AI and the Board: Governance Obligations in an Automated Decision Environment

Many directors already use AI for board work. Few boards govern it

There are two separate AI governance questions facing an association board right now, and conflating them is where most boards go wrong. The first is how the organisation itself uses AI in its operations. The second is how the board uses AI in its own governance work. Both matter. The second is the one almost nobody has governed yet.

The Framework Now Available For The First Question

The AICD, in partnership with the Human Technology Institute at the University of Technology Sydney, has published a substantial and regularly updated suite of AI governance resources for Australian directors, including an AI Governance Checklist for SME and NFP Directors. The flagship Director's Guide to AI Governance organises board-level oversight into eight elements: roles and responsibilities; governance structures; people, skills and culture; principles, policies and strategy; practices, processes and controls; supporting infrastructure; stakeholder engagement and impact assessment; and monitoring, reporting and evaluation. This is not abstract theory. It maps directly onto governance disciplines already covered throughout this series, delegated authority and reporting, risk appetite, and third-party and vendor oversight, applied specifically to a technology most boards have not yet built a framework for.

Alongside this sits the Australian Government's Guidance for AI Adoption (National AI Centre, 2025), which condenses the ten guardrails of the earlier Voluntary AI Safety Standard into six essential practices: decide who is accountable; understand impacts and plan accordingly; measure and manage risks; share essential information; test and monitor; and maintain human control.

The Second Question, Where The Actual Gap Sits

Survey data points to a striking gap on the second question. An August 2025 Diligent Institute and Corporate Board Member poll of US public company directors found 66 per cent had used AI for board work, such as reviewing papers, drafting and preparing for meetings, but only 22 per cent said their board had formal AI governance, ethics or risk policies. Australian association data is limited, but the same gap is likely. This is precisely the kind of informal, ungoverned drift this series has warned against in other contexts, an inner board risk discussed earlier this quarter, except here the risk is directors individually feeding confidential board papers into AI tools with no organisational visibility into what data is being shared, with whom, or under what terms. A board can have a sophisticated policy governing how the organisation uses AI in its programs and services, and still have zero governance over what its own directors are doing with confidential board papers and AI tools every single week. The second gap is usually the larger and more immediate risk.

Why This Is A Governance Matter, Not An IT Matter

Unauthorised or undisclosed AI use, sometimes called shadow AI, sits squarely inside the director duties this series has covered throughout: care and diligence, proper use of confidential information, and the delegation and reporting discipline discussed earlier this quarter. A director who pastes confidential board papers into a consumer AI tool without understanding how that data is retained or used may breach the duty to keep board information confidential and to act with care and diligence, and may also breach privacy obligations if the papers contain personal information, whether or not any harm eventuates.

• Adopt an explicit board-level policy covering directors' own use of AI tools for board work, not just the organisation's operational use of AI, treating confidential board material with the same discipline as any other confidential information.
• Map where AI is being used across the organisation, an AI inventory in the language of current guidance, since a board cannot govern what it cannot see.
• Use the eight-element AICD and HTI framework, and its specific SME and not-for-profit checklist, as a working structure rather than reinventing governance language from scratch.
• Treat AI oversight as a standing risk category within the risk appetite statement discussed earlier this quarter, rather than a separate, occasional agenda item disconnected from the board's broader risk framework.
• Assign accountability for AI decisions and AI-related risk, consistent with the delegations of authority discipline covered in the previous quarter, so oversight does not remain diffused across nobody in particular.

AI governance is moving quickly enough that any specific tool or platform named in this article will likely be outdated within a year. The underlying governance discipline will not. A board that builds oversight structures now, covering both how the organisation uses AI and how its own directors do, is building something durable regardless of how the technology itself continues to change. This is one of the practical governance topics built into our AI for Association Leaders course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.