Principles Are Not Controls
Edition 18 — Why adopting AI principles for the board's own use changes nothing until four of them are treated as controls, not aspirations.
A board can sit through a presentation on responsible AI, nod at eight sensible principles, adopt them in the minutes, and change nothing about how its directors use the technology the following week. This is not cynicism about boards; it is a fact about principles. The eight I set out in the accompanying standard are the ones almost any director would endorse on sight: use AI to support judgement rather than replace it, stay accountable, protect confidential material, treat outputs sceptically. Agreement is easy precisely because each of these asks a director to behave well in private, at the moment of use, where no one is watching. A principle everyone accepts, and no one can be held to, does not govern anything. It is a good intention with a letterhead.
The eight only start to work once you notice that they are not eight things of the same kind. Four of them describe outcomes the board wants: judgement preserved, accountability intact, confidentiality protected, outputs verified. The other four describe the conditions that produce those outcomes: a written policy, director literacy, ethical alignment, and a test that admits AI only where it improves board effectiveness. The first four are what good looks like. The second four are the machinery that makes good happen, and that lets the board know whether it is happening at all. Adopt the first four as a flat list, and you have named the destination without building the road to it.
Take the principle directors endorse most readily: AI should support a director’s judgement, not replace it. Nothing in that sentence tells a director where the line sits, gives them the literacy to recognise when they have crossed it, or gives the board any means of knowing they have. On its own, it is unenforceable — agreeable and inert. What makes it bite is the machinery beneath it: a policy that states what is acceptable, literacy sufficient to challenge an output rather than defer to it, and a board that has built the habit of asking. Confidentiality is the same. It is a fine aspiration until a policy names the approved tools and bars board papers from everything else. So is accountability, which is real enough in law — the Companies Act duty of reasonable care, skill, and diligence, and in regulated firms the Senior Managers regime — but only operative around the table once the board has decided what verification it expects before an AI-assisted analysis informs a decision. The load-bearing work is done by the second four. The first four are the outcomes they secure.
This changes what a board should actually do when guided by a set of principles. The instinct, handed eight of them, is to argue the hard philosophical one — how far AI should be allowed to reach into a director’s judgement — and then defer, because the room cannot agree. That debate can wait. The four conditions cannot, because the exposure they address is live now, whatever the board eventually concludes about judgement. The director who pastes a confidential board pack into a public chatbot to summarise it before a meeting has already created the exposure, and no principle she nodded at last quarter stopped her, because none of them was a control she could be held to. A policy costs the board an afternoon; that single paste can cost it a disclosure it cannot retract.
A board does not need to settle where the line sits in order to write down what is acceptable, fund the literacy to apply it, and name who owns the standard. Those are decisions: fundable, assignable, and cheap. The philosophical question is interesting, and it is also the one part of this that can be left open for a year without anyone being exposed in the meantime. The conditions are what protect directors until it is settled.
So the useful output of adopting these principles is not the list on the wall. It is four commitments a board can make in a single meeting. A short policy covering directors’ own use, with named approved tools and a stated verification standard. AI literacy treated as continuing development that the board funds, rather than a competence it assumes it already has. An explicit expectation that AI-assisted work meets the same ethical standard as any other board conduct. And an effectiveness test that keeps AI out of the parts of governance it cannot improve, deliberation first among them. Name an owner — usually the board together with the company secretary, who is often already the person quietly experimenting — and set a cadence to revisit it as the tools move. That is the whole of the exercise, and none of it waits on the philosophy.
The distinction between an outcome and a control is not academic here. It is the difference between a board that has admired a set of principles and one that has put them into practice. The version most boards will be offered is the flat list, because it is the easiest version to present and the easiest version to adopt. The version worth adopting names the four conditions and treats the other four as the purposes for which those conditions are used. A board that does this has not solved AI governance for its own desk — the technology will keep moving, and the standard will need revisiting. It has done the narrower and more useful thing: made the principles it agreed with capable of governing anything.
If this is the kind of board-level analysis you want more of, subscribe to AI in the Boardroom. I write for directors, executives, and advisers who would rather understand what responsible AI adoption requires than adopt principles that change nothing. The eight principles this piece is built on are available as a downloadable standard below, written for directors’ own use rather than as another framework for governing the enterprise’s AI. Future editions will stick to the governance and accountability questions that boards cannot delegate, including those that begin at their own table.
Download the Principles for Responsible AI Use by Directors