The Illusion of Progress: Why AI Investment Feels Strategic

AI investment now creates a powerful illusion of strategic progress. Boards see budgets approved, pilots launched, and new capabilities emerging across functions. Management teams can point to copilots, automation, summarisation tools, and workflow improvements as evidence that the organisation is moving. Yet much of this activity is better understood as capability accumulation than strategic choice. McKinsey’s 2025 global survey found that 88 per cent of organisations were using AI in at least one business function, but nearly two-thirds had not yet begun scaling AI across the enterprise, and only 39 per cent reported any EBIT impact at the enterprise level. That gap between adoption and economic effect should be read as a strategic signal. It suggests that many organisations are investing before they have decided where AI is supposed to improve their competitive position.

This is the first governance issue boards need to recognise. In most organisations, AI investment is being driven by external pressure as much as internal logic. Competitors are moving, vendors are persuasive, consultants are presenting large value estimates, and investors increasingly expect visible progress. In that environment, investment becomes a signal of competence rather than a consequence of strategy. The “AI race” narrative accelerates adoption, but only a minority of firms translate that activity into meaningful enterprise value. Movement becomes a substitute for direction, and capability becomes a proxy for strategy.

A useful way to frame this problem is to distinguish between what I refer to as AI parity investment and AI advantage investment. Most organisations are currently doing the former while assuming they are achieving the latter. Until that distinction is made explicit, investment will continue to outpace strategic clarity.

Threshold Capabilities vs Distinctive Capabilities: The Critical Distinction Most Organisations Miss

The most useful distinction in this context is between threshold capabilities and distinctive capabilities. Threshold capabilities are those that an organisation must possess to remain credible in its market. Distinctive capabilities are those that shape why customers choose the firm, why margins persist, and why competitors struggle to respond.

Most current AI investment sits firmly in the first category. Rolling out generative AI assistants, automating internal workflows, improving customer-service triage, and accelerating knowledge work are rational responses to technological change. They improve efficiency and, in some cases, quality. The problem is that competitors are doing exactly the same. Over time, they will become expected.

The challenge is that these benefits are inherently replicable. Microsoft Research’s study of M365 Copilot users demonstrates measurable productivity gains, but those gains are available to any organisation deploying the same tools. As adoption spreads, the effect is not differentiation but convergence. The industry becomes more efficient, but relative positions remain largely unchanged.

This is where the distinction between AI parity and AI advantage becomes operationally important. Threshold capabilities should be treated as necessary investments to maintain competitiveness, with a clear focus on cost efficiency and execution discipline. Distinctive capabilities, by contrast, require concentrated investment and are justified only when they can alter pricing power, cost position, or customer preferences in ways competitors cannot easily replicate.

The Resource-Based View Applied to AI: Why Access to Models Does Not Create Advantage

The resource-based view of the firm provides a disciplined way to assess whether AI can create advantage. For a capability to generate sustained advantage, it must be valuable, rare, difficult to imitate, and organised to capture value (VRIO). Most AI technologies fail this test at the level of access.

Foundation models, cloud infrastructure, orchestration tools, and development frameworks are now widely available. The barriers to entry are falling, and the expertise required to deploy them is becoming more widely available. The technology is valuable, but it is neither rare nor difficult to imitate. Under a VRIO lens, it is unlikely to create sustained advantage on its own.

This becomes clearer when compared with established sources of distinctive capability. Amazon’s logistics network is not valuable because warehouses exist; it is valuable because of its scale, integration, and continuous optimisation, which together support superior service levels and cost economics. Zara’s supply chain is not distinctive because supply chains are uncommon; it is distinctive because of the speed and coherence with which it links demand signals to production and distribution, enabling faster inventory turns and reduced markdown risk.

In both cases, advantage arises from an integrated system of resources and capabilities that shapes the firm’s economic model. The same principle applies to AI. The question is not whether the organisation has access to the technology, but whether it can embed that technology within a system of resources and processes that competitors cannot replicate quickly or cheaply.

Where AI Can Actually Become a Distinctive Capability

AI can contribute to distinctive capability, but only when it is embedded within resources and systems that meet the VRIO criteria. There are three credible routes through which this occurs.

The first is proprietary data that improves with use and is difficult for competitors to assemble. Organisations that control unique operational or behavioural datasets can build models that outperform those trained on generic data. The advantage compounds as data accumulates and feedback loops strengthen, creating a widening performance gap over time.

The second is deep integration into core workflows and decisions. When AI becomes part of how pricing decisions are made, how risk is assessed, how inventory is allocated, or how products are designed, it becomes embedded in the operating model. Replication then requires not just access to the tool, but replication of the underlying processes, data flows, and organisational alignment that support those decisions. This is far more challenging for others to imitate, as demonstrated for decades by the Toyota Product System.

The third is organisational capability. Firms that can redesign workflows, combine technical and domain expertise, and continuously improve their systems create a form of advantage that extends beyond any single application. This often manifests in faster decision cycles, better resource allocation, and more consistent execution.

The distinction is critical. Competitors can access the same tools. They cannot easily replicate the same data histories, embedded processes, and organisational learning curves. That is where AI moves from being a productivity lever to a source of sustained competitive advantage.

The Strategic Evasion: Why Boards Avoid Defining Where AI Will Win

So why then do so many organisations still have a conspicuous absence of strategic clarity? The answer lies in the nature of strategic choice. Defining where AI will create an advantage forces difficult trade-offs. It requires deciding where to concentrate investment, where to accept parity, and which opportunities to deprioritise. These decisions reduce flexibility and create accountability. They also expose differences in perspective across leadership teams.

Many organisations avoid this discipline. Instead, they pursue multiple initiatives across functions, creating the appearance of progress without committing to a clear direction. Both Roger Martin’s and Richard Rumelt’s work on strategy is relevant here. They both argue that an effective strategy is not a list of initiatives, but a coherent set of choices about where to focus and how to compete. That coherence is precisely what many AI portfolios lack. The result is fragmentation. Investment is spread across use cases that deliver incremental benefits but do not combine to shift competitive position. The organisation becomes busier, but not necessarily better positioned, and capital is allocated across initiatives that reinforce parity rather than advantage.

Capability Without Positioning: The Hidden Risk in Current AI Strategies

This leads to a specific strategic risk. Organisations that build AI capability without defining strategic intent can become more efficient without becoming more competitive. Costs increase through investment in infrastructure, licences, data engineering, experimentation, governance, and talent. These costs are often justified individually but rarely assessed collectively against a clear source of advantage. At the same time, competitors adopt similar capabilities, neutralising much of the gain. Efficiency improvements are competed away, and the organisation is left with a higher cost base but little change in relative position. The net effect is convergence rather than separation.

This dynamic is already visible. Many organisations report measurable improvements at the use-case level, but struggle to demonstrate how those improvements translate into sustained financial performance. Boards should interpret this as a warning. Capability without positioning consumes capital, increases organisational complexity, and creates governance challenges without strengthening competitive position.

Reframing the Question: From “Where Can We Use AI?” to “Where Must We Win With AI?”

The starting point for many organisations has been the question: “Where can we use AI?” It is a natural question, but it encourages breadth rather than focus. A more effective question is: “Where must we win, and how can AI strengthen that position?” This reframing aligns AI with core strategic choices. It forces organisations to consider how AI supports their market positioning, rather than treating it as a separate domain of innovation.

This aligns with Roger Martin’s “where to play” and “how to win” framework. AI should not sit alongside strategy; it should be integrated into it. As I have written previously, AI must be tied to strategic intent, not deployed opportunistically. The implication is that AI investment should be evaluated in the context of competitive positioning and economic impact, rather than solely on technical feasibility.

A Board-Level Discipline: Defining AI Advantage Explicitly

For boards, this implies a more explicit discipline than most organisations currently apply. They should require management to clearly distinguish between threshold and distinctive uses of AI and to justify that distinction in economic as well as technical terms. A practical way to enforce this discipline is through a structured decision lens. Before approving material AI investment, boards should require management to answer four questions.

First, is this investment building parity or creating a plausible source of advantage? Second, what makes this difficult for competitors to replicate within a defined time horizon? Third, where does the economic value accrue—in cost reduction, revenue growth, pricing power, or risk mitigation—and is that value likely to persist? Fourth, what changes to the operating model, governance, and organisation are required to realise that value?

These questions force clarity. They distinguish between investments that improve efficiency and those that may reshape competitive position. They also provide a basis for governance. AI initiatives that are central to competitive advantage should be subject to different oversight, risk management, and assurance than those that primarily improve internal efficiency. Regulatory developments reinforce this need for discipline. The EU AI Act is being phased in progressively, with increasing obligations around governance, risk management, and accountability. Boards, therefore, need to understand not only where AI is being used, but also how critical it is to the business model and what risks it introduces.

Closing Argument: AI Will Not Create Advantage Without Strategic Choice

AI does not create an advantage by default, certainly not a lasting one. It amplifies the quality of the strategic choices an organisation makes. Where those choices are weak or undefined, AI produces activity without meaningful differentiation. Where they are clear and disciplined, AI can deepen capabilities that competitors struggle to match.

The distinction between AI parity investment and AI advantage investment should therefore become explicit at board level. Without it, organisations will continue to invest broadly, improve incrementally, and converge with their peers. Boards need to separate two questions that are currently conflated. The first is how to adopt AI effectively. The second is where AI will create an advantage. The first is necessary. The second is decisive.

Organisations that make explicit choices about where AI matters will concentrate resources, build distinctive capabilities, and shape their competitive position. Those that do not will continue to invest, improve, and remain broadly indistinguishable.

If you want more board-level insight on AI strategy, governance, and transformation, subscribe to AI in the Boardroom. Each edition is designed to help directors and senior leaders turn AI activity into sustained competitive advantage.

Subscribe now

Walk into most boardrooms today and ask how AI risk is being managed. You will hear confident answers. It sits with IT. Data governance is in place. Legal is reviewing regulatory exposure. Internal audit has added AI to the risk register. On paper, this appears structured and comprehensive. It is also misdirected.

Boards are not ignoring AI risk. They are approaching it through the wrong lens. AI is being treated as a technology risk—something to secure, validate, and control within existing structures. That framing misses the shift already underway. AI is altering how decisions are formed, shaped, and executed across the organisation. Governance that remains focused on systems will struggle to keep pace with that change.

Boards Think They Are Managing AI Risk. They Are Not.

Most boards take comfort from the fact that AI risk has been allocated. IT manages infrastructure and security. Data teams oversee models. Legal and compliance monitor regulatory exposure. These structures work for systems that behave predictably, where outputs can be traced and logic audited.

AI systems behave differently. They generate outputs based on statistical patterns rather than defined rules. The same input can produce different results, and in many cases, the reasoning behind those outputs cannot be fully explained. This creates a persistent gap between perceived control and actual control. Risk appears contained because it has been assigned to familiar functions, yet the organisation remains exposed in ways those functions are not designed to detect or manage.

The Category Error: AI Is Not Just Another Technology Layer

Treating AI as another form of software leads to a fundamental misunderstanding. Traditional systems execute instructions defined by humans. When those instructions are wrong, failures tend to be predictable and traceable. Testing and remediation follow a clear path.

AI operates on a different basis. It identifies patterns in data and uses those patterns to generate predictions, recommendations, or content. The system does not “know” whether it is correct. It produces outputs that are statistically plausible given what it has seen before. When conditions change, those outputs can become unreliable without any obvious signal.

This introduces uncertainty directly into the organisation’s decision processes. What was once a question of system accuracy becomes a question of how much uncertainty is being embedded into decisions, and whether that uncertainty is understood or governed.

AI Systems Do Not Make Decisions. They Shape Them.

The distinction between AI making decisions and supporting them is often overstated. In practice, AI systems shape decisions by influencing the information on which people rely. That influence is rarely neutral and often invisible.

Consider how this plays out across functions. A customer service team uses AI to draft responses and gradually relies on those drafts with minimal review. A credit team uses a model to prioritise applications, shaping which cases receive attention. A strategy team uses AI-generated analysis as a starting point, with embedded assumptions left largely unchallenged.

In each case, the final decision remains with a human. What changes is the quality and direction of the inputs that inform that decision. When those inputs are accepted without scrutiny, governance frameworks are bypassed in practice, even if they remain intact on paper.

The Five Failure Modes of AI-Driven Decision-Making

AI risk rarely presents as a visible system failure. It tends to surface as a decline in decision quality, often gradually and without a clear trigger. These failures follow patterns that are already emerging across industries.

Misleading outputs are treated as reliable because they are presented clearly and confidently. This has been seen in legal contexts, where AI-generated case references were accepted without verification and later found to be incorrect. The system produced plausible outputs; the failure lay in how those outputs were interpreted.

