律、监管、财务或专业建议。如需具体指导，请咨询合格专家。"
Why AI governance is now a board matter
Director duties of care exist across major jurisdictions — Australia's Corporations Act s180, UK Companies Act 2006 s174, Delaware corporate law, and equivalents globally. ASIC has applied this specifically to AI: directors of organisations deploying AI in significant decisions should demonstrate understanding of what AI systems are deployed, what decisions they inform, what governance frameworks exist, and how AI risks are monitored. The FCA's SM&CR creates personal accountability for senior managers for oversight of material operational risks including AI.
What effective board oversight looks like
Boards do not need technical AI expertise. They need to ask the right questions, receive meaningful reporting, and exercise independent judgement about risk appetite. Key elements: understanding the AI footprint (what AI makes or informs consequential decisions); board-approved governance framework; regular AI risk reporting (quarterly); and at least one director able to engage meaningfully with AI governance questions.