Directors Are Already Using AI. Governance Has to Catch Up.

Somewhere right now, a director is preparing for a board meeting the same way millions of professionals prepare: by asking a generic AI tool to summarize the materials. For directors, that reading is a board book, and it may contain deal terms, financial forecasts, privileged legal advice or other sensitive information. 

This is no longer a hypothetical scenario. It is becoming routine — and at most companies, no board-specific policy governs this activity. 

AI is already in the boardroom 

Research from the Diligent Institute and Corporate Board Member found that 82% of U.S. public-company directors used generative AI in their board work over the prior six months, up from 66% in September 2025. Roughly 30% used it to summarize board books or meeting materials. Nearly half had heard of directors turning to public, consumer-facing AI tools rather than company-approved systems. 

The number that should stop every general counsel and corporate secretary in their tracks: only 6% of directors reported having a formal AI policy specific to the board. 

The question is no longer whether directors will use AI. They already do. The question is whether governance can keep pace with adoption. Right now, it’s losing the race. 

This is a governance problem, not a productivity problem 

A board pack is not an ordinary business document. It may contain M&A information, strategic plans, privileged or litigation-related material, and information subject to retention and discoverability requirements. When a director uploads that packet to an unapproved tool, the company may face questions about confidentiality, privilege, discoverability, data-transfers and vendor-risk before the meeting has even begun. 

The risk is not limited to where the data goes. It is whether the output can be trusted. Directors need to know what an AI-assisted analysis or summary is based on, challenge its logic and understand how it informs their oversight. Board-level AI should operate within the organization’s permission structure, keep sensitive materials in a controlled environment, ground its analysis in board materials and trusted sources, and produce cited, auditable insight that directors can interrogate.  

In the boardroom, trust is non-negotiable. That is the distinction between a general-purpose AI tool and a secure, purpose-built assistant that works within the board’s governance environment.  

Why banning AI is the wrong answer 

The instinctive response may be to prohibit AI use for board work. That approach is likely to backfire. Directors are experimenting with these tools because they make preparation genuinely better: questions become sharper, synthesis becomes faster, and more time is available for judgment. A blanket ban would not stop that. Instead, it may drive AI use underground, where the company has no visibility and no controls. 

The answer is not zero use. It is a board-specific AI policy built on clear rules, secure tools, defined ownership and evidence that controls are working. 

Four layers of a workable framework  

The board’s role is to set expectations, understand material risks and oversee whether the framework works — not to administer tools or write operating procedures. Management, supported by the general counsel, corporate secretary, security leader, and risk and compliance leaders should design and run the controls. A practical framework has four layers: 

• Use-case boundaries. Distinguish permitted uses (such as research on public information), conditionally permitted uses, and prohibited uses. State explicitly what information may never be entered into an AI system. 

• Approved environments. Give directors tools that carry appropriate security, contractual protections, access controls and auditability, rather than leaving them to select consumer services on their own. 

• Clear ownership. The full board approves the oversight approach; management implements it; the corporate secretary supports process integrity and records; committees oversee the risks within their mandates. 

• Ongoing assurance. Management reports regularly on use cases, incidents, training, tool changes and control effectiveness. The board or relevant committee should challenge and monitor the results. 

Six questions every board should ask 

Directors do not need to execute these controls personally. They need to ask management the right questions: 

• Does our AI policy explicitly cover directors and board materials? 

• Which tools are approved, and what security and contractual protections were reviewed before approval? 

• What information is off limits, and how are those boundaries enforced? 

• How are AI-assisted outputs verified, disclosed and retained? 

• What is the process for reporting and responding to an unapproved use or data incident? 

• Which committee owns oversight, and how will management report on effectiveness? 

The goal is not zero use. The 82% adoption figure tells us that directors see real value in these tools. The goal is visible, secure and accountable use: AI that helps the board move faster and prepare better without compromising confidentiality, trust or the human judgment that oversight ultimately depends on.