Bias embedded in training data is reproduced at scale. Amazon’s experimental hiring tool illustrates this clearly. It penalised CVs containing indicators associated with women because it was trained on historical hiring data that reflected existing bias. The model amplified a pattern that was already present.

AI systems also struggle when conditions change. During the early stages of COVID-19, many predictive models became unreliable as consumer behaviour shifted in ways not reflected in historical data. Models that performed well under stable conditions proved fragile under disruption.

Accountability becomes blurred when AI influences decisions. Responsibility is distributed across teams, and no single role owns the outcome. When something goes wrong, organisations often struggle to determine who is accountable for the decision itself.

Reputational exposure increases when AI-driven decisions affect customers at scale. Errors in automated responses or moderation systems can spread quickly, damaging trust. These incidents are rarely the result of a single failure. They reflect a lack of clarity over how decisions are governed and reviewed.

Why Existing Risk Frameworks Fall Short

Most enterprise risk frameworks assume that systems are observable and controllable. They are built on the premise that behaviour can be tested, monitored, and corrected when deviations occur. These assumptions hold for traditional systems.

AI challenges each of these assumptions. Many models operate with limited explainability, and their behaviour can evolve as new data is introduced. Validation processes tend to focus on performance at a point in time, rather than how outputs will be used in practice or how they will behave under changing conditions. Compliance processes assess whether systems meet regulatory requirements, but they do not capture how decisions are influenced once those systems are deployed.

The gap is structural. Risk frameworks remain focused on systems, while risk is emerging through decisions. Until governance reflects that reality, organisations will continue to manage the visible risks while missing the more consequential ones.

The Strategic Blind Spot: AI Risk Without AI Ambition

Risk cannot be defined without a clear sense of ambition. Yet many boards are discussing AI risk without establishing where AI is expected to create value. Without that clarity, defining an appropriate risk appetite becomes difficult.

The risk profile associated with using AI to improve efficiency differs significantly from one where AI is embedded in core products, pricing, or customer interactions. Without an explicit ambition, governance tends to become reactive. Some organisations take on risk without recognising it, deploying AI broadly with limited oversight. Others become overly cautious, slowing down initiatives because governance cannot support them.

The underlying issue is not governance in isolation. It is the absence of a clear link between strategy and risk. Decisions about where to deploy AI and how much risk to accept need to be made together.

The Governance Gap: No One Owns AI-Driven Decisions

AI spans multiple functions, but governance structures remain siloed. IT manages infrastructure, data teams manage models, legal oversees compliance, and business units apply outputs. This reflects organisational design, not the reality of decision-making.

When AI influences a decision, no single role owns the outcome. A model may perform as intended, yet be applied in a context that introduces risk. A system may meet regulatory requirements, yet still lead to poor decisions in practice. These gaps are not anomalies; they are a consequence of how responsibility is distributed.

Governance has not adapted to the way decisions are now being shaped. Until accountability is aligned with decision-making, these gaps will continue to emerge.

What Boards Should Govern Instead: Decisions, Not Systems

Boards need to shift their focus from systems to decisions. The critical question is where AI is influencing decisions that matter to the organisation, and how those decisions are governed.

This begins with visibility. Boards need to understand where AI is shaping decisions, whether directly or indirectly. It requires clarity on where human judgement is required and where automation is appropriate. It also requires explicit accountability, ensuring that responsibility for outcomes is clearly defined.

This does not demand complex frameworks. It demands alignment between governance and how decisions are actually made. Organisations that achieve this tend to simplify governance, focusing on clarity and accountability rather than expanding controls.

The Implication: Competitive Advantage Will Come from Better Governance

There is a tendency to equate advantage with speed of adoption. Organisations that move quickly are expected to gain an edge. Speed plays a role, but it does not determine who captures the most value.

Advantage will come from the ability to govern decision-making effectively. Organisations that understand where AI influences decisions, and how those decisions are managed, can deploy AI in areas that matter with confidence. They can scale without undermining trust or performance.

Others will find progress more difficult. Some will remain in pilot mode, constrained by governance concerns. Others will move quickly and encounter issues that erode trust. The difference will not be technical capability. It will be governance discipline.

AI Risk Is a Leadership Issue

AI is reshaping how decisions are made across organisations. That shift sits at the centre of strategy and governance. It cannot be addressed solely through technical or compliance functions.

Boards need to define where AI will be used, what level of risk is acceptable, and how decisions will be governed. Without that clarity, decisions will still be influenced by AI, but without clear oversight or accountability.

AI risk sits at the core of leadership responsibility. Treating it as a peripheral technical issue delays the work that matters.

Final Thought

Most organisations are asking how to manage AI risk. A more useful question is how AI is changing decision-making, and whether that change is being governed deliberately.

Until that question is addressed, AI risk will continue to be managed in the wrong place.

Subscribe for more

If you want practical guidance on how boards can govern AI effectively and turn it into a strategic advantage, subscribe to AI in the Boardroom.

Each issue explores how boards and executive teams can turn AI disruption into a strategic advantage, covering strategy, governance, and transformation in the age of artificial intelligence.

Subscribe now

Share AI in the Boardroom

AI Is Now a Boardroom Issue

Artificial intelligence is now a regular topic in boardrooms. Almost every board is discussing AI. Far fewer are governing it. Across the world, it appears on the agenda every quarter. Directors ask management about the latest initiatives. Executives describe pilots involving generative AI tools, predictive analytics, customer service automation, or internal productivity systems built on large language models. The tone is often optimistic. AI is framed as a powerful opportunity to increase productivity, create new products, and sharpen competitive advantage.

Yet when the conversation moves from opportunity to governance, clarity often disappears. Ask most boards a simple question - who actually governs AI in this organisation? - and the answers are often vague. Related questions quickly follow: Who oversees AI risks? Which AI systems exist across the organisation? Who decides whether an AI system should be deployed?

In many companies, the answers are uncertain. AI governance is often documented in a policy written by legal or risk teams and circulated internally. Meanwhile, real-world experimentation continues across business units, innovation teams, and technology groups, sometimes officially sanctioned, often not. The gap between policy and practice is growing.

As AI becomes embedded in decision-making, products, and operations, this gap becomes increasingly dangerous. Boards cannot govern AI effectively through occasional agenda items or general policy statements. AI requires structured oversight, and in many organisations that means committee-level attention.

AI Is Not Just a Technology Topic

Many boards still treat AI as an extension of the technology agenda. It often appears alongside updates on cybersecurity, cloud migration, or digital infrastructure. While understandable, this framing is incomplete.

Artificial intelligence is what economists describe as a general-purpose technology. Like electricity or the internet before it, AI has the potential to reshape how organisations operate across almost every domain. It can influence how strategic decisions are analysed and made, how customers are served, how employees work, how products are designed, how risks are assessed, and how organisations compete.

Consider a common example. A retail bank introduces an AI-driven credit scoring model designed to assess loan applicants more accurately than traditional methods. The system analyses thousands of data points and generates predictions about default risk. From a business perspective, the benefits are clear: faster approvals, better pricing, and potentially improved portfolio performance.

But the implications extend far beyond efficiency. Directors and executives must also ask whether the model unintentionally disadvantages certain customer groups, whether regulators will expect explainability in decisions made by algorithms, how the model will be monitored over time, and who is accountable if the system behaves incorrectly. These questions sit at the intersection of strategy, risk, ethics, regulation, and reputation.

Boards routinely rely on committees to examine complex matters in depth. Audit committees examine financial integrity. Risk committees scrutinise enterprise risk frameworks. Remuneration committees oversee executive incentives. AI increasingly demands the same level of attention.

The Problem With AI Governance on Paper

Many organisations believe they already have AI governance in place. Typically, this governance takes the form of a written policy outlining principles such as fairness, transparency, and accountability. These policies often align with international guidance from organisations such as the OECD or national regulators.

The challenge is not the existence of these policies. It is their lack of operational impact.

Across industries, a familiar pattern is emerging. AI adoption spreads quickly across departments. Marketing teams experiment with generative AI tools, data science teams build predictive models, and product teams embed machine learning into digital services. Oversight remains fragmented. Legal teams review compliance risks, IT teams review security implications, and HR teams consider workforce impacts. Yet no single forum evaluates the full picture.

The consequences are predictable. Organisations discover AI risks only after systems have already been deployed.

One large consumer company experienced this firsthand when a marketing team implemented an AI system designed to generate personalised promotional messages. The system performed well initially, increasing engagement and reducing campaign costs. Several months later, however, a customer complaint triggered an internal investigation. Analysts discovered that the model had been trained on historical marketing data that reflected past biases. As a result, certain customer groups received significantly fewer promotional offers. Situations like this are becoming increasingly common as AI adoption accelerates across organisations.

The problem was not malicious intent. The system had simply replicated patterns in historical data. The deeper issue was the absence of structured oversight. No committee had reviewed the model’s training data, fairness implications, or monitoring processes before deployment.

AI governance had existed on paper, but it was not being actively practised.

Why Committee-Level Oversight Matters

Boards cannot examine every complex issue in depth during full board meetings. AI governance requires sustained attention for several reasons.

First, AI systems evolve after deployment. Traditional software behaves predictably once implemented, but machine learning models can drift over time as real-world data changes. Generative AI systems can produce unexpected outputs. Autonomous systems may behave in ways designers did not anticipate. Oversight, therefore, cannot stop at the moment a system goes live. It must continue as the system operates.

Second, AI decisions increasingly carry ethical and societal implications. Algorithms are already influencing decisions related to hiring, insurance pricing, credit approval, healthcare diagnostics, and content moderation. Errors or bias in these systems can lead to legal exposure and reputational damage. Committee-level review creates a structured environment where such implications can be examined from multiple perspectives.

Third, AI strategy and AI risk are inseparable. Organisations that adopt AI too loosely expose themselves to regulatory and reputational risks. Organisations that govern AI too cautiously may fall behind competitors that use it more effectively. Oversight must therefore balance innovation with accountability, and a committee provides a forum for evaluating this balance.

What an AI Oversight Committee Should Do

The phrase “AI committee” can create confusion. Some boards assume it requires a new permanent board committee. In practice, oversight can take several forms depending on the organisation.

Some boards embed AI oversight within an existing risk or technology committee. Others establish a digital, data, or AI oversight committee reporting to the board. Regardless of the structure, the responsibilities tend to be similar. The committee’s purpose is to ensure AI governance moves from principle to practice.

One core responsibility is reviewing AI proposals and deployments at defined stages. A useful question for directors to consider is simple: where does this scrutiny currently happen in your organisation? Before significant AI systems are implemented, the committee should ensure adequate consideration of the system’s purpose, the data used for training, the expected business value, the potential risks, and the monitoring mechanisms to be used once the system is operational. The objective is not to slow innovation but to ensure meaningful scrutiny before systems affect customers, employees, or markets.

Committees should also request risk and impact assessments. AI systems introduce risks such as bias, privacy violations, cybersecurity vulnerabilities, lack of explainability, and operational dependency on automated decisions. Impact assessments should examine transparency, fairness, security, privacy, and, where relevant, broader societal implications.

Another key role is ensuring alignment between AI initiatives and organisational values. Many companies publish statements on responsible AI or the ethical use of technology. A committee can ensure these commitments are reflected in actual deployment decisions rather than remaining aspirational language.

Committees can also provide a channel for stakeholder input. Employees, customers, regulators, and civil society groups often identify risks that technical teams overlook. Structured oversight enables these concerns to be raised and evaluated in a controlled, constructive manner.

Critically, the committee must have the authority to raise red flags when necessary. It should be able to pause, recommend revision, or veto AI projects that fail to meet agreed ethical, legal, or operational standards. Without this authority, the committee risks becoming symbolic rather than effective.

Designing an Effective Oversight Committee

For committee-level oversight to be credible, the structure must be thoughtfully designed.

First, the committee should be diverse in expertise and perspective. AI governance cannot be managed solely by technologists. Effective oversight requires input from legal and compliance specialists, HR leaders, cybersecurity professionals, strategy and operations executives, and technical experts such as data scientists. Diversity should also extend beyond professional disciplines. Representation across gender, ethnicity, and organisational perspectives improves the committee’s ability to identify unintended consequences.

Second, the committee must be embedded within the organisation’s formal governance framework. This means having a clearly defined Terms of Reference, reporting lines to the board, scheduled review cycles, and documented decisions. The board should receive regular reports summarising AI deployments, emerging risks, and key governance decisions.

