_8867.jpg)
For many organizations, AI is now being viewed as an enterprise-wide risk, along with financial and cybersecurity oversight, demanding regular and robust attention in the boardroom.
What used to be a mere tool can act autonomously in multiplying capacities. And as public and private corporations increasingly leverage the technology to create more value, AI governance and oversight will be vital to addressing AI risk and strategy.
Matt Johnson, KPMG’s Leader of AI Audit and Assurance, says that oversight committees need to assess, and potentially evolve, governance structures to clarify accountability, create transparency, and evolve auditability across the business. All without slowing innovative value creation. “Effective directors know this is more than technology,” he says. “But at the same time, many of them admit that they need to learn where to begin – what questions they should even ask.” KPMG’s Leader of AI Audit and Assurance, says that oversight committees must transform governance structures entirely to clarify accountability, create transparency, and evolve auditability across the business.
John Rodi, Partner and Co-Leader of KPMG’s Board Leadership Center, agrees, adding that AI is the top agenda item directors want to discuss this year. “Every board briefing starts and ends with AI oversight,” he says. “Directors and board members want to execute their responsibilities well, and this is the most pressing issue.”
Proactive boards oversee ownership and accountability of AI deployment and usage
Rodi and his work with the KPMG Board Leadership Center have identified five key elements to help boards and board committees oversee and help guide the management team’s AI transformation efforts with greater confidence.
- Trends. While no one expects board members to be technologists, overseers must understand emergent developments. For example, fundamental AI capabilities, ways the organization (and its competitors) are leveraging those functions, and how investors and regulatory stakeholders view use cases.
- Benefits. In addition to insisting on a responsible AI use policy, boards are focused on how management is measuring efficiencies and productivity. How does AI help the organization make better decisions?
- Risks. As AI-enabled cyberthreats change the cybersecurity landscape, how is the company defending against increasingly sophisticated cyberattacks, including using AI for defense? What are the AI-related risks to mission critical processes, and how do users report vulnerabilities and incidents? Basic data integrity and accuracy—and processes to help ensure data quality—should also be on the board’s radar.
- Strategy and transformation. Boards can help the company keep sight of the big picture, including recognizing the pitfalls of being overly focused on an “AI strategy,” instead of seeing AI within the context of the company’s overall growth strategy. It’s about staying focused on “the business of the business.” So, they ask how AI can be used to achieve that plan, and they champion ambition through that lens.
- The board’s own role. Bring in the technology and AI expertise and fluency the board needs—whether external or additive to the board’s membership—to help oversee the risks and opportunities as AI capabilities and deployments continue to evolve and expand.
Johnson emphasizes that in addition to the core areas of governance and oversight effectiveness, boards should encourage cross-functional connectivity and recognize the growing importance of third-party risk management. “Internally, effective AI adoption tends to bring functions like finance, technology, legal, and HR closer together, prompting them to operate in a more integrated way,” he notes. “Externally, as reliance on technology service providers (such as SaaS, IaaS, and PaaS) continues to expand, potential risks increasingly sit outside an organization’s direct ability to control them—making vendor oversight a critical focus area for effective boards.”
Requiring human-in-the-loop controls to build trust and create culture
Regulators and stakeholders demand transparency, yet many AI models operate as "black boxes." Johnson says that effective directors address this by probing the organization’s AI use and the basis for its leaders’ trust (or not) in AI-generated outputs.
“Demystifying the so-called ‘black box’ starts with good governance, and not just at the board level,” he says. “The governance foundation you build operationally enables trust, transparency, and explainability – all the things that historically have resulted in technology deployment that scales.”
Rodi adds that since human judgment should always be involved in AI, a surprising skill should be prioritized: philosophical and ethical logic. “Even as roles change, human judgment will continue to be an increasingly valuable skill.”
Evolving the board’s agenda to monitor rapid adoption and outcomes
Rodi’s work with the KPMG Board Leadership Center has noted the importance of AI governance being housed at the full-board level, with board committees supporting the board’s oversight of specific areas of AI risk and strategy. Since the transformation touches each function strategy, it becomes an agenda item for every group, and therefore, the whole board. “Most directors have dealt with major transformations, disruptions, and crises, but no one has experienced the rapid evolution of AI before,” he says. “So, it’s critical to ensure the right people are in the room to help oversee this.”
Johnson adds that directors should listen for missing voices across functions. “Are we seeing a disconnect between the strategy and the governance?” and he asks “Is there a function that’s not at the table? How strong are the silos?”
In practice: demonstrated ways boards oversee AI-driven value creation – and preservation
In Part 2 of this two-part series, KPMG’s experts consider the real-world steps directors are taking to achieve these oversight changes. They cover proven actions, including…
- How effective directors self-educate on AI without compromising their high-level vantage point
- How they position guardrails as strategic advantages instead of bottlenecks
- How effective committees address AI-related challenges before they arrive
- How boards parse outcomes, distinguishing AI activities (like pilot programs) from organizational and even business-level transformation
To explore tactics like these, click here for Part Two of this series.
