Saturday, 5 September 2026
Artificial intelligence may be forcing companies to rethink not only their technology infrastructure but the way boards and senior management govern risk itself. Traditional oversight structures built around committees, periodic reports and relatively static risk assessments can struggle when AI applications are introduced, modified and expanded across an organisation far faster than conventional governance processes can respond. That was the central argument presented at Ai4 2026 in Las Vegas by Brian Allen, Executive Director of the Center for AI Oversight, who argued that organisations should stop thinking primarily about governing AI technology and instead govern the management system surrounding its use.
The distinction is important. A board does not need to understand every model, agent or technical architecture operating inside the business. It needs confidence that management has established a repeatable process for deciding where AI can be used, what risks the organisation is prepared to accept, when problems or missed opportunities must be escalated, and whether the expected economic benefits justify the exposure. Allen framed this as part technology revolution and part management revolution, arguing that companies are introducing a rapidly changing technology into governance structures designed for a much slower environment.
This also changes the relationship between risk and strategy. Traditional cybersecurity discussions have often concentrated on downside: preventing breaches, protecting information and avoiding disruption. AI creates another dimension because moving too slowly can itself become a competitive risk. A company that blocks useful automation while competitors reduce costs, improve margins or deliver services faster may be accepting a different kind of exposure. Governance therefore needs to balance the danger of deploying AI too aggressively against the economic cost of not deploying it quickly enough.
Quarterly reporting illustrates the problem. A board may receive an AI risk update every three months, yet employees and business units can introduce new models, applications and agents in a fraction of that time. By the time a traditional report reaches senior management, the company’s actual AI environment may already have changed materially. Allen therefore challenged what he called the assumption that having an AI committee automatically means an organisation has effective governance. A committee is a governing body, but the more important question is what management system that body is actually governing.
If the committee’s main role is simply to receive periodic information about projects and risks, executives may be well informed without actively governing how the organisation balances AI opportunity and exposure. Effective oversight instead requires a mandate defining responsibility, authority, risk tolerance, escalation procedures and the evidence necessary to determine whether management is operating within those expectations. This broadly reflects the direction of established frameworks such as the NIST AI Risk Management Framework, which treats governance as something extending across the entire lifecycle of an AI system rather than as a one-time technical approval.
Risk tolerance is central to this approach because it gives management something concrete against which investment and behaviour can be measured. Broad statements that a company has a low, moderate or high appetite for AI risk provide limited practical guidance. A more useful model is to establish tolerances around particular applications and consequences. An internal productivity assistant may justify a different tolerance from an AI system influencing lending decisions, recruitment, pricing, customer data or safety-critical infrastructure.
Those tolerances should function as decision points rather than automatic stop signs. If an AI application moves beyond an agreed boundary, management can decide whether to reduce the risk, introduce additional controls, accept greater exposure or discontinue the activity. The same principle can work in the opposite direction. If controls are preventing a low-risk AI initiative from generating measurable savings or competitive benefits, that missed opportunity can also be escalated. Governance then becomes a mechanism for balancing risk and return rather than merely stopping activity.
That makes AI oversight closely connected to resource allocation. Once a company understands the economic importance of a particular use case and the exposure associated with it, management can decide how much investment in security, data quality, monitoring, human oversight and resilience is justified. The objective is not zero risk, which is unrealistic in any business environment. It is to determine how much risk the company is prepared to accept in exchange for a particular strategic benefit.
Allen proposed an oversight model built around several interconnected areas: governance responsibility, a risk-informed decision system, trust and assurance, risk-based strategy, and escalation and disclosure. The precise structure will differ between organisations, but the underlying principle is that these elements need to operate as one programme rather than as a collection of disconnected activities. Many large companies already have much of the required infrastructure through legal, compliance, cybersecurity, audit, data governance and enterprise-risk teams. The challenge is connecting those functions into a repeatable system that can make AI decisions consistently and quickly.
Clear ownership is therefore essential. Companies need to know who has the authority to establish the AI governance programme, who operates it and which matters must reach executive management or the board. Formal mandates and documented responsibilities become especially important when difficult decisions arise because employees cannot rely solely on informal relationships or assumptions that information will automatically move upwards through management. A codified governance structure provides something the organisation can lean on when business pressures become intense.