Third, the committee must be properly resourced and supported. Members should receive training on core AI concepts, model risks, and regulatory developments. Where necessary, organisations should provide access to independent experts who can assist with complex technical or ethical assessments.

Proportionate Governance for Smaller Organisations

Not every organisation can establish a formal AI oversight committee with dedicated staff. Smaller organisations often lack the internal expertise or resources to build such structures.

Yet the governance need still exists.

For micro-organisations and SMEs, proportionate approaches may include fractional advisory panels composed of external experts, periodic independent reviews of AI deployments, or outsourced governance support from specialist firms. The objective is not bureaucracy. It is ensuring that important AI decisions receive thoughtful evaluation before they shape products or services.

The Committee Must Not Become a Rubber Stamp

The committee’s culture matters as much as its structure. If the committee exists only to approve management proposals, it will fail.

A credible oversight body must function as a deliberative forum. Members should challenge assumptions, request additional evidence, and examine long-term implications. At the same time, the committee should support responsible innovation. The objective is not to stop AI development but to guide it.

A well-functioning committee often accelerates innovation rather than slowing it. By identifying risks early, organisations avoid costly regulatory problems, reputational damage, and public controversy.

The Strategic Advantage of Responsible AI Governance

Some boards worry that strong AI governance will slow innovation. Experience across industries suggests the opposite.

Organisations with credible governance frameworks often move faster because employees understand the boundaries within which they can experiment. Teams know what standards AI systems must meet. Management gains a clear process for evaluating proposals and prioritising initiatives.

Responsible governance also builds trust. Employees feel more confident experimenting with AI when guardrails are clear. Customers and regulators are more comfortable engaging with organisations that demonstrate thoughtful oversight.

Over time, governance becomes a strategic asset rather than a constraint.

What Boards Should Do Now

For directors and executives, three practical steps can help move AI governance from discussion to action.

First, map where AI is currently used across the organisation. Many boards are surprised by how widespread experimentation has already become.

Second, identify who currently oversees AI risk and deployment decisions. If accountability is unclear, governance gaps likely exist.

Third, establish a structured oversight mechanism. This may involve one or more of the following:

• empowering an existing committee,

• establishing an AI or digital oversight committee with the authority and expertise required to review AI initiatives effectively.

• introducing formal review processes for AI initiatives

These steps move AI governance from aspiration to action.

Final Thoughts

Artificial intelligence is moving rapidly from experimentation to infrastructure. As AI becomes embedded in products, services, and decision-making processes, the governance challenge will only intensify.

Boards cannot rely solely on occasional discussions or policy statements. Effective AI governance requires active practice. Committee-level oversight is one of the most practical ways to ensure oversight is consistent and thoughtful.

Done well, this structure does not slow innovation. It enables organisations to pursue AI opportunities with discipline and confidence while protecting customers, employees, and shareholders from unintended harm. In the long run, the organisations that succeed with AI will not be those that experiment most aggressively. They will be those who combine ambition with responsible governance.

If you found this useful, consider subscribing to AI in the Boardroom.

Each issue explores how boards and executive teams can turn AI disruption into a strategic advantage, covering strategy, governance, and transformation in the age of artificial intelligence.

Why boards must treat AI as a core competence, not a vendor service

In 2000, Toys “R” Us made a decision that looked sensible at the time. It partnered with Amazon to run its online sales. The logic was simple: Amazon was good at e-commerce, Toys “R” Us was good at toys. Let the specialist handle the technology.

A few years later, the channel became the market. The firm that had outsourced its digital capability no longer controlled the most important part of its business model. When the partnership unravelled, Toys “R” Us found itself without the internal muscle to compete in a world it had helped create.

This pattern repeats. Boeing outsourced large parts of its software engineering and system integration, hollowing out the very capability needed to assure safety in complex aircraft. Ford allowed vehicle software to fragment across hundreds of supplier-built modules, then discovered that speed, integration, and innovation had become impossible to orchestrate. In each case, what was once seen as “support” quietly became strategic. By the time leadership realised, the organisation no longer owned the competence required to respond.

AI now sits at the same inflexion point.

Many boards still treat AI as a technology to be procured, piloted, and rolled out. In reality, AI is becoming a general-purpose production and decision-making system that spans the entire enterprise. It shapes how products are designed, how prices are set, how risks are assessed, how customers are served, and how capital is allocated. Once a capability reaches that position, it is no longer an IT concern. It becomes part of the firm’s competitive identity.

Strategy, at its core, is not a plan. It is the set of decisions, assets, and capabilities that allow a company to do things rivals cannot, at a speed and quality they cannot match. You can outsource tasks. You cannot outsource the capability on which your advantage depends.

AI and the logic of core competencies

The idea of a “core competence” is simple. Some capabilities do more than support operations. They underpin multiple products, shape how the firm competes, and are difficult for others to copy. These capabilities deserve long-term investment, executive attention, and board oversight because they define what the organisation is.

AI increasingly meets all three tests.

It is not confined to a single product line. It cuts across marketing, operations, finance, risk, and R&D. It is not a marginal efficiency tool. It influences cost curves, service levels, speed of innovation, and the quality of decision-making. And when built on proprietary data, domain knowledge, and organisational learning, it becomes hard to replicate.

This is where the resource-based view of the firm becomes useful. Sustainable advantage comes from resources and capabilities that are valuable, rare, hard to imitate, and embedded in organisational systems. Generic AI services accessed through an API fail this test. They are widely available, easily copied, and outside the firm’s control. In-house AI capability built on proprietary data, tailored models, and disciplined operating routines can meet it.

Michael Porter’s value chain offers another lens. Competitive advantage is realised through activities: how the firm designs, builds, sells, and supports its products and services. AI now sits at the heart of many of these primary activities. It shapes demand forecasting, pricing, production planning, customer interaction, fraud detection, credit assessment, and compliance monitoring. When a capability permeates the value chain, it cannot be treated as a peripheral service. It becomes part of the way the firm creates value.

Once a capability reaches that point, the strategic question is no longer “Which vendor should we use?” It becomes “Do we own the competence to design, govern, and evolve this capability ourselves?”

Three levels of AI adoption, three strategic positions

Most organisations move through distinct stages in their use of AI. Each stage carries different implications for control, learning, and advantage.

Level 1: Using general models

At this stage, firms consume foundation models through standard interfaces. They build chatbots, automate document processing, and support knowledge work. Time to value is short. Costs are variable. Differentiation is minimal. Learning is limited because the underlying models, data pipelines, and evaluation methods are owned by someone else.

This is a sensible place to start. It is not a place to stay.

Level 2: Customising and fine-tuning

Here, organisations adapt general models using their own data. Performance improves. Use cases become more specific. Some intellectual property is created. Yet architectural control, safety mechanisms, and core learning loops remain external. Dependence on vendors persists. Switching costs rise. Strategic freedom remains constrained.

Level 3: Building and operating in-house capability

At this level, the firm owns the data architecture, model lifecycle, evaluation standards, and deployment pipelines. It may still use external cloud platforms and open models, but it controls how intelligence is trained, tested, monitored, and integrated into business processes. It develops its own talent, tools, and governance routines. Learning compounds over time.

This is the point at which AI becomes a core competence rather than a purchased feature.

The strategic distinction between these levels mirrors the distinction between renting capacity and owning capability. The former enables experimentation. The latter enables sustained advantage and effective governance.

Toys “R” Us: when a channel becomes the business

The lesson from Toys “R” Us is not about e-commerce. It is about misclassifying a strategic capability as a support function. Many organisations, and sadly consultancies, still make this mistake.

By outsourcing its online presence, the company also outsourced customer data, experimentation, and the learning cycles that would later define retail competition. When digital became central, it no longer possessed the skills, systems, or culture needed to adapt. The cost was not just lost revenue. It was lost strategic freedom.

AI now plays a similar role. For many firms, it is moving from a productivity tool to the primary interface between the organisation and its customers, employees, and partners. If that interface is built, trained, and controlled elsewhere, the firm may retain operational access but lose strategic agency.

Boeing: outsourcing engineering judgment

Boeing’s difficulties reveal a different dimension of the same issue. Complex systems demand system-level understanding. When software development and integration are fragmented across suppliers, knowledge becomes dispersed, accountability blurs, and management loses the ability to interrogate risk with confidence. Technical assurance becomes contractual rather than intrinsic.

AI systems exhibit similar characteristics. They are probabilistic, adaptive, and deeply dependent on data quality and operational context. If the organisation cannot inspect model behaviour, test failure modes, and understand interactions with other systems, governance becomes symbolic. Boards remain accountable for outcomes they cannot truly oversee.

Owning AI capability is not only about competition. It is about control.

Ford, Tesla, and the Chinese EV manufacturers: software as the product

Ford’s public acknowledgement of its software challenge markeda significantt shift. Over time, vehicle software had grown into a patchwork of supplier-built modules, each optimised locally but poorly integrated. Innovation slowed. Updates became complex. Learning cycles stretched.

Tesla and several Chinese electric vehicle manufacturers took a different path. They built vertically integrated software and data platforms. They treated software and, increasingly, AI as central to product identity and performance. This allowed rapid iteration, tight integration between hardware and intelligence, and continuous improvement based on real-world data.

The strategic difference is not simply technical. It is organisational. One model treats software and AI as components to be sourced. The other treats them as capabilities to be cultivated.

As AI becomes embedded in products and services across industries, the same divergence will appear. Firms that own the full learning loop will adapt faster than those that manage ecosystems of suppliers.

AI as a system of resources and routines

Competitive advantage does not arise from a single model. It arises from a system of resources and organisational routines, for example:

• Proprietary data that reflect unique customer behaviour, processes, and risks.

• Talent that understands both the domain and the methods.

• Platforms that support training, testing, deployment, and monitoring.

• Governance mechanisms that define acceptable risk, ensure compliance, and enable intervention.

• Cultural norms that encourage experimentation and disciplined review.

Together, these form a dynamic capability: the ability to sense opportunities, test responses, and scale what works while containing what does not.

This is the true core competence in the age of AI. It cannot be bought off the shelf.

What to buy and what to own

Boards need clarity on the boundary between sourcing and stewardship.

Infrastructure, commodity tooling, and generic applications can be procured. Strategic architecture, data governance, model evaluation, and the integration of AI into critical decisions must be owned.

In practice, this means:

• Retaining internal accountability for AI strategy and prioritisation.

• Owning the data pipelines that feed learning systems.

• Defining and enforcing standards for model performance, bias, robustness, and security.

• Building internal capability to challenge vendors and to operate independently if required.

• Ensuring that knowledge generated by AI use remains within the organisation.

Questions for boards

A small set of questions can reveal whether AI is being treated as a core competence or a utility:

1. Which parts of our value chain will be shaped most by AI within three years?

2. Where does AI influence differentiation, cost, or risk in ways competitors cannot easily match?

3. Which of these capabilities do we currently rent rather than own?

4. Who is accountable for the end-to-end AI lifecycle, from data to decision?

5. How do we test, explain, and override the models that affect critical outcomes?

6. What learning loops allow us to improve faster than our peers?

7. What is our exit strategy from any vendor whose technology has become mission-critical?

These are strategic questions, not technical ones. They belong in the boardroom.

The strategic choice

Toys “R” Us lost a channel. Boeing lost system-level engineering coherence. Ford lost software speed and integration. Each case reflects the same underlying error: mistaking a future-defining capability for a support service.

AI is now crossing that threshold in many sectors. It is becoming part of how firms compete, not just how they operate. The decision facing boards is whether to treat AI as something to be purchased or as something to be built, governed, and renewed as a core competence.

You can outsource delivery. You cannot outsource learning. You can buy tools. You cannot buy the organisational capability that turns those tools into sustained advantage and effective control.

In the age of AI, strategy is inseparable from the capabilities you own.

If you want more practical, board-level insight on how to govern AI, link it to strategy, and build the capabilities that matter, subscribe to AI in the Boardroom. This newsletter is written for directors and senior leaders who want to turn AI from a source of anxiety into a source of advantage.

Boards are increasingly asking for an AI strategy. Most organisations respond with enthusiasm, pilots, and slide decks. A year later, little has changed. Some teams use AI daily. Others block it. Risk sits on the sidelines, and value is unclear. This is not a failure of ambition or technology. It is a failure of clarity.

Most boards talk about “AI” as if it were a single thing. It is not. AI enables different levels of automation, and each level changes the game in material ways. It affects how value is created, where risk sits, who is accountable, and what the board must oversee. When boards miss this, two predictable patterns emerge.

Some overreach. They talk about autonomy and transformation before basic controls are in place. That leads to stalled programmes, regulatory anxiety, and quiet reversals.

