The accuracy problem and consequential liabilities outside your AI policy.

Most AI policies are considering, and most cover the same ground. Approved tools, acceptable use, data handling, human review of outputs, a register of systems, a line on shadow usage. That work is necessary and it is largely under way. It has one thing in common: all of it concerns AI the organisation controls.

Consider also your second exposure, and it does not appear in those policies because it does not involve a system anyone in the business procured. Customers use external AI before contacting you. Staff use it instead of the intranet. Investors and journalists use it to get oriented before a call.

01What this looks like in practice.

In an anonymised case in which AI read a published results table and assigned revenue to the wrong business segment or year. The approved figures were correct. The information reaching the reader was not.

The pattern repeats in more consequential places. A pharmaceutical microsite carried administration guidance for a withdrawn medicine, and AI returned it as current clinical instruction. The website had stayed online after the programme ended, with no process to retire it.

In another account, outdated chemical storage temperatures & incorrectly ordered procedures reached the people handling the material, while the documents themselves looked correct on screen.

In a third, an obsolete partner promotion was returned as current, held on a site the financial-services firm had not recorded centrally.

Four different failure modes sit inside those examples, and they are worth separating because they need different fixes.

None of these is a content quality problem in the conventional sense. Each piece of material would pass a proofread.

02Why nobody owns it, leaving those at the top vulnerable.

Work out where the accountability sits and the exercise usually stalls. Content owners approved material that was accurate when approved. IT did not build the system that misread it. Communications published what it received. Compliance signed off the version that went live. The digital team maintains the current estate, not the parts of it that were supposed to have been retired. Legal reviews claims, not what happens to claims 2 years later.

The failure occurs after each existing control has done its job correctly. That is why it survives: it falls between functions rather than inside one.

This matters for you specifically. If you raise it without establishing ownership, the most likely outcome is that it is handed to you, unbudgeted, on the basis that you are the person who mentioned AI.

03Establish the position before you raise it.

5 steps, in order. They can be done at small scale first.

04The argument that lands.

When you do table it, the regulatory framing carries more weight than the technology framing.

Provision 29 of the UK Corporate Governance Code applies on a comply-or-explain basis to financial years beginning on or after 1 Jan. 2026, requiring a declaration on the effectiveness of material controls at the balance-sheet date across operational, reporting and compliance controls where these are material. This is the single most useful hook, because it converts a discretionary concern into a reporting question with a date attached.

For firms within the FCA’s Consumer Duty, testing communications and regularly monitoring their impact on retail customer outcomes are already required where appropriate, and where that work identifies problems, firms must investigate and correct the deficiency, including by adapting communications. Nothing new is being asked for here. The obligation already exists.

On safety exposure, HSE explains that directors and similar officers can be prosecuted alongside the company where its offence involves their consent, connivance or neglect. Put this carefully. An inaccurate AI answer does not meet that threshold, and overstating it will cost you credibility in the room. What it establishes is that board knowledge and board action are inside the legal picture rather than outside it.

2 useful points of precision. Under SEC guidance, leaving information accessible in an archive is not in itself a reissue, so an external AI error should be assessed separately from a statement the company issues or adopts. And Delaware’s Marchand v Barnhill allowed an oversight claim to proceed without deciding final liability; the standard it applied is demanding, and the question it turned on was whether the board had a monitoring system at all.

For context on how common the underlying concern is: Gallagher’s 2026 survey of more than 1,200 businesses put AI errors, misinformation and hallucinations at the top of the list of perceived threats, at 57%, while fewer than half of those businesses had a formal AI risk management framework or an AI-specific incident response plan.

05What the board will ask you.

Have answers ready for these before the meeting, because they are the reasonable follow-ups and you do not want to be discovering them live.

The last of these is worth preparing properly. Gallagher’s survey found 1 in 5 insurance professionals reporting a client AI-related loss in the past year, with just over half fully covered, and policy wordings widely regarded as written for a pre-AI world. A CFO who has dismissed the operational argument will often engage with the insurance one.

06Where to start.

Take the 10 most consequential pieces of published information in your organisation. Ask the questions a customer or investor would ask about them. Compare the answers to what you approved.

That exercise takes an afternoon and produces either a finding or a clean bill of health. Both are worth having before the conversation happens without you.

Sources.

Regulatory material, court and supervisory documents, survey and professional commentary, and the AAAnow case accounts drawn on in this page. Addresses are shown for reference.

1. The results table AI read had its figures in the wrong columns
   Anonymised case account; financial interpretation example. https://aaanow.ai/use-cases/results-table-wrong-columns/
2. A withdrawn medicine still carried full dosing guidance online, and AI served it as current
   Observed, anonymised account; potential consequences are distinguished from established injury. https://aaanow.ai/use-cases/withdrawn-medicine-served-as-current/
3. Chemical handling instructions
   Anonymised observations concerning outdated temperatures and procedure order; potential consequences are distinguished from established injury. https://aaanow.ai/use-cases/staff-handled-instructions-already-replaced/
4. A 2-year-old partner promotion
   Anonymised case account concerning obsolete product information on a partner website. https://aaanow.ai/use-cases/partner-promotion-two-years-on/
5. Financial Reporting Council · UK Corporate Governance Code 2024
   Provision 29, with scope and commencement information · The Code applies to companies listed in the commercial companies and closed-ended investment funds categories; Provision 29 applies to financial years beginning on or after 1 Jan. 2026. https://www.frc.org.uk/docs/6709/html/
6. Financial Conduct Authority · PRIN 2A.5: Consumer Duty, retail customer outcome on consumer understanding
   Particularly 2A.5.10 · Testing, monitoring and adapting communications within the rule’s scope. https://handbook.fca.org.uk/handbook/prin2a/prin2as5
7. Health and Safety Executive · Legislation on leading health and safety
   Individual liability under section 37 of the Health and Safety at Work etc. Act 1974; the reported case accounts are not findings against any director. https://www.hse.gov.uk/leadership/legislation.htm
8. US Securities and Exchange Commission · Commission Guidance on the Use of Company Web Sites
   Release 34-58288, 2008, Sections II.B.1–2 · Previously posted information, restatement, reissue and attribution of third-party information. https://www.sec.gov/files/rules/interp/2008/34-58288.pdf
9. Delaware Supreme Court · Marchand v Barnhill
   Decided 18 Jun. 2019, corrected 19 Jun. 2019, opinion pages 29–37
   Oversight and good faith; reversal of dismissal and remand, with no determination of final liability. https://courts.delaware.gov/Opinions/Download.aspx?id=291200
10. Gallagher · The 2026 AI Adoption and Risk Survey: AI in Action
    Third annual survey of more than 1,200 global businesses. Adoption at 63% against 45% in 2025; AI errors, misinformation and hallucinations the top perceived threat at 57%; fewer than half with formal AI risk frameworks or incident response plans; insurance findings on AI-related losses and policy wording.
    Figures are respondent perceptions across all surveyed businesses, not a director-only sample. https://www.ajg.com/news-and-insights/features/ai-adoption-and-risk-benchmarking-2026/
11. Financial Reporting Council · Corporate Governance Code Guidance
    Paragraphs 264 and 270–278 · Monitoring, material controls, internal audit and discretion over external assurance. https://www.frc.org.uk/library/standards-codes-policy/corporate-governance/corporate-governance-code-guidance/
12. Aon · AI Risk 2026: What Business Leaders Need to Know
    Especially the insurance and D&O sections
    Monitoring evidence supports an insurance discussion; it does not determine cover. https://www.aon.com/en/insights/articles/ai-risk-2026-practical-agenda