The board’s role should nevertheless remain different from management’s. Directors do not need to operate AI controls themselves. Their responsibility is oversight: understanding whether an appropriate system exists, whether management is executing it and whether significant risks and opportunities are reaching the board. Operational teams then determine how technical controls, cybersecurity measures, data processes and assessments are implemented. This separation allows directors to remain engaged without attempting to manage technology they are not equipped to operate.
Corporate law provides important context to that discussion, although it should not be interpreted as establishing a specific AI governance standard. Delaware’s Caremark line of cases has progressively examined directors’ and, more recently, corporate officers’ responsibilities for oversight and reporting systems, particularly where risks are central to a company’s operations. The lesson for AI is not that boards automatically face liability whenever an AI system fails. Rather, as AI becomes material to business operations, directors and executives may increasingly need to demonstrate that appropriate information and escalation mechanisms existed and that significant warning signs were not ignored.
This creates another reason for companies to document how AI decisions are made. Governance should produce evidence showing what management knew, which risks were considered, what tolerance was approved and why a particular decision was taken. The standard should not be that every AI decision must ultimately prove correct. Business involves uncertainty. A more realistic objective is demonstrating that material decisions were informed, appropriately authorised and consistent with the organisation’s established governance process.
Explainability illustrates the distinction. AI models are frequently described as black boxes because it can be difficult to reconstruct precisely how a complex model produced an output. That does not necessarily mean a company cannot provide meaningful accountability. Management can document what information entered the system, what it was intended to accomplish, which controls applied, what output was produced, how that output was validated and why the organisation considered it reliable enough for the intended purpose. The emphasis shifts from trying to expose every internal mathematical operation towards demonstrating that the overall decision process is controlled and defensible.
The same principle applies to AI strategy more broadly. Companies cannot know precisely how models, regulation and competitive pressures will evolve over the next several years. Governance therefore needs to accommodate uncertainty rather than pretending it can eliminate it. Organisations should establish boundaries that permit experimentation while creating clear mechanisms for escalating situations where financial, legal, operational or reputational exposure becomes significant.
For property companies and investors, these issues are likely to become increasingly relevant as AI enters investment analysis, valuation, leasing, development, building management, procurement and financing. An investment manager may use AI to screen acquisitions, a lender to analyse borrowers, a developer to assess sites and a property manager to automate tenant interactions. Each application creates a different balance between economic opportunity and risk, which means a single company-wide rule is unlikely to be appropriate for every use case.
Commercial real estate also demonstrates why governance needs to extend beyond the technology department. AI-generated investment analysis may depend on data controlled by asset managers and finance teams. Automated lease analysis involves legal departments. Building-management AI can affect operations and safety, while customer-facing systems create privacy and reputational considerations. Effective oversight therefore requires technology specialists to work with the people responsible for the underlying business processes rather than treating AI as an isolated IT function.
There is also a longer-term organisational issue. As companies automate more analytical and administrative work, they need to consider what happens to the institutional knowledge traditionally developed by employees performing those tasks. Junior professionals often learn by completing repetitive work, observing experienced colleagues and gradually understanding exceptions that are not obvious from formal procedures. If AI removes much of that work, businesses may need alternative ways to develop the judgement required for future senior positions.
This makes AI governance partly a question of organisational design. Companies are not simply deciding which software to buy. They are deciding which decisions remain with people, which can be delegated to machines, what knowledge must remain inside the organisation and how accountability operates when human and automated decision-making become intertwined.
The organisations best positioned for this transition may therefore be those that treat governance as an accelerator rather than a brake. A well-defined programme can allow employees to experiment faster because boundaries, responsibilities and escalation routes are already understood. Instead of requiring every new AI project to begin a fresh debate about risk, management can evaluate it against an established system and make decisions more quickly.
That may ultimately be the most important distinction between traditional technology governance and the emerging AI model. Companies cannot realistically govern every technological change individually at the speed at which AI is developing. What they can govern is the system through which those changes are evaluated and adopted.
For boards, the question is therefore moving away from whether the company has an AI committee or policy. The more important questions are whether management knows which risks it is willing to take, whether those boundaries can adapt as circumstances change, whether opportunities as well as threats are escalated and whether there is evidence that the organisation is actually operating according to those decisions.
AI governance at that level becomes much closer to strategy than compliance. It is a mechanism for deciding how quickly an organisation wants to move, where it is prepared to take risk and where stronger controls are necessary. As AI spreads across corporate operations, the ability to make those decisions repeatedly, transparently and at speed may become as important as the technology itself.
Source: CIJ.World Research & Analysis Team