Others underreach. They treat AI as a productivity tool for analysts and marketers. They gain small efficiency wins and miss the strategic upside that competitors are already capturing.

Both outcomes stem from the same root problem: a lack of shared language. In my work with boards and executive teams, there is a simple, practical model to fix this. It breaks AI down into three levels of automation. Each level is real and already in use. Each carries a very different value and risk profile.

This model does not require technical depth. It gives boards a way to ask better questions, set clearer boundaries, and govern AI without slowing the organisation down. If you want AI to drive advantage rather than confusion, this distinction matters. The rest of this article explains the three levels, what they enable, what can go wrong, and what boards should do at each stage.

Automation Level 1 - AI to Augment Tasks Performed by Humans

At the augmentation level, AI supports humans in their work; it does not replace them. The AI acts as a partner or co-pilot: it gathers data, surfaces insights, suggests options—and the human retains final decision-making authority. The human remains in the loop, guiding strategy, interpreting nuance, and bearing accountability. This means the organisation uses AI to enhance human judgement, speed and scale tasks rather than handing over control. For boards and executives, this is often the safest entry point: lower risk, faster value, less governance burden, but still substantial potential upside.

Consider a large professional services firm’s audit department. They deploy an AI system that reads contracts, extracts clauses, flags anomalies, and offers the audit manager a ranked list of risks to review. The manager then chooses which flagged items to pursue, drafts questions, and leads the human conversations. An AI model augmented human judgment; it did not replace it. Similarly, in HR, AI might sift thousands of employee survey responses, detect underlying sentiment patterns, and surface the top themes for the HR Director to address—human insight remains central.

Think of Level 1 as a competent analyst. It produces output. You still edit and sign off on it.

Augmentation is a pragmatic first step: you retain human control, deploy AI models to improve your people’s decision-making, reduce mundane load, improve speed and insight, and thereby increase productivity. From a board governance perspective, the required oversight is manageable. Use this level to build AI literacy, governance frameworks, and internal trust before moving to higher autonomy.

The three types of AI you must not confuse.

At Level 1, boards often lump all AI into one category. That creates sloppy oversight. You need to distinguish three common model types because their risks and controls differ.

1) Classification: “Which bucket does this belong in?”

Classification sorts items into categories.

Typical uses:

• Fraud detection: suspicious vs everyday transactions

• Spam filters: spam vs not spam

• Customer support: route to the right team

• HR: identify CVs that match baseline criteria (with care)

Classification is powerful because it improves consistency and speed. It is also easier to test because the outputs are discrete classes.

Board lens: classification tends to fail in predictable ways. You can measure error rates and track drift.

2) Regression: “What number should we predict?”

Regression predicts a number or a probability.

Typical uses:

• Forecasting demand

• Predicting churn risk

• Estimating delivery times

• Credit risk scoring (within a governed framework)

Regression is often the hidden engine in planning and forecasting. It can be very valuable, but only if the underlying data is clean and stable.

Board lens: regression failures often show up as bad forecasts that look “reasonable”. The harm is business-value erosion rather than scandal until it touches regulated decisions.

3) Generative AI: “Create text, images, code, or summaries”

Generative AI produces new content. Large language models, such as ChatGPT and Gemini, sit here.

Typical uses:

• Drafting documents and emails

• Summarising reports and meetings

• Searching internal knowledge bases via natural language

• Drafting code, test cases, and documentation

• Creating first drafts of policies, training content, or comms

Generative AI is the most visible form of AI right now, and the most misunderstood. Generative AI is not a truth machine. It produces plausible output based on patterns. It can be wrong in a confident tone. It can also leak sensitive data if used carelessly.

Board lens: generative AI risk is less about “accuracy in a test set” and more about real-world use: confidentiality, IP, bias, audit trail, and who relies on output without checking.

Real Level 1 examples that boards will recognise

Many organisations are already integrating these use cases into their everyday work, boards included. Examples include:

• Board pack summarisation: AI creates an executive summary, a draft risk heatmap, and a list of questions to ask. The company secretary and the exec team verify.

• Contract and policy drafting support: AI drafts clauses or compares versions. Legal reviews and owns the final document.

• Finance analysis: AI flags anomalies, drafts commentary, and suggests drivers. Finance signs off on numbers and narrative.

• Risk and incident support: AI clusters incidents, suggests root causes, and drafts post-incident reports. The incident manager validates.

Level 1 is not “small”. It can change cycle times, reduce rework, and lift decision quality across the organisation. This can have a tangible impact on bottom lines. However, some things can go wrong at this level. Some common failure modes include:

• Over-trust. People treat AI output as correct because it reads well.

• Data leakage. Staff paste confidential content into public tools.

• Poor prompts, poor results. Output quality varies wildly by user skill.

• Shadow AI. Teams use tools outside policy because it is easy.

Level 1 failures are usually containable if you set rules early. The key here is to keep governance simple and enforceable by doing the following:

• Define where AI is allowed.

• Internal-only drafts? Fine.

• Customer-facing comms? Tight controls.

• Regulated decisions? Treat as Level 2 governance even if “advisory”.

• Set “human-in-the-loop” standards.

  • What must be checked every time?

  • What can be sampled?

  • Who signs off?

• Lock down data handling.

  • Approved tools and approved accounts.

  • Clear rules on confidential and personal data.

  • Central logging, where feasible.

• Train staff on safe use.

  • Not a vague e-learning. A short, sharp playbook:

  • What to use AI for,

• What not to use it for,

• How to verify outputs.

Questions directors should ask at Level 1

• Where is AI being used today, formally and informally?

• What data is going into prompts, and where does it go?

• What outputs are customer-facing or regulator-facing?

• Where is human review required, and is it happening?

• How do we capture incidents and near-misses?

If you cannot answer these, you do not have Level 1 under control. Do not move to Level 2.

Automation Level 2 - AI to automate well-defined tasks previously done by humans

At this level, the AI takes over well-defined tasks (or workflows) that humans previously did, with minimal human intervention. The task is sufficiently structured and repeatable that the AI can automate it reliably. Humans still monitor, manage exceptions and escalations, but the daily execution is machine-led. AI for automation means replacing specific tasks with AI models. This works best with tasks that are repeatable, bounded, high-volume, and have clear success criteria. This is where measurable cost savings and speed gains arrive. It is also where risk rises sharply because errors scale.

Typical Level 2 use cases include

• Claims handling for simple cases (with escalation for edge cases)

• Invoice processing and reconciliation

• Customer service resolution for routine issues

• Document processing and extraction at scale

• Automated KYC checks in defined scenarios

• Scheduling and routing in operations

At Level 2, the risks shift from “bad output” to “bad outcomes”. Key risks include:

• Scale of harm. A model error hits thousands of cases quickly.

• Fairness and bias. If it affects customers or staff, scrutiny increases.

• Explainability and audit. You need to show what happened and why.

• Control failures. No clear kill switch or escalation path.

• Drift. Performance degrades quietly as data changes.

The board does not need to understand the complex mathematics of these models, but it does require confidence that controls match the impact.

Board-level controls that matter at Level 2

• Explicit decision rights

  • Who approved automation?

  • Who owns outcomes?

  • Who can pause it?

• Clear boundaries and exception handling

  • What cases are automated?

  • What cases must escalate?

  • What is the fallback process?

• Monitoring of outcomes, not activity. Track:

  • error rates,

  • rework rates,

  • complaint rates,

  • time to resolve,

  • fairness indicators where relevant,

  • financial leakage.

• Independent testing before deployment

  • Test on historic data.

  • Test on edge cases.

  • Red-team the process: how could it fail in practice?

• Audit trail

  • What data was used?

  • What version of the model ran?

  • What decision was made?

  • Who overrode it?

Automation is the next step beyond augmentation: you’re handing over execution of tasks to AI. The human oversight role remains, but the operational burden shifts. For board/executive teams: this is where you must raise governance, risk monitoring, exception management and change management sharply, because the scale is bigger. Value is real — cost down, throughput up — but risk moves up too.

Automation Level 3 - AI to behave as an autonomous agent to plan & execute actions to achieve goals

Agentic AI refers to AI systems that behave as autonomous agents: they set or are given goals, plan the tasks to achieve those goals, decide which tools to use, take actions, and adjust course, often without human prompting. The human might be in the loop, but AI is doing far more than executing rules; it is orchestrating workflows, making decisions, and continually adapting. According to Oracle: “Agentic AI refers to an AI system that’s capable of making autonomous decisions … then executing on its decisions.”

From the board’s perspective, this is the highest autonomy tier, offering significant value potential, but also the highest risk. Value arises from scalability, speed, adaptive workflows, and “digital workers” replacing or extending humans significantly.

Some carefully bounded examples of what Level 3 can do in real organisations include:

• IT operations agents that diagnose incidents and run approved fixes

• Security response agents that triage alerts and trigger defined actions

• Procurement agents that run sourcing workflows within thresholds

• Sales enablement agents that build account plans and schedule outreach (with controls)

• Finance agents that chase approvals, reconcile variances, and prepare close packs

What boards should demand before Level 3 scales:

• A clear agent charter

  • What goals is it allowed to pursue?

  • What goals are prohibited?

  • What constraints are non-negotiable?

• Permission design

  • Least privilege access.

  • Separate environments.

  • No shared credentials.

  • Strong identity controls.

• Human approval gates

  • external communications,

  • payments,

  • contract changes,

  • customer decisions,

  • production deployments.

• Continuous logging and replay

  • prompts, actions, tool calls, outputs, timestamps.

• Testing for failure behaviours

  • edge cases,

  • adversarial inputs,

  • conflicting objectives,

  • unexpected tool responses.

• A shut-down path that works

  • immediate revoke of permissions,

  • stop job queues,

  • fall back to manual process.

Agentic AI is the frontier of autonomy: significant potential gains, but also big governance stakes. Boards and executives must not treat it as just another automation tool. They need to think about goals, boundaries, oversight, accountability, and learning loops. If the governance is weak, the risk is high. If it’s done well, value can scale.

How to Use the Three Levels as a Board

Below is a simple, board-friendly way to operationalise this model.

1) Create an “AI Automation Register”

This is a one-pager. Updated quarterly and presented to the board or a board committee.

For each AI system:

• owner,

• business area,

• automation level (1/2/3),

• what it does,

• what data it uses,

• what outcomes it affects,

• key controls and monitoring.

If you cannot list it, you cannot govern it.

2) Match governance intensity to automation level

• Level 1: policy, training, approved tools, human review rules, and incident logging.

• Level 2: formal risk assessment, monitoring of outcomes, audit trail, kill switch tests.

• Level 3: agent charter, permission controls, approval gates, deep logging, tighter board scrutiny.

Do not over-govern Level 1. It kills adoption and drives shadow use.

Do not under-govern Level 2 and 3. It creates systemic risk.

3) Link AI to strategy in plain terms

Boards get stuck because “AI strategy” sounds abstract.

Use a simple framing:

• Which strategic outcomes do we need? (growth, cost, risk, service, speed)

• Which business constraints block them? (capacity, cycle time, decision quality, cost to serve)

• Which automation level addresses each constraint safely?

AI becomes a portfolio of interventions, not a hype programme.

4) Set a risk appetite for autonomy

The board should make an explicit call:

• Where are we comfortable with augmentation only?

• Where are we comfortable with automation?

• Where do we allow agents, and under what constraints?

Make it explicit. If you do not, the organisation will decide by default, project by project, with uneven controls.

Summary: What to Remember

Level 1 augments people. It improves speed and quality. Keep humans accountable. Know the difference between classification, regression, and generative AI.

Level 2 automates tasks. This is where savings scale. Risks scale too. Govern outcomes, not tools.

Level 3 uses agents. Autonomy makes goal-setting, permissions, and logging the main governance issues. Treat this like delegation, not software.

The board’s job is not to become technical. It is to ensure the organisation is making explicit choices about autonomy, value, and risk.

If you found this useful, subscribe to AI in the Boardroom. I write for directors and senior leaders who want clear thinking, practical controls, and real-world examples of what works and what fails.

In my work advising boards around strategy, AI and transformation, one thing has become abundantly clear in recent years: AI is no longer a technical project sitting three levels down in the organisation. It is now a strategic force that shapes cost, pace, innovation, risk, trust, and competitive position.

Yet most leadership teams cannot answer a fundamental question: What level of AI adoption are we aiming for?

This sounds simple. It isn’t. Many organisations jump between isolated use cases without a clear direction. Some chase hype. Others avoid action due to fear of risk. The result is the same: confusion, slow progress, and little value delivered.

