Boards Are Starting to Treat AI Governance Like Cyber Risk

There is clear evidence that boards are elevating AI governance into the same category of formal oversight as cybersecurity and enterprise risk.

For example, the Harvard Law School Forum on Corporate Governance has documented how AI risk oversight is now appearing alongside cyber risk in corporate disclosures and board agendas, signalling convergence in governance treatment: https://corpgov.law.harvard.edu/2025/10/28/cyber-and-ai-oversight-disclosures-what-companies-shared-in-2025/

Similarly, Deloitte’s board-level analysis on generative AI governance states that boards must integrate AI risk into formal risk management and oversight structures, not treat it as a technical side topic:
https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/articles/generative-ai-governance-risk-management.html

The National Association of Corporate Directors has also issued director guidance making clear that AI risk oversight is now a board responsibility requiring defined governance structures and accountability:
https://www.nacdonline.org/all-governance/governance-resources/governance-research/director-faqs-and-essentials/artificial-intelligence-and-board-governance/

At the regulatory level, the European Union’s AI Act formalises risk classification, documentation and governance obligations in a way that pushes AI squarely into board-level risk territory: https://artificialintelligenceact.eu/

Meanwhile, McKinsey has published guidance specifically advising boards to evolve their oversight models to address AI risk alongside other strategic risks:
https://www.mckinsey.com/capabilities/mckinsey-technology/our-insights/the-ai-reckoning-how-boards-can-evolve

Taken together, these sources show a consistent pattern: AI governance is no longer positioned as experimentation or innovation management. It is being treated as a structured, reportable enterprise risk.

Teaching Point

If AI governance is moving into the same oversight tier as cyber risk, then AI metrics must become board-ready and reportable.

Boards expect:

• Clear accountability
• Defined risk categories
• Visibility into exposure
• Evidence of control effectiveness

Narrative reassurance will not be enough. Oversight requires measurable structure.

Three Metrics Leaders Should Prepare Now

1. Model Inventory Coverage
   A complete and current inventory of AI systems in use, with defined ownership.
2. Risk Classification and Tiering
   Clear categorisation of systems by impact, sensitivity and regulatory exposure.
3. Audit and Assurance Readiness
   Evidence of documented controls, monitoring and review processes that could withstand external scrutiny.

Boards are not asking for perfection.
They are asking for visibility.