With directors and officers responsible for the organisation’s AI strategy, a robust and adaptable governance framework is a must. To support boards and leadership teams as they navigate the opportunities and risks of AI, the Institute of Directors (IoD) provides guidance and thought leadership on effective governance and board oversight.
Dr Erin Young, Head of Innovation and Technology Policy, Institute of Directors (IoD) said: “AI capabilities evolve at a rapid pace, against an uncertain global regulatory and geopolitical landscape, directors who prepare now will be best placed to embrace AI’s opportunities while managing the legal, operational and reputational risks that accompany it.”
“Across our membership at the Institute of Directors, we’re seeing growing demand for practical guidance and support that helps boards move beyond the hype and build the skills, confidence and governance frameworks needed to underpin informed decisions. Boards don’t need to have all the answers today, but they do need a clear strategy for how AI will be governed, adopted and overseen in their businesses. Effective governance is not about slowing innovation; it’s the tool which helps organisations adopt AI responsibly and realise its potential long-term value.”
AI opportunities
AI presents significant opportunities across many sectors. As well as helping to automate and streamline business processes, AI can improve customer experience, increase productivity and drive innovation.
AI risks
There are risks too, especially in the boardroom. Directors and officers can face personal liability exposures in certain circumstances and should seek appropriate legal and insurance advice regarding their individual situation, if AI is used inappropriately.
Allianz Commercial’s Directors & Officers Insurance Insights 2026 report highlights that AI-related litigation is already emerging as a source of management liability. The report notes a significant increase in AI-related filings in recent years, reflecting growing scrutiny from investors, regulators and other stakeholders around how organisations develop, govern and communicate their use of AI.
This could happen where an AI model contains unintended bias or infringes privacy or intellectual property laws. Similarly, AI system failures and mistakes, such as hallucinations, model drift and outages, could land directors and officers in legal hot water.
Ignoring the technology can be equally harmful. Failure to adapt or adopt the right AI tools could wipe out the business, with shareholders, investors and other third parties seeking compensation from management.
AI disclosure is another area where directors must tread carefully. If a company is believed to have made false or misleading statements about its use of AI, a practice known as AI washing, it could face legal action from investors and regulators. This reflects a broader trend identified by the report, with stakeholders placing greater expectations on organisations to demonstrate robust governance, transparency and oversight of AI.
Keeping quiet won’t wash either, with growing pressure on companies to be transparent about their use of AI to avoid claims around inadequate disclosure.
There are also security risks to consider, especially as management could face legal action if cybersecurity isn’t up to scratch. AI is making it easier for criminals to launch cyberattacks, with organisations seeing an average of 2,201 attacks a week according to Check Point research. Attacks are more sophisticated too: an AI-powered deepfake of the finance director is much more convincing than the old-school phishing email scams.
AI regulatory complexity
To add to the complexity, regulatory expectations are constantly shifting as the risks associated with AI evolve or become better understood. Businesses must keep on top of this to ensure compliance.
The UK’s position highlights the complexities. Rather than having a single AI Act setting out the regulation, the UK has a principles-based approach with existing regulators such as the ICO, Ofcom and the FCA enforcing the rules. Each oversees rules specific to its regulatory remit, for instance the ICO is working on a statutory code of practice for AI and automated decision making. A lot of the guidance is already in force, with the remaining elements due to be finalised in stages by 2027. Directors should already be acting in line with current guidance, and be prepared to keep pace with evolving requirements.
As well as the intricacies of the UK regulations, firms also need to consider legislation in other jurisdictions. For instance, the EU AI Act came into force in August 2024, with the provisions rolled out by 2028. Any UK firm with an AI system, or output that is used in the EU, could find itself subject to the regulations.
AI governance
A robust and adaptable governance framework is essential to manage these AI risks.
By setting clear guidelines around a business’s strategy and the AI it uses, its easier to anticipate and avoid potential issues.
It also helps to change company culture, with employees comfortable questioning the AI tools they use and the output it generates.
A governance framework should consider the following:
Set the tone
Governance must come from the top, with the strategic, reputational and legal implications making AI adoption a board level responsibility, rather than an IT or operations issue.
The board should also set high-level strategic goals for the adoption of AI, aligned with the company’s values and objectives. This helps to embed the strategy into corporate culture but also ensures any AI adoption is carefully considered.
Companies should also have a cross-functional review committee in place to ensure the implications of any decisions are fully understood. This encourages a more inclusive approach to AI adoption.
Understand your AI risk
Undertaking impact and risk assessments gives insight into the implications of AI use across a business. This can inform strategic decisions and enable managers to put appropriate risk management measures in place.
It’s important to have a close eye on the regulatory and political environment to ensure compliance.
Audit AI assets
Another key part of governance is understanding which AI tools are used across the organisation. Shadow AI, where employees independently use AI tools to support work, is common, but can increase the risk of infringing copyright.
Data integrity is also essential. Companies should regularly audit the data that is used across any AI models to ensure its accuracy and relevance.
Having an AI policy setting out appropriate use can help to reduce risk.
Train employees
Training employees on an organisation’s AI tools will help them use them correctly and responsibly, but it should also empower them to question the technology and its output.
Any training should also cover which tools can – and can’t – be used in the workplace. Restricting usage to authorised tools reduces the risk of issues such as inadvertently infringing copyright.
It’s also important to keep employees updated on cybersecurity issues. Questioning the MD’s authenticity on a videocall may feel odd but it could save the business thousands.
Ensure compliance
As organisations adopt AI, protecting personal data remains essential. AI solutions should comply with UK GDPR and the Data Protection Act 2018, with appropriate safeguards in place throughout their lifecycle.
Security is equally important. AI systems should be designed with robust controls to protect data, support resilience and reduce the risk of cyber threats and unauthorised access.
Test and review
Testing is essential before any AI system is deployed and companies should establish robust governance around how this is conducted.
Additionally, as AI and business strategy evolves, regular reviews are a must to ensure the technology still meets its objectives.
Supporting AI adoption
AI offers huge opportunities for the UK and there’s plenty of support for businesses wishing to take advantage of the technology.
Getting the foundations right, with a robust and adaptable governance framework in place, will ensure that businesses are able to seize all the opportunities AI offers.
We are here to help
Please do get in touch if you would like to know more about how we can support you and your business.
This article was adapted from an article by Allianz which can be found here.