To help organisations understand the scope of their AI ambitions, I use a simple framework with my clients: the Four Levels of AI Automation. It shows how AI can reshape personal work, operations, products, and whole business models. Each level brings new expectations for leadership involvement, data requirements, in-house capabilities, risk, and governance.

This article explains the four levels in clear terms. It includes real examples and straightforward guidance for board oversight. No buzzwords. No over-the-top promises. Just a clear roadmap that shows where you are, what comes next, and what you need to do.

Level 1: AI for Personal Productivity & Decision-Making - The Co-pilot Phase

At this level, AI tools are adopted by individuals to serve as intelligent collaborative partners, helping individuals work faster and make better decisions. The primary objective is to enhance the productivity, creativity, and effectiveness of knowledge workers by augmenting human tasks or providing rapid, data-informed decision support. Think of it as a smart aide. It drafts, summarises, plans, and checks. You stay in charge. The tool speeds you up and reduces cognitive load. It feels small, but it isn’t. If every knowledge worker speeds up by 20–40%, entire workflows change.

A CFO uses AI to draft board finance papers. She still checks everything, but she starts from a smarter first draft. Her team follow her lead. Cycle times dropped by days, and her analysts now spend more time on judgment and less on formatting.

A sales director uses AI inside his CRM to qualify the pipeline. It reviews inputs, flags missing data, and predicts which accounts might be at risk of slipping. The team catch risks far earlier.

A legal head uses AI to summarise case files and produce early contract outlines. It reduces time spent on admin and frees capacity for real thinking.

Leadership, accountability, and focus

At this level, leaders set the tone. If the CEO and executive team use AI, others will follow. If they avoid it, adoption dies. Leaders should model use cases in public. They should share how they use AI to read papers or prepare meetings. These signals change culture far more than a policy memo.

Accountability sits with functional heads. Their job is to redesign the daily workflow. AI only helps when people change how they work, not when they bolt a tool onto existing habits.

Organisational data readiness

The data requirement is low. AI tools can create value from basic inputs, but teams soon hit a wall when internal data is unclear, missing, or scattered. Level 1 exposes gaps that must be fixed later for Levels 2 and 3.

Proprietary model development

None needed. Off-the-shelf tools deliver strong returns, but guardrails matter. Staff must know when they can and cannot share sensitive content.

AI literacy

This is the highest return investment you can make at this stage. Teach people how to write prompts, check output, and make better decisions with AI. Most people use only 5–10% of the capabilities of the tools they have.

Governance and compliance

At this level, organisations must ensure clear rules for:

• What data can be shared

• When humans must check AI output

• How quality should be reviewed

• How prompts and outputs are monitored

Mistakes often happen through carelessness, not malice. Good governance prevents these problems before they become headlines.

This level represents the lowest-risk entry point for AI. Organisations should start here. It is fast to deploy, cheap to test, and easy to govern. Roll it out to knowledge workers first. Start with clear tasks: drafting emails, notes, briefs, slides, code, and simple analysis. Add guardrails, measure gains, prove value, build literacy, then expand the scope.

Level 2: AI for Efficient Operations - The Value Chain Optimisation Phase

This level focuses on applying AI across specific, established functional departments or points in the organisational value chain to drive measurable efficiency, cost reduction, and process improvement. AI systems are integrated into existing workflows to automate high-volume, repetitive tasks and optimise resource allocation. This is where things get interesting. The focus shifts from improving individual productivity to influencing core processes. You start redesigning how work flows across teams.

AI models run and improve core processes. They forecast, schedule, route, classify, and detect. They reduce waste and errors across Ops, Supply Chain, Finance, HR, and IT. Humans remain in control of the exceptions and own the outcomes. Pick high-volume, repeatable flows with clear targets. This is where material P&L gains show up.

Banks use AI to detect fraud, assess credit risk, and flag suspicious activity. These systems run thousands of checks per second and spot patterns that humans would miss.

Retailers use machine learning to predict demand, reduce overstock, adjust prices, and optimise delivery routes. The effect on the margin is real.

Manufacturers use predictive maintenance systems that tell engineers when a critical part will fail. Unplanned downtime drops. Safety improves.

A large insurer I worked with now uses AI to classify claims documents. Staff no longer sift through long reports. The system reads, tags, and routes each item. Case handlers focus on decisions rather than scanning PDFs.

Leadership, accountability, and focus

Ownership shifts to senior operational leaders. AI now touches throughput, cost, and risk.

KPIs must be clear:

• Cycle-time

• Accuracy

• Cost-to-serve

• Failure rates

The COO becomes a key sponsor. Cross-functional collaboration becomes essential because processes rarely fall neatly within a single department.

Organisational data readiness

Now data quality matters. Organisations need clean, structured, reliable datasets that connect across systems. If your ERP and CRM don’t speak to each other, AI will struggle. Leaders must treat data as infrastructure, not as a nice-to-have. Without this level of data readiness, Level 2 becomes slow and painful.

Proprietary model development

Many firms fine-tune models on their own data. You rarely need to build models from scratch.

Your advantage usually comes from strong pipelines, clear labels, and frequent updates.

AI literacy

Teams in operations need to understand:

• How models behave

• When to override predictions

• How to spot drift

• How to manage exceptions

These skills must sit across technology, risk, and business units.

Governance and compliance

As opportunity rises, risk rises with it. You now automate decisions that affect money, safety, and trust. This demands:

• Model testing

• Fairness checks

• Documentation

• Audit trails

• Regulatory alignment

• Clear human oversight

Boards should ask for evidence, not reassurance.

Level 3: AI for Innovative Value Propositions - The Product & Service Enhancement Phase

Level 3 marks a shift from internal efficiency to external value delivery. AI is used as a core component to fundamentally enhance the quality, personalisation, or capability of the organisation’s products, services, and customer interactions, creating tangible competitive advantages.

AI shapes the product and the experience. It personalises content, pricing, offers, and journeys. It powers service across channels. It becomes part of the product’s value, not just the back office. Use it where choice is vast, context shifts often, and speed matters. Media, retail, travel, telco, and banking are prime ground. Personalisation increases use, retention, and spend.

Streaming platforms personalise every user’s experience.

Retail banks offer AI-driven insights on spending, saving, and money habits.

Learning platforms supply AI tutors that adapt to each student.

Car manufacturers provide real-time alerts, predictive servicing, and assisted driving features.

I advised a firm that used AI to personalise every step of its customer onboarding. The system predicted the best sequence of actions for each client. This reduced drop-off by a third. The board had expected a modest uplift. Instead, they saw a dramatic shift in customers’ perception of the product.

This level turns AI into part of the product promise. Done well, it drives growth and loyalty. It becomes hard to copy because it relies on your data and your learning. It also raises the bar on ethics and accountability.

Leadership, accountability, and focus

The focus moves to product strategy. AI capability becomes a source of differentiation.

Ownership sits with the CPO and CTO, but the board must stay close due to customer impact, brand risk, and regulatory exposure.

The organisation must work cross-functionally. Product, engineering, data, marketing, legal, and risk teams must align. AI-driven features create new kinds of failure. Slow coordination kills momentum.

Organisational data readiness

Customer-level data must be accurate, linked, and accessible. Organisations need real-time flows, strong tagging, and consistent standards. Data privacy becomes a design constraint rather than an afterthought. Customers must have complete trust in how their data is used.

Proprietary model development

This is where proprietary models start to matter. The value lies in training on your own datasets: behaviour patterns, usage signals, support cases, equipment telemetry, or user feedback loops. Competitors cannot copy this without your data. This is the first point where AI creates a lasting strategic edge.

AI literacy

Product managers must understand how to build with AI. Designers must learn how users interact with conversational agents. Engineers need deeper model skills. This is not optional. If leaders do not understand AI at this level, they cannot govern it.

Governance and compliance

Customer-facing AI creates new classes of risk:

• Inaccurate recommendations

• Unfair outcomes

• Unclear decisions

• Hallucinations

• Harmful advice

• Breach of trust

Boards should require:

• Impact assessments

• Testing environments

• Safety reviews

• Monitoring dashboards

• Red-teaming

• Clear escalation paths

Level 3 offers high reward but also high exposure.

Level 4: AI for Disruptive Business Models - The Industry Reimagination Phase

This is the highest level of transformation, where AI is leveraged to create entirely new operating models, redefine industry structures, or capture new markets that were previously inaccessible. The focus moves beyond incremental improvement to leveraging proprietary AI capabilities as the foundational architecture of the business.

Here, AI is no longer a tool inside the business. It is the business. It enables new models, breaks cost curves, and reshapes value pools. Incumbents feel it in margins and share. New entrants scale fast. AI changes the unit economics or the speed of discovery. It creates experiences that were previously not feasible.

Consider autonomous vehicles. The entire economic model of transport changes when driving becomes software. Costs fall. Safety improves. Asset use rises.

Or think about factories run by autonomous systems. You no longer need large teams on the floor. Sensors, robots, and predictive systems handle most tasks. The cost structure collapses.

The typical pattern is clear: AI enables work to be done in ways that were previously impossible.

Leadership, accountability, and focus

This becomes a CEO and board-led agenda. These decisions affect the organisation’s entire strategy. They involve long-term bets, heavy investment, and new forms of oversight.

Leaders must have clear answers to:

• What markets are we entering?

• What risks do we accept?

• How do we protect customers?

• How do we manage liability?

• What skills do we need?

• What systems must we build?

Strategy becomes technology-led. Execution involves partners, regulators, and new ecosystems.

Organisational data readiness

Data becomes mission-critical. You need high-quality, real-time input streams, strong data governance, and monitoring that detects failure early. If the data is weak, the model collapses. If the model collapses, the business model collapses.

Proprietary model development

At this stage, many firms build advanced models or large R&D teams. The advantage comes from unique data, strong telemetry, and deep domain knowledge. These models often require new infrastructure and new talent.

AI literacy

Everyone must improve their skills. Executives need enough understanding to govern complex systems. The technical teams need world-class expertise. Product teams need to understand limits and failure modes. Risk teams need new tooling and new methods.

Governance and compliance

This is the highest-risk level. Failures become system-wide. A single model error can cause significant harm.

Boards should expect:

• advanced safety frameworks

• continuous audits

• fail-safe design

• independent review

• crisis playbooks

• regulatory engagement

Level 4 is where trust becomes a strategic asset.

This level is not a tech pilot. It is a strategic bet. It can redefine cost curves, cycle times, and customer norms. Treat it like a new business and build models with strong governance in place.

A Simple Way to Use This Framework

When I present this model to boards, I ask three questions:

1. Which level are we operating at today?

• Most firms sit between Level 1 and Level 2.

• A few reach Level 3.

• Very few operate at Level 4.

2. What level are we trying to reach?

• This forces clarity on ambition, risk appetite, and investment.

3. What must change in leadership, data, skills, and governance to get there?

• This brings discipline and order to AI discussions that often spin in circles.

Boards find this grounding. Executives find it helpful because it cuts through noise. It gives both sides a shared ambition and language.

Summary

AI adoption is not one thing; it is a ladder. Each level changes what is possible and what is required.

Level 1: Personal Productivity

• AI boosts individual output and judgment.

• Leaders must model usage.

• The focus is on literacy and safe practice.

Level 2: Efficient Operations

• AI supports the value chain.

• Operational leaders take control.

• Data and process redesign matter.

Level 3: Innovative Value Propositions

• AI shapes products and services.

• It creates new customer value and a competitive edge.

• Risks become public and must be governed carefully.

Level 4: Disruptive Business Models

• AI rewrites industry rules.

• Boards and CEOs must lead from the front.

• The risks are high, but so are the rewards.

(download a PDF of the visual here)

The organisations that win treat AI as a leadership discipline, not a technical project. They build clarity, maturity, and strong governance at each step.

If you found this helpful…

👉🏽 Subscribe to AI in the Boardroom to get weekly insights, tools, and guidance on how directors and executives can use AI to strengthen strategy, improve oversight, and build stronger organisations.

For many decades, boards and executives have worked together to define an organisation’s strategy. This undertaking has always required a clear vision, relevant data, and tough choices. The pace of change, the volume of available data, and the complexity of ecosystems are all increasing. According to McKinsey & Company, AI and generative AI are now “a new inflexion point in strategy design” that magnifies the capacity for insight and choice.

For boards and executives, this raises a dual challenge:

• How do we embed AI into the strategic process so it strengthens rather than fragments our efforts?

• How do we turn AI into a competitive advantage, not just cost savings or pilot inertia?

