What boards looked like before cyber, and what they look like after
Fifteen years ago, almost no public-company board had a director with cyber expertise. Boards trusted the CIO. Cyber was “operational,” not “strategic.” Then a few breaches changed everything: the regulators wrote new disclosure rules, the activists started filing proposals, and the D&O insurance carriers started asking pointed questions in renewals. Today, 81% of S&P 500 boards have a named cyber expert. It happened in roughly a decade.
AI is on the same trajectory, but compressed. The disclosure rules are being drafted. The first lawsuits are being filed. The insurance markets are starting to price the exposure. And only 14% of boards have someone who can speak to it with substance.
What “AI literacy” actually means at the board level
It does not mean knowing the difference between transformer and diffusion models. It means being able to evaluate, unprompted, the following kinds of questions:
- Where in our operations is AI making decisions that affect customers, employees, or counterparties?
- What is our exposure — financial, reputational, regulatory — if any of those decisions are systematically wrong?
- Who is accountable inside the company when an AI system fails, and who reports that failure to the board?
- How do we know our AI vendors are not training their public models on our data?
- Which of our AI systems would fall under "high-risk" classifications under the EU AI Act, the Colorado AI Act, or equivalent regimes?
- What is our position on AI-augmented hiring, performance evaluation, and termination?
Notice that none of these are technical. They are governance questions. A literate board asks them. A non-literate board hopes management is on top of it.
The three-track upgrade path
Boards that are taking this seriously are running on three parallel tracks:
Track 1 — Composition
Add at least one director with real operational AI experience. Not an investor in AI startups. Not a futurist. An operator who has shipped, governed, or been accountable for AI systems at scale. The pool is small. Hiring will get more competitive every quarter.
Track 2 — Education
A structured literacy program for the whole board — not a single training session. The boards making real progress run quarterly immersions: one substantive AI topic per quarter (vendor risk, hiring AI, customer-facing AI, regulatory exposure, etc.), with pre-reading, expert briefings, and a discussion about how it applies to the company’s specific exposure.
Track 3 — Process
Either expand the audit committee’s charter to include AI risk explicitly, or create a dedicated AI committee. Mandate a quarterly review with named management accountability — typically the Chief AI Officer or, in companies without one, the Chief Risk Officer plus the CIO.
What the laggards will be saying in 2028
Two scenarios await the boards that delay:
| Trigger event | What an unprepared board will say |
|---|---|
| Disclosure regime forces AI risk reporting | "We thought management had it under control." |
| Customer-facing AI system causes a public failure | "We were not aware that system existed." |
| Activist files governance proposal | "We are reviewing our AI governance framework." |
| Regulator opens enforcement action | "We have engaged outside counsel." |
None of these are good positions. All of them are avoidable.
The window is open. It will not stay open.
In 2015, adding a cyber expert to your board was forward-looking. By 2020, it was table stakes. By 2025, the absence of one is a red flag for institutional shareholders.
AI is on a faster compression. Boards that act in 2026 will be ahead of the curve. Boards that act in 2027 will be catching up. Boards that wait until 2028 will be answering questions they could have prevented.
I would rather be the board that did the homework.
Our Perspectives
The board-composition data is unambiguous. PwC's 2025 Annual Corporate Directors Survey reports that only 14% of S&P 500 boards have a director with substantive AI expertise — defined as having led an AI-driven product, function, or governance program. Compare that to the 81% of those same boards that now have a director with cyber expertise (up from 11% in 2015). The mismatch is acute: 67% of CEOs surveyed by Deloitte say AI is a 'top-three' strategic priority, yet only 23% of their boards have the literacy to evaluate AI-related decisions independently. The pattern that worked for cyber will work here — defined committees, mandated training, named directors with AI accountability. Boards that adopt this in 2026 will get ahead of the disclosure regimes that arrive in 2027–2028. The numbers say: act now.
Let me be specific about what 'AI literacy on the board' should NOT mean. It should not mean adding the founder of an AI startup as an independent director and calling it done. It should not mean a one-day training led by the company's CIO. And it absolutely should not mean treating AI as a sub-bullet under the technology committee's existing agenda. Real AI literacy at the board level means directors can ask, unprompted: where in this business is AI making decisions that affect customers, employees, or counterparties? What is our exposure if those decisions are wrong? Who is accountable when they are wrong? If the directors cannot ask those questions, the management team is operating without supervision in the area that will shape the company's risk profile for the next decade. That is not a competency gap. That is a governance failure. Stop dressing it up.
I love this conversation. AI literacy in the boardroom is not just a defensive move; it unlocks offensive strategy. A board that understands AI can authorise faster pilots, ask sharper questions about competitive positioning, and challenge management to think bigger. The boards that will out-compete in 2027–2030 are the ones whose directors can sit in a strategy review and ask 'where could AI flip the unit economics here?' instead of 'is this safe?' That is a fundamentally different conversation. And it is teachable — the boards I see making the most progress are running 90-day immersions: one director leads, two follow, the rest get briefings. Within a year, the board talks differently about every strategic question, not just AI ones. The flywheel is real.
I serve on boards in three countries and I will say what most directors will not: most of us are bluffing about AI. We have been to the conferences. We have read the McKinsey reports. We can use the right vocabulary in a meeting. But if you put us in a room with the Chief AI Officer and asked us to challenge their model deployment plan with substance, most boards would fold inside ten minutes. The honest path forward is not to pretend; it is to invest deliberately. Three things I have seen work: (1) a structured AI literacy program for the entire board, not a one-time training; (2) the addition of one director with real operational AI experience — not an investor, an operator; (3) a quarterly AI-and-risk review owned by the audit committee or a new AI committee, with named management accountability. Boards that treat AI literacy as optional in 2026 will be the ones explaining to shareholders in 2028 why they did not see something coming. I would rather be the board that did the homework.
Sources & References
- 2025 Annual Corporate Directors Survey — PwC (2025-10-01)
Only 14% of S&P 500 boards have a director with substantive AI expertise
View source - State of Generative AI in the Enterprise — Board Edition — Deloitte (2025-11-01)
67% of CEOs rank AI as top-three priority; only 23% of boards self-report literacy to evaluate it
View source - EU AI Act — Governance Provisions for Boards — European Commission (2025-08-01)
Articulates board-level accountability for high-risk AI systems
View source
AI education should be as intelligent as the technology it teaches. Our program adapts to your role, industry, and experience level to deliver exactly what you need — nothing more, nothing less.
Comments (0)
No comments yet. Be the first to share your thoughts!