There are two genuinely separate AI governance questions facing an association board right now, and conflating them is where most boards go wrong. The first is how the organisation itself uses AI in its operations. The second is how the board uses AI in its own governance work. Both matter. The second is the one almost nobody has actually governed yet.
The framework now available for the first question
The AICD, in partnership with the Human Technology Institute at the University of Technology Sydney, has published a substantial and regularly updated suite of AI governance resources for Australian directors, now including a version specifically tailored for the resources of SME and not-for-profit boards. The flagship Director's Guide to AI Governance organises board-level oversight into eight elements: oversight and accountability, strategy and purpose, risk management, AI system lifecycle management, people and culture, third-party relationships, transparency and disclosure, and continuous improvement. This is not abstract theory. It maps directly onto governance disciplines already covered throughout this series, delegated authority and reporting, risk appetite, and third-party and vendor oversight, applied specifically to a technology most boards did not have a framework for two years ago.
Underneath this sits Australia's AI Ethics Principles, now operationalised through what the AICD and HTI refer to as six practical governance practices, consolidating an earlier set of ten voluntary guardrails into a more workable core organised around safety, transparency, fairness, accountability and contestability.
The second question, where the actual gap sits
Recent director survey data reveals a genuinely striking gap on the second question. Sixty-six per cent of directors surveyed already use AI tools for their own board work, reviewing papers, drafting, preparing for meetings, yet only 22 per cent report their board has any governance process in place for that usage at all. This is precisely the kind of informal, ungoverned drift this series has warned against in other contexts, an inner board risk discussed earlier this quarter, except here the risk is directors individually feeding confidential board papers into AI tools with no organisational visibility into what data is being shared, with whom, or under what terms.
A board can have a sophisticated policy governing how the organisation uses AI in its programs and services, and still have zero governance over what its own directors are doing with confidential board papers and AI tools every single week. The second gap is usually the larger and more immediate risk.
Why this is genuinely a governance matter, not an it matter
Unauthorised or undisclosed AI use, sometimes called shadow AI, sits squarely inside the director duties this series has covered throughout: care and diligence, proper use of confidential information, and the delegation and reporting discipline discussed earlier this quarter. A director who pastes confidential board papers into a consumer AI tool without understanding how that data is retained or used has arguably misused information obtained in their capacity as a director, precisely the kind of conduct the fiduciary duty discussion earlier in this series was built around, whether or not any harm eventuates.
- Adopt an explicit board-level policy covering directors' own use of AI tools for board work, not just the organisation's operational use of AI, treating confidential board material with the same discipline as any other confidential information.
- Map where AI is actually being used across the organisation, an AI inventory in the language of current guidance, since a board cannot govern what it cannot see.
- Use the eight-element AICD and HTI framework, and its specific SME and not-for-profit checklist, as a genuine working structure rather than reinventing governance language from scratch.
- Treat AI oversight as a standing risk category within the risk appetite statement discussed earlier this quarter, rather than a separate, occasional agenda item disconnected from the board's broader risk framework.
- Assign genuine accountability for AI decisions and AI-related risk, consistent with the delegations of authority discipline covered in the previous quarter, so oversight does not remain diffused across nobody in particular.
AI governance is moving quickly enough that any specific tool or platform named in this article will likely be outdated within a year. The underlying governance discipline will not. A board that builds genuine oversight structures now, covering both how the organisation uses AI and how its own directors do, is building something durable regardless of how the technology itself continues to change.
Explore the Board Director course
Want the fully branded, board-ready PDF of this article? Download the whole 52-part series — free.
Until next week,
Annie