If you fail to address these challenges, you risk falling behind organisations that treat AI as foundational to strategy, rather than an add-on. There are many opportunities in the strategy process to embed AI tools. These include:

• vision, purpose, mission, & values,

• external analysis - macro environment,

• external analysis - industry dynamics,

• internal analysis - core capabilities,

• strategy formulation - competitive advantage,

• strategy implementation & execution,

• risk, governance & ethical dimension.

We will explore each of these in turn.

Vision, Purpose, Mission & Values

A good strategy provides both a direction of travel and a high-level positioning. Before zooming in on tools and frameworks, you must start with direction. A strategy without an anchor will likely fail. A clear Vision, Purpose, Mission & Values (VPMV) sets the north star. Without them, you may apply AI tactically—but miss where to play and how to win. The board must ask: Does our VPMV still reflect AI-era realities?

Practical steps for boards

• Conduct a workshop with senior leadership: examine the Vision statement through an AI lens. Ask: if AI doubles our data speed or automates major processes, does our Vision still reflect what we seek to become?

• Use AI to test assumptions. For example, take transcripts of stakeholder interviews and run natural language processing (NLP) to identify emerging values or contradictions (we’ll return to this).

• Define one or two ‘North-Star’ metrics tied to your AI ambition (see next section).

• Once VPMV is refreshed, communicate widely: the board sets the tone, leadership drives.

Map your existing Mission (“We deliver customer-centric financial services”) and ask: if we embed AI, what shifts? Perhaps you become “We deliver real-time anticipatory financial services.” Then you test stakeholder sentiment—via AI-driven sentiment analysis of customer and employee feedback—to validate whether the shift resonates.

How AI can help

• Use AI to digest interviews, customer feedback, and leadership round-tables to identify stakeholder values and tensions.

• Run rapid A/B testing of different phrasings of Vision and Mission statements: show them to random internal/external audiences, measure sentiment, clarity and resonance.

• Use generative AI to draft alternative Mission/Value statements, then review and refine with the board.

That embeds AI into the core of strategic grounding — not as an afterthought.

External Analysis – Macro Environment

Strategy must start outward. What is happening in the world that could affect you? What is the likelihood and impact of each identified threat or opportunity? What will you do to mitigate or capitalise on each of them?

Common tools

• PESTLE (Political, Economic, Social, Technological, Legal, Environmental) analysis

• Impact/Certainty matrix (which trends are high-impact & high-certainty)

• Horizon-scanning

• Scenario planning (extremes plus central cases)

• Country attractiveness when operating internationally

How AI could add value

• Use AI tools to continuously automate horizon scanning: monitor news, regulations, geopolitical signals, and industry commentary to flag signs of change. Deep research can be an excellent tool for this, and can do in a few minutes what would take a consultant weeks, and at a fraction of the cost.

• Detect strategic inflexion points: e.g., a regulatory shift in AI governance, or a new entrant disrupting with a business model.

• Use simulation or generative modelling to test different macro-scenarios and their impact on your business.

• Quick “what-if” models: if interest rates rise and AI adoption doubles in X segment, what’s the effect on your cost base or competitor speed?

Example anecdote

A major infrastructure services company used an AI-driven platform to scan regulatory filings, patent filings and global news feeds. It flagged a shift in Chinese infrastructure financing 12 months ahead of their internal PESTLE review. The board then scheduled a scenario planning day and reallocated strategy time to that region.

Why boards should care

Often, boards receive a static macro environment slide deck once a year. AI enables living insight. For non-executive directors, the questions become:

• Are we asking the right questions of management around these signals?

• Do we require updates on horizon-scanning and scenario shifts at each board meeting?

• Are we prepared for both opportunity and risk at the macro level?

External Analysis – Industry Dynamics

Zoom in: what’s happening in your specific industry? Who are the main competitors, suppliers, and customers? What changes are coming?

Common tools

• Porter’s Five Forces analysis

• Technology S-Curve (where is the adoption tipping point?)

• Ecosystem mapping (partners, competitors, new entrants, regulators)

How AI could add value

• AI can speed up competitor and industry analysis by scraping public filings, news feeds, and patent databases, and by building competitor profiles.

• Predict future industry attractiveness: AI can model adoption curves, supply-chain shifts, and customer behaviour trends.

• Analyse market/customer behaviour: apply AI to internal and external customer data to spot shifts earlier.

• Strategic “game-theory” modelling: what likely moves will our competitors make if they embed AI?

Example

An insurance board asked: “What happens if a fintech start-up uses AI to undercut us on risk assessment and pricing?” Using AI competitor mapping and scenario modelling, they estimated a 15-per-cent erosion of premium income within 36 months if they did nothing. They then accelerated their AI-embedded product launch accordingly.

Board considerations

• Are we adjusting our Five Forces analysis to include AI as a force (e.g., AI lowering switching costs and creating new-entrant threats)?

• Do we have metrics to monitor our position on the S-Curve of AI adoption in our industry?

• Does our ecosystem map include new nodes enabled by AI (data partners, ecosystem incumbents, regulatory technology)?

Internal Analysis – Core Capabilities

Having looked outside, we now look inside at ourselves. What do we have and what do we need? What are our key resources and capabilities that give us our unique competitive advantage?

Common tools

• Value Chain analysis

• Core-competency identification

• VRIO/VRIN framework (Value, Rarity, Imitability, Organisation)

• SWOT (Strengths, Weaknesses, Opportunities, Threats)

How AI could add value

• Automate or augment processes in your value chain: e.g., AI in procurement, logistics, marketing, and service.

• Use AI models and proprietary data as strategic resources that competitors cannot easily replicate.

• Use AI to analyse your internal capability gaps: for example, talent, data architecture, governance, culture.

• Real-time dashboards using AI to monitor internal performance, identify bottlenecks and run early-warning indicators.

Example

A retail business used AI to map its end-to-end value chain, overlaying internal data flows and external customer touchpoints. It was discovered that its data capture in the last-mile delivery segment was weak, making targeted AI-enabled personalisation impossible. The board mandated investment in data capture, which enabled a differentiator in customer loyalty.

Board questions

• What parts of our value chain are subject to automation or augmentation via AI, and what does that mean for our business model?

• Do we treat our data, AI models, and workflows as strategic assets (i.e., VRIO)?

• How well are we organised for AI: talent, infrastructure, governance, culture?

• Are we monitoring internal capability gaps and addressing them proactively?

Strategy Formulation & Competitive Advantage

This is where it all comes together. Having analysed vision, the external and internal environment, you can now choose where to play and how to win—and build competitive advantage.

Common tools

• Generic strategies (cost leadership, differentiation, focus)

• Where to play / How to win frameworks

• Portfolio analysis / BCG Matrix

• Ansoff Matrix / McKinsey 3‑Horizons Framework

• Blue Ocean Strategy

• Game-theory modelling

How AI could add value

• You can build AI features into products and services: making the offering smarter, more adaptive, more valuable.

• Personalise customer interactions at scale: using AI to tailor experiences, offers, and service.

• Use AI to simulate “what-if” strategies: test different business models, pricing, customer segments, and service levels rapidly.

• Automate insights from customer behaviour and generate novel strategic options: AI can surface patterns humans miss.

Example

A healthcare company asked: “Should we enter diagnostics as a service using AI?” They used scenario modelling with AI to evaluate market sizes, reimbursement risks, and ecosystem partners. They then decided to adopt a “focus-plus-differentiation” strategy: target a niche segment (chronic disease diagnostics), use AI for predictive detection and partner with digital health platforms. The board reviewed the models, agreed on the strategy, and allocated resources accordingly.

Key for boards

• Make the hard choices: where will we play, how will we win? AI supports, but does not replace judgment.

• Ensure resource allocation aligns: AI investments must map to strategic choices and the business model.

• Monitor strategic options as dynamic: AI changes can shift “how to win” faster than in past eras.

Strategy Implementation & Execution

A strategy is only as good as its implementation. Boards must ensure execution, not just ambition.

Common tools

• OKRs (Objectives & Key Results)

• Hoshin Kanri / Traction / Cascaded goals

• McKinsey 7‑S Framework

• Balanced Scorecard

How AI could add value

• AI can support the the creation of objectives and goals by using historical data and scenario modelling to set realistic yet stretching OKRs.

• AI can automate risk and compliance audits: freeing leadership to focus on value, while governance remains robust.

• Real-time monitoring and dashboards: AI-driven tools alert boards or executives when strategy drift occurs.

• Continuous feedback loops: AI models learn from execution data and refine strategic metrics or goals.

Example

A manufacturing firm used AI to monitor the execution of a cost-reduction strategy. The board set OKRs focused on efficiency, customer lead time, and service level. The AI platform tracked thousands of sensor data points and flagged when a production line was deviating. This allowed leadership to intervene early rather than wait for the quarterly report.

Board checklist

• Are strategy implementation metrics aligned with AI-capable monitoring?

• Does our governance oversight include dashboards that use AI-driven signals for early warning?

• Do we have a clear cascading of goals (board → executive → function) with AI-aware measures?

• Is our organisation structured (7-S) to embed AI: shared values, skills, systems, style, staff, structure, strategy?

Risk, Governance & Ethical Dimensions

This thread runs across all the stages above. Boards cannot ignore it. Research shows that firms with strong governance around AI build greater trust and can convert it into a competitive advantage. For example, according to EY, companies that embed responsible AI practices gain a premium in stakeholder trust and long-term value.

IBM asserts responsible AI is a differentiator in competitive markets: it strengthens brand, attracts talent, and retains customers.

Practical board mechanisms

• Establish an AI oversight committee (or designate board sub-committee) linking strategy, risk, ethics and technology.

• Set AI literacy expectations: directors need basic knowledge of AI capabilities, risks and architecture—the board article on governing AI underlines this.

• Embed ethics, fairness, and transparency metrics into the balanced scorecard.

• Require scenario testing of AI failures/risk events (e.g., data bias, model drift, regulatory shock).

• Link AI strategy to enterprise risk management (ERM): AI is not separate; it’s at the heart of many risks (operational, reputational, strategic).

Actionable Tips for Boards & Executives

• Start with a one-pager. At your next board meeting, ask: “How does AI affect each element of our Vision & Values?” Use this as a catalyst for deeper reflection.

• Require an AI-strategy briefing. Ensure management presents how AI will support strategy formulation and execution—not just “pilot projects”.

• Ask for a capability heat-map. Request from leadership a map of AI readiness across people, data, models, infrastructure, and culture.

• Set a board dashboard. Insist on a simple, high-level AI-strategy dashboard: adoption metrics, value delivered, risk indicators, model drift alerts.

• Embed scenario planning. Make AI-driven scenario modelling part of your regular strategic review cycle. Choose at least one “wild card” scenario (e.g., regulatory shock in AI, competitor uses AI to halve cost).

• Focus on value, not hype. Don’t let AI become a distraction from core strategy. Ask: “What business value will this deliver? How will we monetise it or build differentiation?”

• Monitor sustainability. Competitive advantage from AI can be fleeting unless you embed systems, data, culture, and governance. Ask: “Can our competitors copy this within 18-24 months?” If yes, you need a new edge.

Summary

Boards and senior leaders must treat AI as a strategic instrument, not an optional tool.

You begin with Vision, Purpose, Mission & Values, then map the macro and industry context, assess internal capabilities, formulate strategy, and execute it—all with AI in mind.

From horizon scanning to internal dashboards, from scenario modelling to value chain automation, AI offers both opportunities and risks.

Your job as a director or executive: ask the right questions, insist on clarity of value, allocate resources, monitor execution and governance, and ensure that AI becomes a sustainable competitive advantage, not just noise.

👉🏽 Download a handy AI for Strategy & Competitive Advantage One-Pager.

👉🏽 If you found this useful, subscribe to AI in the Boardroom. You’ll receive future deep-dives packed with actionable insights on AI strategy, governance, transformation and board oversight. Let’s make AI a source of strength—not risk—for your organisation.

Whether we like it or not, directors need to face a simple fact: artificial intelligence, particularly its governance, is now firmly a board issue. Many directors know it, but few feel confident talking about it, let alone exercising leadership.

I see it in my advisory work every week — people nodding along to terms like foundation models, RAG pipelines, or AI governance frameworks, while quietly wondering what they really mean. It’s understandable given the speed of change. The language of AI is evolving faster than most organisations and directors can adapt.

That’s why I created The Ultimate AI Glossary for Directors & Leaders — a single reference for leaders who need clarity, not hype or jargon.

Why it matters

Boards are being asked to sign off AI strategies, risk frameworks, and compliance plans. But without a shared vocabulary, conversations stall, misunderstandings creep in, and risk oversight weakens.

This glossary aims to fix that. It covers over 200 key terms — from algorithmic bias to zero-shot learning — all explained in plain English, written for directors, not data scientists. Every definition has been checked for accuracy and aligned with current UK, EU, and OECD guidance.

