Directors do not need to be AI engineers, but they do need to oversee AI in good faith. As AI moves into products, pricing, hiring, lending and customer service, the duty of oversight now reaches algorithms. This article explains where that duty comes from, how disclosure raises the stakes and what a defensible board record looks like.

This article is general information, not legal advice. Boards should consult counsel on their specific obligations.

The duty of oversight: Caremark and Marchand

In the United States, the duty of oversight traces to the Delaware Court of Chancery's 1996 decision in In re Caremark International Inc. Derivative Litigation. Directors breach the duty when they fail to implement any reporting system for key risks, or when they consciously ignore red flags from a system that exists.

In 2019, the Delaware Supreme Court in Marchand v. Barnhill sharpened the standard for mission-critical risks: when a risk is central to the business, the board must make a good-faith effort to establish board-level monitoring of that risk. Later cases, including the 2021 Boeing derivative litigation over aircraft safety, showed that courts examine board minutes, committee charters and reporting cadence to test whether monitoring was real.

How AI changes the oversight picture

AI does not create a new legal standard. In an analysis for the Oxford Business Law Blog, Pierluigi Matera argues that AI leaves the Caremark standard intact but changes the evidence through which oversight is shown. Directors do not need to master machine learning; they need to show genuine engagement with the systems that shape compliance, safety and regulatory exposure.

The same analysis identifies new kinds of red flags: model performance decline, model degradation and gaps between what a system reports and what regulators find. A board that receives those signals and does nothing faces the second prong of Caremark.

When is AI "mission-critical"?

AI is likely mission-critical when it:

• Makes or shapes decisions about customers' money, health, safety or legal rights.
• Runs inside a regulated product or process.
• Drives a large share of revenue, pricing or customer interaction.
• Processes sensitive personal data at scale.
• Acts autonomously, as AI agents do, across company systems.

For many financial services, health care, insurance and consumer technology companies, at least one AI use already meets this test.

Disclosure: the second source of exposure

AI risk is now a standard disclosure. The Conference Board reports that 83% of S&P 500 companies disclosed AI as a risk by the end of 2025, up from 12% in 2023. An earlier analysis by ISS-Corporate found only about 15% of S&P 500 companies disclosed any board oversight of AI.

That mismatch matters. When a company tells investors AI is a material risk, plaintiffs and regulators will ask how the board oversees it. In December 2025, the SEC's Investor Advisory Committee approved a recommendation on AI disclosure calling for companies to define AI, disclose whether the board or a committee oversees AI deployment and report material AI effects. Disclosures that overstate AI capabilities ("AI washing") create a separate securities risk.

International expectations

Outside the US, the EU AI Act places obligations on providers and deployers of AI systems, with fines of up to 35 million euros or 7% of global turnover for prohibited practices. Accountability attaches to the organization, which means boards of companies operating in the EU need assurance that classification, documentation and human oversight duties are met.

What a defensible board record looks like

A board that wants to show good-faith AI oversight should be able to point to:

1. An AI inventory of material systems, owners and risk ratings, reviewed at least yearly.
2. Committee ownership written into charters, so audit, risk and technology committees each know their AI scope.
3. Regular reporting from a named executive, with metrics on performance, incidents and compliance.
4. Escalation triggers that define which AI incidents reach the board and how fast.
5. Framework alignment with recognized standards such as the NIST AI RMF or ISO/IEC 42001.
6. Independent assurance from internal audit on management's AI controls.
7. Minutes that show engagement: questions asked, follow-ups requested and decisions taken.
8. Director education on AI, documented and refreshed each year.

The competence question

Oversight depends on understanding. A board that cannot interpret management's AI reporting cannot show good-faith monitoring of it. That is why director AI fluency is becoming part of the governance record, and why boards use an assessed standard such as the AI Native Board certification to document competence.

Frequently asked questions

Can directors be personally liable for AI failures?

Liability under Caremark requires bad faith, a high bar. The risk rises when a board has no AI reporting system at all for a mission-critical use, or ignores clear warning signs. Counsel should advise on specific situations.

Should one committee own AI oversight?

Many boards assign primary ownership to one committee, often audit, risk or technology, while keeping AI strategy at full-board level. What matters is that charters leave no gaps.

How do we know whether our oversight is adequate?

Start with a structured review. A board AI diagnostic benchmarks fluency, oversight structures and disclosure against the AI Native Board standard. Directors can also begin with the self-check.