AI Governance Is Now a Board-Level Question — Here's the 10-Minute Version
Between the EU AI Act, ISO 42001, and enterprise-buyer security questionnaires that now include AI-specific sections, 'we don't have an AI governance program' is no longer a neutral answer.
September 16, 2026
v1
2 min
AI Governance Is Now a Board-Level Question — Here's the 10-Minute Version
Three separate pressures are converging on the same conclusion: AI governance has moved from "a topic the engineering team is thinking about" to "a question the board should be able to answer directly." Regulatory pressure (the EU AI Act's risk-based obligations), procurement pressure (AI-specific sections now routinely appear in enterprise vendor-security questionnaires), and reputational pressure (AI incidents are genuinely newsworthy in a way most other technical risk isn't) are all real and independent of each other.
The question worth asking in the next board meeting
Not "are we using AI responsibly" — that's unanswerable without a real governance structure behind it. The concrete question is: do we have an inventory of the AI systems we build, buy, or meaningfully rely on, and does each one have a named owner accountable for its risk? If the honest answer is no, that's the actual starting point, not a symptom of a bigger problem to solve first.
Related Executive Guides
One is a voluntary US risk-management framework; the other is a certifiable international management-system standard. Most serious AI governance programs end up using both.
Titles like 'Head of AI Governance' and 'AI Risk Officer' didn't exist five years ago. The role is still being defined, and it's landing in different places at different companies.