How to use it

Use it before your next strategy session, risk review, or AI presentation. Keep it open when reviewing proposals or supplier claims. It will help you ask sharper questions, challenge assumptions, and make better decisions.

AI governance isn’t about knowing how to code. It’s about knowing what to ask, what to approve, and what to challenge.

Where to get it

To access The Ultimate AI Glossary for Directors & Leaders, you may either view an online version or download a handy PDF version to view offline.

And if you want regular, board-level insights on AI strategy, governance, and transformation, subscribe to my newsletter AI in the Boardroom.

Every week, I share practical tools and insights to help boards turn AI disruption into strategic advantage — safely, ethically, and profitably.

Subscribe now

AI now consistently appears in board packs, strategy sessions, and risk registers. Directors are being asked to approve AI investments, manage regulatory obligations, and protect their organisations from reputational harm. Yet many still don’t know what “responsible AI” means in practice.

One place to start is with the OECD’s Principles on Artificial Intelligence. These were the world’s first intergovernmental AI standards, adopted in 2019 by 46 countries, including the UK, the US, and EU members. They underpin the EU AI Act and are shaping regulations worldwide.

At their core are the five principles for responsible stewardship of trustworthy AI. They set out what “good AI” looks like—not for engineers, but for leaders. Boards that ignore them are taking unnecessary risks.

Let’s break them down.

1. Inclusive growth, sustainable development, and well-being

This principle is about making sure AI drives prosperity for people and the planet—not just profit. Trustworthy AI can support inclusive growth, sustainable development, and the UN Sustainable Development Goals across areas such as education, health, transport, agriculture, and the environment.

Boards must also recognise the risks. AI can widen inequalities if access is uneven or if systems reinforce existing biases. Vulnerable groups—minorities, women, children, older people, and low-skilled workers—are especially exposed. These risks are even greater in low- and middle-income countries.

Responsible stewardship means guiding AI to reduce, not amplify, these divides. It requires clear safeguards, cross-sector collaboration, and open public dialogue. The aim is to use AI to empower all members of society, build trust, and create outcomes that benefit everyone.

Example: When UPS introduced AI-driven route optimisation (ORION), it cut fuel costs and carbon emissions. Shareholders benefited, but so did drivers and the environment. Compare that with Amazon’s failed AI recruitment tool, which downgraded CVs from women. It created reputational harm and regulatory exposure.

For directors:

• Ask if your AI projects create value beyond short-term profit.

• Challenge management to explain the human impact.

• Consider sustainability and workforce implications as part of every AI business case.

• Consider the implications of increased energy use on ESG policies.

2. Respect for the rule of law, human rights and democratic values, including fairness and privacy

This principle states that AI must be built on human-centred values: freedom, fairness, equality, the rule of law, privacy, and consumer rights.

Poorly designed systems risk infringing human rights, whether by accident or intent. Boards should ensure AI is “values-aligned”, with safeguards, human oversight, and the ability to intervene when needed. Doing so keeps AI behaviour consistent with democratic values, reduces discrimination, and builds public trust.

Tools like human rights impact assessments, ethical codes, and quality certifications can embed fairness and accountability into AI development and use.

Example: In the US, a global bank had to scrap its AI CV screening system after it amplified gender bias. Regulators and the media took notice. In healthcare, several NHS trusts are piloting AI diagnostics tools. These raise critical questions: are they equally accurate for all patient groups?

For directors:

• Insist on bias audits before systems are deployed.

• Demand clear evidence that AI decisions can be explained in plain English.

• Hold management to account for fairness metrics, not just financial ones.

3. Transparency and explainability

Transparency means people should know when they’re dealing with AI—whether it’s a chatbot, a recommendation, or a decision. It also means providing meaningful information about how a system was built, trained, and deployed so that users can make informed choices. Transparency does not mean handing over source code or proprietary data, which is often unnecessary or impractical.

Explainability goes further. People affected by AI decisions should be able to understand the primary factors and logic behind an outcome, and challenge it if needed. The level of detail depends on the context. High-stakes decisions demand clarity; low-risk interactions may need less.

Boards should note the trade-offs: explainability can reduce accuracy and add costs, but without it, trust and accountability collapse. The goal is clear communication, simple, accessible explanations that respect privacy, protect IP, and still allow scrutiny.

Example: Credit scoring algorithms are notorious for opacity. The EU has already fined firms for failing to explain automated decisions to consumers. Boards that sign off on opaque systems are exposing themselves to legal and reputational risk.

For directors:

• Require management to present AI systems in language that non-technical directors can understand.

• Test explainability yourself—if you can’t explain a decision to a regulator, you shouldn’t approve the system.

• Ensure your risk committee tracks AI transparency as a standing item.

4. Robustness, security, and safety

AI systems must not pose unreasonable safety risks in everyday use, foreseeable misuse, or over their whole lifecycle. Existing consumer protection laws already define many of these risks, and governments are deciding how they apply to AI.

Two tools stand out:

• Traceability: keeping records of data sources, cleaning, and processes so outcomes can be analysed, mistakes corrected, and accountability strengthened.

• Risk management: applying structured methods to identify, assess, and mitigate risks, from bias and privacy breaches to digital security threats, at every stage of the AI lifecycle. Different uses demand different levels of protection.

For boards, the message is clear: without robust systems, secure design, and continuous risk management, AI becomes a liability rather than an asset.

Example: Self-driving cars highlight the stakes. A software glitch or adversarial attack can cost lives. In an enterprise, a single faulty algorithm can wipe millions from market value in minutes, as Knight Capital’s trading debacle proved in 2012 (though not AI, the lesson is clear).

For directors:

• Ask if AI models have been stress-tested.

• Confirm cyber teams are included in AI governance from day one.

• Demand incident response plans for AI failures—just as you would for data breaches.

5. Accountability

While responsibility, liability, and accountability overlap, accountability is the most relevant for AI. It means organisations and individuals must ensure AI systems function properly throughout their lifecycle and can show how and why decisions were made.

It is not just about blame after something goes wrong. It is about taking ownership, documenting key decisions, enabling audits, and showing regulators, customers, and stakeholders that governance is in place.

For boards, the message is simple: you cannot outsource accountability to an algorithm or a vendor. The buck stops with leadership.

Example: The Dutch childcare benefits scandal starkly illustrates this. An AI system falsely accused thousands of families of fraud. The fallout forced the government to resign. The lesson: accountability is non-negotiable.

For directors:

• Ensure clear ownership of AI risks across the organisation.

• Mandate board-level oversight—whether through the audit, risk, or ethics committee.

• Include accountability in vendor and partner contracts.

Why this matters for boards

These five principles are not abstract ideals. They are becoming the baseline for regulation. The OECD framework influenced the EU AI Act, the US AI Bill of Rights, and the UK’s AI White Paper.

For boards, adopting them now means:

• Strategic clarity: AI projects link to sustainable value creation.

• Risk protection: You stay ahead of regulatory and reputational risks.

• Trust building: Customers, employees, and investors see AI as responsible rather than reckless.

The question is not whether you adopt these principles. It is whether you do so before regulators or the public force your hand.

Takeaway for directors

When AI is on your board agenda, test proposals against these five principles. If they don’t measure up, push back.

• Does it benefit more than just shareholders?

• Does it respect fairness and human rights?

• Can you explain it to a regulator or journalist?

• Has it been stress-tested and secured?

• Is there clear accountability?

If you can’t answer “yes” with confidence, you have work to do.

Final thought

The OECD AI Principles give boards a practical framework for responsible stewardship. They are not a compliance burden. They are a guide to turning AI into a strategic advantage, while avoiding the pitfalls that have already cost others dearly.

If your board is serious about AI, these five principles should be on your agenda.

👉🏽 If you found this helpful, subscribe to AI in the Boardroom. Each week, I share practical insights to help directors and executives turn AI disruption into opportunity—while staying safe, ethical, and compliant.

As we have seen in previous posts, AI is no longer an IT side project. It is strategy. It is risk. It is reputation. It is also regulation - arriving faster than many boards think. The new business paper from the Institute of Directors (IoD), AI Governance in the Boardroom, gives directors a practical framework: 12 principles to govern AI use sensibly and safely. Treat it like a board pack, not a blog. Read it, adopt it, and assign owners.

This article breaks down the paper, showing its connection to current regulations and providing board-level actions. It also provides credible case examples, enabling you to brief your colleagues with confidence. Where possible, I’ve linked to primary sources.

What’s new - and why it matters

The IoD paper updates the 2023 guidance, incorporating the reality of today’s AI: wider use, increased risk, and tighter expectations from regulators, investors, and customers. It also includes results from an IoD Policy Voice survey of ~700 directors and business leaders: two-thirds use AI personally; half say their organisations use AI; a quarter lack any AI policy or governance. That gap is where fines, headlines, and value erosion live.

The EU AI Act entered into force on 1 August 2024, with staged obligations through 2025–2027. Boards operating in or selling into the EU will need to understand the risk-based model, new obligations for deployers, and the timeline for compliance.

The UK is taking a regulator-led approach. As such, there is no single AI Act. Expect sector regulators (FCA, ICO, CMA, Ofcom, MHRA) to tighten guidance and enforcement using existing powers, backed by the Department for Science Innovation and Technology (DSIT), the AI Security Institute, and the Digital Regulation Cooperation Forum (DRCF). Boards should assume that expectations will continue to rise, even without a single statute.

Bottom line: the governance bar is moving up. Your board can either guide this, or get guided by events.

The IoD’s 12 principles - what they mean in practice

The paper’s strength is practicality. It provides a simple, board-owned approach to guiding AI across strategy, risk, compliance, and culture. Here’s what to take into your next meeting.

1) Monitor the evolving regulatory and (geo)political environment

Map your exposure to the EU AI Act, UK regulators, and any other jurisdictions where you operate or sell. Decide who updates the board and how often. Use a simple dashboard: obligations, deadlines, status, red flags.

Board question: Which rules will apply to us over the next 12 months, and are we prepared?

2) Continually audit and measure

Create one source of truth for all AI systems in use; internal, vendor, embedded in platforms, and “shadow” tools your people already use. Tie each system to an owner, purpose, data sources, risks, and controls. Align to standards where it helps. ISO/IEC 42001 is now the AI management system benchmark.

Board question: Do we know where AI shows up across our technology stack and supply chain?

3) Undertake impact and risk assessments

Don’t stop at model metrics. Assess impact on employees, customers, suppliers, and communities. Determine your organisation’s risk appetite. Decide where humans must stay in the loop. In higher-risk settings, seek independent assurance.

Board question: Who might be harmed, and how would we know?

4) Establish Board accountability and management responsibilities

Name a board committee with oversight. Name an executive owner. Put AI into risk and audit cycles. Keep veto rights with the board for high-risk deployments. Communicate this to staff and investors.

Board question: Who signs off on AI risks today? Is that formal?

5) Set high-level strategic goals

No “AI because everyone else is doing it.” Nor should AI be a shiny solution searching for a problem. Define a small set of plain-language goals: augment people, improve quality, speed decisions, protect customers, cut waste. Make success measurable. Keep it tied to values and ESG commitments.

Board question: What “AI-shaped” problems are we solving, and how will we measure success?

6) Empower a cross-functional, operational, independent review committee

Cross-functional. Trained. Resourced. With the authority to pause or reframe projects. The role is to surface issues early, not to block innovation. Build a clear Terms of Reference and define the reporting line to the board.

Board question: Can this committee actually stop a launch if needed?

7) Validate, document and secure data sources, and assess data assets

Provenance, quality, bias controls, logging, and retention. Be explicit about synthetic data. Treat decision logic like any other controlled asset: understandable and auditable. Build tripwires to detect model drift or suspicious behaviour.

Board question: Where does this data come from, and who has checked it?

8) Train and upskill people

AI literacy is not optional. Tailor training for the board, the exec team, frontline users, and engineers. Teach people to challenge outputs and escalate concerns. Make this part of the induction. Reward good practice.

Board question: Do our people know when to question the machine?

9) Comply with privacy requirements

Minimise personal data. Honour rights. Use Data Protection Impact Assessments (DPAIs) where needed. Follow your regulator’s guidance on AI and data protection.

Board question: Can we evidence privacy-by-design for each AI system?

10) Comply with security-by-design requirements

Adopt the SSDLC for AI, penetration test, red-team, monitor suppliers, and log incidents. Consider standards like ISO/IEC 27001 and the UK AI Cyber Security Code of Practice.

Board question: Have we stress-tested our AI like we stress-test our finances?

