AI governance: 5 questions directors should ask

A company approves its results. Checked, signed off, published. Some time later an investor asks an AI system about the company’s performance and receives figures that were never in the accounts: real revenue, attached to the wrong business segment or the wrong year. AAAnow describes an anonymised case of exactly this.¹

Ask who owns that failure and the answer, in most organisations, is nobody. Finance approved correct numbers. IT did not build the system that misread them. Communications published what it received. Compliance signed off material that was accurate at the point of approval. The error happened after all of that, in a place no one has been made responsible for.

This is not a question about AI strategy or AI tooling. It is a question about whether the information the company publishes still means what it meant by the time people act on it, and about who answers when it does not.

01What to ask.

5 questions, and what a serious answer to each one contains.

Where could AI’s use of our information cause material harm?
A named list of the sources that carry real consequence, across owned and partner sites, not an inventory of all content. Instructions people follow, figures people price on, terms customers rely on.
How do we know our information stays accurate when AI reads it?
Comparisons between approved information and actual AI answers, checking whether figures, dates, qualifications and instructions keep their meaning. A record of discrepancies, and repeat checks after corrections.
Who owns monitoring, escalation and correction?
Named individuals, a threshold for what reaches the board, and reports that track an issue through to resolution rather than to acknowledgement.
What independent evidence do we have that the controls work?
Challenge from internal audit or external specialists. The FRC leaves external assurance to board judgement, so this is a decision the board makes rather than inherits.¹¹
Do our disclosures and insurance reflect this exposure?
Aon reports growing D&O underwriting interest in governance evidence, public-disclosure checks and third-party exposure. Gallagher’s 2026 survey found policy wordings widely regarded as written for a pre-AI world, and 1 in 5 insurance professionals surveyed reporting a client AI-related loss in the past year, with just over half fully covered.^{12 13}

02Why it reaches the board.

The financial example is the mildest version. AAAnow also describes a pharmaceutical microsite still carrying administration guidance for a withdrawn medicine, returned by AI as current clinical instruction, and outdated chemical storage temperatures and incorrectly ordered procedures reaching the people who handle the material. In each case the site had stayed online after the programme ended, with no process to retire it.^{2 3}

Directors’ duties include exercising reasonable care, skill and diligence, and considering the company’s reputation when promoting its success. Where unsafe information raises injury concerns, the exposure runs to individuals as well as to the organisation: HSE explains that directors and similar officers can be prosecuted alongside the company where its offence involves their consent, connivance or neglect.

That is a deliberately high threshold, and an inaccurate AI answer does not meet it. It does establish that what the board knew, and what it did about it, sits inside the legal picture rather than outside it.^{4 5}

Multiple obligations make the position harder to leave open, provision 29 of the UK Corporate Governance Code applies on a comply-or-explain basis to financial years beginning on or after 1 Jan. 2026. This requires a declaration on the effectiveness of material controls at the balance-sheet date, covering operational, reporting and compliance controls where these are material.

For firms within the FCA’s Consumer Duty, testing communications and monitoring their impact on retail customer outcomes are already required where appropriate. And for listed issuers, exchange rules on timely and accurate disclosure apply to an information incident as they would to any other.^{6 7 8 9}

Delaware’s Marchand v Barnhill is the reminder from the other direction. The judgment emphasised good-faith efforts to establish board monitoring and reporting on central compliance risks, and allowed an oversight claim to proceed without deciding final liability. The standard it applied is demanding. The question it turned on was whether the board had a system at all.¹⁰

03The answer that matters.

Ask for 3 things at the next board discussion: the information risks currently monitored, the significant issues still unresolved, and evidence that corrections have held.

If those cannot be produced, that is the finding. Gallagher’s survey found 63% of businesses had operationalised AI or implemented it within parts of the organisation, up from 45% a year earlier, while fewer than half had a formal AI risk management framework or an incident response plan for AI. Most boards are not yet in a position to answer.

The ones that establish where they stand now will be answering the question on their own terms rather than someone else’s.¹³

Sources.

Regulatory material, court and supervisory documents, survey and professional commentary, and the AAAnow case accounts drawn on in this article. Addresses are shown for reference.

The results table AI read had its figures in the wrong columns ·
Anonymised case account; financial interpretation example. https://aaanow.ai/use-cases/results-table-wrong-columns/
A withdrawn medicine still carried full dosing guidance online, and AI served it as current
Observed, anonymised account; potential consequences are distinguished from established injury. https://aaanow.ai/use-cases/withdrawn-medicine-served-as-current/
Chemical handling instructions
Anonymised observations concerning outdated temperatures and procedure order; potential consequences are distinguished from established injury. https://aaanow.ai/use-cases/staff-handled-instructions-already-replaced/
Companies House · Being a company director
General duties, including promoting company success and reasonable care, skill and diligence. https://www.gov.uk/guidance/being-a-company-director
Health and Safety Executive · Legislation on leading health and safety
Individual liability under section 37 of the Health and Safety at Work etc. Act 1974; the reported case accounts are not findings against any director. https://www.hse.gov.uk/leadership/legislation.htm
Financial Reporting Council · UK Corporate Governance Code 2024
Provision 29 · The Code applies to companies listed in the commercial companies and closed-ended investment funds categories; Provision 29 applies to financial years beginning on or after 1 Jan. 2026. https://www.frc.org.uk/docs/6709/html/
Financial Conduct Authority · PRIN 2A.5: Consumer Duty, retail customer outcome on consumer understanding Particularly 2A.5.10 · Testing, monitoring and adapting communications within the rule’s scope. https://handbook.fca.org.uk/handbook/prin2a/prin2as5
London Stock Exchange · Admission and Disclosure Standards
Effective Jul. 2024, Section 1.7 · Timely price-sensitive disclosure under applicable UK MAR and regulatory requirements. See also Financial Conduct Authority, UKLR 2.2: The Listing Principles, and Nasdaq, 5200 Series, Rule 5250(b)(1). https://docs.londonstockexchange.com/sites/default/files/documents/admission-and-disclosure-standards.pdf
New York Stock Exchange · 2026 Annual Guidance Letter
Page 5, referring to Listed Company Manual Sections 201 and 202 · Material news and factual accuracy. https://www.nyse.com/publicdocs/nyse/markets/nyse/NYSE_2026_Annual_Guidance_Letter.pdf
Delaware Supreme Court · Marchand v Barnhill
Decided 18 Jun. 2019, corrected 19 Jun. 2019, opinion pages 29–37
Oversight and good faith; reversal of dismissal and remand, with no determination of final liability. https://courts.delaware.gov/Opinions/Download.aspx?id=291200
Financial Reporting Council · Corporate Governance Code Guidance
Paragraphs 264 and 270–278 · Monitoring, material controls, internal audit and discretion over external assurance. https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/
Aon · AI Risk 2026: What Business Leaders Need to Know
Especially the insurance and D&O sections
Monitoring evidence supports an insurance discussion; it does not determine cover. https://www.aon.com/en/insights/articles/ai-risk-2026-practical-agenda
Gallagher · The 2026 AI Adoption and Risk Survey: AI in Action
Third annual survey of more than 1,200 global businesses.
Figures are respondent perceptions across all surveyed businesses, not a director-only sample. https://www.ajg.com/news-and-insights/features/ai-adoption-and-risk-benchmarking-2026/

All articles