11) Test and evaluate systems and remove from use

Pre-deployment testing is table stakes. More importantly, a straightforward process to pause or retire systems that drift, degrade, or cause harm. Contract for this with vendors. Keep the board’s veto alive.

Board question: If this system fails, who is responsible for shutting it down, and how quickly?

12) Review systems, policies and governance practices regularly

AI governance is not “set and forget.” Plan reviews. Track KPIs. Invite independent assurance. Keep a human-in-the-loop where the stakes are high.

Board question: When did we last review our AI inventory, risks, and controls?

Real-world signals directors should know

Boards often ask for proof that AI governance matters. Here are some real-life examples to use in the boardroom.

Recruitment bias: Amazon scrapped its internal AI screening tool
Amazon ended an experimental CV-screening system after discovering it penalised resumes that included indicators associated with women. The issue is that the model was trained on historical, male-dominated hiring data. The outcome was that the project was scrapped, a lesson for everyone. This is not about one company; it is about data and governance.

Hiring platforms under scrutiny: EEOC vs Workday
In the U.S., a class-action suit alleges discriminatory screening by Workday’s tools. The court allowed key claims to proceed in July 2024, and the EEOC has argued that anti-bias laws can cover Workday as an “employment agency.” Workday disputes the allegations. Regardless of the outcome, this shows where regulators are heading and why boards must ask tough questions of vendors.

NHS diagnostics: AI to speed stroke treatment
NHS England has deployed AI in stroke pathways. Brainomix e-Stroke has been credited in government reporting with significantly cutting “door-in-door-out” times, enabling faster treatment. NHS England has also been piloting a central AI Deployment Platform, routing radiology images to approved AI tools for decision support. The key lesson is that governance, vendor assurance, and clinical oversight are essential.

Cancer pathways: AI in chest X-ray and imaging networks

Regional NHS alliances report using AI to accelerate chest X-ray review in suspected cancer, with published research on procurement and early deployment across 66 Trusts. This is a valuable case when discussing explainability, clinical validation, and change management at scale.

These are not “tech” stories. They are governance stories: data, bias, assurance, safety, and accountability.

How directors can use this IoD paper

The IoD’s guidance is not abstract. It is a direct response to cases like these and to the regulatory shift now underway. The paper offers checklists and “what boards should consider” prompts for each principle. If you only do one thing this month, make sure to incorporate those prompts into your next board agenda.

Three practical moves I recommend:

1. Stand up a one-page AI register and review it quarterly
   Maintain a comprehensive inventory that includes: system, purpose, owner, training data, decision logic, risks, controls, KPIs, vendor status, and review date. Tie this to risk and audit cycles. Reference ISO/IEC 42001, where it helps you bring order and cadence.

2. Adopt a plain-English AI policy with real guardrails
   Cover acceptable use, privacy-by-design, security-by-design, human-in-the-loop, red lines, escalation, and incident reporting. Make the policy visible to staff and vendors. Bake it into onboarding and procurement.

3. Form (or empower) an independent review committee
   Cross-functional, empowered to pause launches, and trained to read assurance reports. Give it a clear Terms of Reference and a line to the board. Use it to normalise complex trade-off discussions before systems go live.

And four frequently-asked questions to be ready for:

1. “Do we really need to care if we are UK-only?”
   Yes. UK regulators are active. And your vendors may be operating under EU rules, which push obligations onto deployers through contracts and product requirements.

2. “Can’t we just rely on the vendor’s assurance?”
   No. Vendor assurance is necessary, not sufficient. You must validate fit-for-purpose in your context: your data, your processes, your risks, your people. Keep testing, even post-deployment.

3. “What does ‘human-in-the-loop’ actually mean?”
   A trained person who can understand the system’s role, challenge the output, and override it when needed. That requires process, time, and authority—not just a box tick.

4. “Where do we start if we have nothing?”
   Begin by establishing an inventory and a basic policy. Pick one pilot system. Run a lightweight impact assessment. Prove the muscle, then scale.

What to do before your next board meeting

• Download the IoD’s paper and my one-pager summary (see below). Bring it to your next board meeting.

• Map AI use in your organisation. Don’t rely on assumptions—include third-party tools.

• Agree on accountability. Name a director and a committee to oversee AI.

• Set clear goals. Align AI projects with strategy, values, and measurable outcomes.

• Plan regular reviews. AI governance is a cycle, not a tick-box.

Final thought

Boards don’t need to be AI experts. But they must be AI-literate governors. The IoD has given directors a framework to start. The next move is yours.

👉🏽 Download the IoD’s AI Governance in the Boardroom Business Paper.

👉🏽 Download my IoD - AI Governance in the Boardroom - Principles One-Pager.

And if you want regular insights on strategy, governance, and AI at the board level, subscribe to AI in the Boardroom.

Note: The IoD principles are based on the original work, Anekanta Responsible AI Governance Framework for Boards by Anekanta Ltd, Licensed under CC BY-NC-SA 4.0

Artificial intelligence adoption is accelerating across almost every industry. There is a powerful opportunity to achieve a competitive advantage through increased productivity, or augmenting value chains and even value propositions. With this opportunity, comes risk, complex ethical dilemmas, and the potential for increased attention of regulators. For directors, the question is no longer “should we care about AI?” but “how do we govern and lead responsibly in the age of AI?”

Too many boards treat AI as a technical project to be delegated to IT. That is a mistake. The consequences of AI, be they strategic, financial, legal, and reputational, fall squarely within the remit of directors. Oversight cannot be abdicated. It is too important an issue to ignore.

To provide effective stewardship, every board should begin with five core questions.

1. How does AI align with our business strategy and enhance our competitive advantage?

AI is not a bolt-on. It has the potential to automate daily tasks, augment your value chain, or reshape entire business models. Boards must ask whether management is using AI to reinforce the organisation’s unique sources of competitive advantage, or merely chasing shiny tools without strategic coherence.

• What capabilities do we have that AI can amplify (e.g. data assets, customer relationships, operational scale)?

• Are we investing in AI in ways that truly differentiate us from competitors, or simply keeping up?

• How will AI shift our industry’s economics in the next 3–5 years, and are we preparing for that shift?

Boards should expect management to articulate how AI initiatives link explicitly to the business strategy, not just as experiments, but as drivers of growth, productivity, and resilience.

2. Do we have the right governance and oversight in place?

AI introduces new risks - data privacy, bias, opacity, accountability gaps - that traditional governance structures are not built to handle. Boards need clarity on how these risks are being identified, managed, and escalated.

• Who within management is accountable for AI governance?

• Do we have the right board-level committees (Audit, Risk, Ethics) actively monitoring AI?

• Are our policies aligned with evolving regulation, including the EU AI Act and UK AI guidelines?

• Do we have the expertise on the board, or through external advisors, to scrutinise management effectively?

Without proper oversight, AI can erode trust quickly. Directors should press for clear accountability and transparent reporting.

3. What risks - ethical, legal, regulatory, and reputational - do we face?

AI failures make headlines. From discriminatory recruitment algorithms to deepfake fraud, the downside risks are real and rising. Boards must treat AI risks as part of enterprise risk management, not a separate silo.

• What guardrails are in place to ensure AI systems are fair, explainable, and secure?

• How exposed are we to regulatory non-compliance in the jurisdictions in which we operate?

• What reputational damage could result from misuse of AI, and how prepared are we to respond?

An organisation’s licence to operate increasingly depends on responsible AI. Boards should view this not only as a compliance obligation, but as a matter of trust and legitimacy.

4. How prepared is our organisation for transformation?

AI transformation is not only about technology. It requires data readiness, cultural change, new skills, and re-engineered processes. Boards must probe management’s readiness honestly.

• Do we have the quality data, infrastructure, and cybersecurity foundation required?

• Are we investing in up-skilling our workforce to work alongside AI?

• How are we engaging employees, trade unions, and stakeholders in this transformation?

• Are we addressing ethical use internally, not just in products, but in how we deploy AI with staff?

Transformation readiness is where many organisations stumble. Boards should demand a realistic assessment of organisational capabilities, not glossy roadmaps.

5. What opportunities are we missing by moving too slowly?

Caution is prudent, but excessive caution is dangerous. The pace of AI adoption means laggards risk losing competitive ground rapidly. Boards must balance risk management with strategic boldness. As a veteran of dozens of digital and agile transformations over two decades, I have witnessed first hand the risks of an abundance of caution.

• Where are competitors already using AI to gain cost or innovation advantages?

• Are there adjacent opportunities we could seize by moving faster?

• What partnerships or acquisitions could accelerate our AI journey?

Boards must encourage management to explore opportunity as rigorously as risk. Standing still is rarely a safe strategy.

Summary

AI is no longer an emerging technology, it is an enterprise reality. Boards that fail to engage meaningfully risk strategic drift, regulatory exposure, and reputational harm.

Asking these five questions is a starting point, not an endpoint. They help boards move from curiosity about AI to competence in overseeing it.

Directors do not need to be data scientists. But they do need to ensure AI is governed, aligned to strategy, and embedded responsibly in transformation. That is a board duty no different from finance, risk, or sustainability.

Next Steps for Boards

Download my AI Governance Board Checklist (a one-page tool to structure oversight).

Let’s have a conversation about AI strategy, governance, and transformation tailored to your organisation.

Welcome to AI in the Boardroom

Hi, and welcome to AI in the Boardroom, a newsletter for board directors, executives, and senior advisors who need to understand and govern artificial intelligence responsibly, strategically, and with confidence. As AI transforms industries at pace, leadership teams must ensure they are equipped to manage the ethical, legal, and strategic dimensions of this shift. This publication exists to bridge that gap.

This is a new space dedicated to one thing: helping boards and senior leaders make sense of AI. It will deliver clear, board-level insights on strategy, governance, and transformation in the age of AI.

AI is no longer just a technology topic, it’s a boardroom issue. It touches strategy, risk, regulation, culture, and transformation. The stakes are high: get it right, and AI can reshape competitive advantage; get it wrong, and you face reputational, regulatory, and operational risk.

Boards can’t afford to ignore it, nor can it be delegated to IT teams.

That’s where AI in the Boardroom comes in.

Who this newsletter is for

AI in the Boardroom is written for:

👍🏽 Non-Executive Directors or Chairs overseeing risk and strategy
👍🏽 C-suite executives accountable for transformation and compliance
👍🏽 PE-backed leaders navigating disruption and governance expectations
👍🏽 Board committee members (Audit, Risk, Governance etc.) seeking clarity on AI
👍🏽 Consultants advising on AI strategy and transformation
👍🏽 Senior policymakers or regulator shaping corporate oversight

If you sit at the top table, this is for you.

What this newsletter delivers

AI in the Boardroom focuses on what directors need to know - no hype, no jargon, no technical rabbit holes.

Subscribers will receive:

✅ Concise board briefings twice a month on AI governance, strategy, and risk
✅ Exclusive practical tools like frameworks, checklists, and cheatsheets
✅ Regulatory intelligence — what EU and UK policy shifts mean for your board
✅ Case studies and governance lessons from real transformations
✅ Invitations to private director events including briefings, masterclasses, and roundtables

This isn’t about hype or technical deep dives. It’s about giving directors the right lens to ask the right questions and make better decisions in the boardroom.

Who I am

I’m Karim Harbott, a Chartered Director, board advisor, and executive educator.

➡️ I teach strategy for the Institute of Directors.
➡️ I serve on boards, governance committees, and Finance Audit & Risk Committees
➡️ I’ve worked internationally in strategy, digital transformation, and AI governance, across financial services, government, retail, technology, and sport.
➡️ I’m the co-founder of a global strategy, AI, and transformation consultancy.
➡️ I’m the author of The 6 Enablers of Business Agility.

My focus is always at the top table: helping boards and executives oversee AI responsibly, govern effectively, and drive transformation with confidence.

My purpose

In my board and advisory work, I see a growing gap:

❗️Directors know AI is critical, but don’t know what questions to ask.
❗️Executives are under pressure to “do AI,” but boards struggle to oversee it responsibly.
❗️Regulators are moving fast, yet many boards are behind.

It can be overwhelming trying to keep up. My goal is to close that gap, giving leaders the clarity, tools, and frameworks to navigate disruption without the noise without spending hours following every latest development.

This newsletter is my way of sharing those insights more widely.

If you’re still reading — thank you. I want this to be useful, practical, and directly relevant to your role as a leader.

Now, I’d love to hear from you:
👉🏽 What’s the biggest AI-related challenge or question facing your board right now?
👉🏽 What would you like to see more of in this newsletter?

Reply to this email or drop a comment below.

Welcome aboard. I’m glad you’re here.

Karim