Directors in the age of AI: oversight and risk in closely held companies

A session report from the IBA’s Annual Conference that took place in Copenhagen from 4 to 9 October 2026

Reporter

Enrico Sisti

Rucellai & Raffaelli, Milan

Co-chairs

Andreas Kloyer

Luther, Frankfurt and London

Jean-Gabriel Flandrois

Gide Loyrette Nouel, Paris

Speakers

Nick A Dorsey

Cravath Swaine & Moore, New York

Sharon Gazit

Fischer, Tel Aviv

Kathleen Lemmens

Gianni & Origoni, Milan

Kaupo Lepasepp

Sorainen, Tallinn

Saranya Mishra

Khaitan & Co, Mumbai

The panel began by considering whether artificial intelligence (AI) creates genuinely new responsibilities for directors. A broad consensus emerged that AI changes a company’s opportunities and risk profile, but does not require an entirely new concept of board responsibility. Management must identify and manage material AI risks, implement controls and report upwards. The board must ensure that the organisation is capable of doing so, receive decision-useful information, challenge management and respond when significant weaknesses emerge. Under existing US oversight principles, Nick A Dorsey observed that this responsibility arises even without AI-specific case law.

AI as a strategic issue

Boards should treat AI as a strategic issue, not merely as a compliance policy. They should assess whether it supports the company’s short- and long-term objectives, how competitors are deploying it, whether it could render a business line obsolete and how it may affect the attraction and retention of talent.

Sharon Gazit highlighted the tension, particularly in founder-led businesses, between management’s desire to move quickly and the board’s role to impose checks and balances. The starting point is a reliable map of where AI is used: by employees, within customer-facing services and in products developed by the company.

Kathleen Lemmens suggested that directors should ask five practical questions:

• Where is AI being used in the business?
• What material risks arise from those uses?
• Who owns and manages those risks?
• Which policies and controls are in place and are they actually applied?
• How will material incidents or changes be escalated to the board?

Kaupo Lepasepp cautioned against beginning with generic risk lists: the greater strategic danger may be failing to capture AI opportunities. Starting from concrete use cases makes risk management practical and exposes the risks that are genuinely relevant.

Saranya Mishra similarly urged boards to ask whether the company is thoughtfully optimising through AI or simply allowing itself to be driven by the trend. She compared AI to an exceptionally capable new hire whose alignment with the organisation’s values and methods must still be tested.

AI policies

The discussion then turned to corporate documents, disclosure and regulated activities. The panellists favoured comprehensive AI-use policies covering permitted and prohibited applications, mandatory human review, confidentiality, personal data, third-party intellectual property, retention and deletion and incident response when an AI-generated error is discovered after publication.

Gazit noted that AI-generated client documents are already commonplace and may contain obvious errors. Lemmens recalled encountering through a public tool a document that retained parties’ names, illustrating the risk of confidential material being uploaded or reused without adequate safeguards.

For consequential decisions in areas such as credit, insurance, fraud or employment, boards should require explainability, the ability to challenge outcomes and insist on meaningful human oversight. Dorsey noted that US enforcement activity already indicates regulatory concern with software discrimination, facial recognition and misleading disclosures about AI, while uncertainty remains over the federal–state division of regulation. Gazit described the Israeli approach as sector-based, with guidance already emerging for financial institutions and lawyers. The panellists agreed that regulated companies must test AI use against their existing obligations and document both the analysis and the resulting decisions.

The involvement of third parties

Third-party concentration also requires attention. Dependence on a single cloud or AI provider can create resilience risk and boards should verify that data governance precedes deployment. Organisations may not even know every point at which AI is being used, so categorical representations about AI use or non-use can themselves be risky. Transparency remains important, but disclosures must be accurate and supported by effective internal mapping.

Where auditors and other advisers use AI, boards should seek transparency, data traceability and human verification. In relation to accounts, Gazit suggested that directors should require the relevant source data to be identified and retained. If AI generates efficiencies, boards may also expect faster delivery and question whether fees should change, although speed does not necessarily mean lower cost. Lepasepp added that a human in the loop is not enough: organisations also need a robust process to support the loop, designed around the specific use case.

Responsibilities

Responsibility for AI oversight must be clearly allocated. Depending on the company’s maturity and exposure, this may sit with the audit or risk committee, a specialist committee, a cross-functional management group or a chief AI officer. Dorsey noted that US public companies may amend audit committee charters, whereas closely held companies may rely more on external support. The label matters less than ensuring that those responsible have expertise, authority, independence and access to the board. Companies should avoid creating impressive titles without corresponding substance. AI investments should be supervised like other material investments, with success criteria based on results rather than expenditure alone.

The board’s use of AI

A second major theme was the board’s own use of AI. Directors need baseline, company-specific AI literacy: not engineering expertise or detailed knowledge of algorithms, but a practical understanding of its capabilities, limitations and the points at which AI intersects with strategy, compliance, cybersecurity, reputation, customers and the workforce. They should hear both advocates and critics and develop enough knowledge to ask the right questions. Independent judgement remains a core duty and cannot be displaced by technical output.

AI assistance

AI can assist directors by summarising extensive board papers, retrieving information, testing management responses, identifying anomalies, supporting scenario analysis, preparing minutes and tracking action items. These benefits come with significant qualifications. Large language models may give users the answer they appear to want, generate different answers to the same question or encourage uniformity of opinion. Confidential material should not be entered into unapproved public tools and all important outputs require verification. AI should enhance, rather than replace, attentive reading, diverse debate, value-based assessment and thoughtful human engagement.

Meeting summaries

Recording and automatically summarising meetings may be practical, but it creates additional concerns. The resulting record may be inaccurate, may capture statements that participants did not intend to appear in the minutes and may compromise legal or commercial confidentiality. Transcripts, prompts and persistent logs may also become discoverable or be subpoenaed. Companies, therefore, need a clear inventory of AI-generated information, defensible retention and deletion rules, and the ability to preserve and produce material in response to a legal hold. Directors must comply with the company’s AI policies when using such tools themselves.

An AI board member

In regard to the prospect of an AI board member, the preferred formulation was that AI may have a seat at the table, but not a seat on the board. Although the discussion referred to examples of AI advisers or purported AI appointments in several jurisdictions, the panellists considered AI most defensible as an observer, consultant or analytical tool without voting rights. Fiduciary duties and accountability cannot simply be delegated to a system whose output may vary and which cannot supply all the contextual, interpersonal and cultural information relevant to a real board decision.

Striking the right balance

The panel also examined whether AI might draw boards too deeply into operations. Supervisory bodies may use it to analyse reports, sample data and challenge management, but new technical capability does not justify micromanagement or circumvention of executives. Internal directors contribute detailed knowledge of systems and data, while independent directors should bring external perspective and resist organisational bias. Management retains discretion to formulate and implement AI strategy, including a deliberate decision not to adopt AI where commercially justified, while the board must ensure that the choice is reasoned, properly resourced and monitored.

The emerging landscape

Where law lags behind technology, management should use credible voluntary frameworks, follow emerging sectoral rules, obtain advice on novel issues and document its reasoning, incident handling and governance trail. Governance must remain proportionate to the company, industry and use case rather than being copied in response to market fashion. The discussion acknowledged that earlier technologies, such as blockchain and virtual reality, had attracted comparable hype. Possible distinguishing features of AI include autonomous agents, its dependence on information and the difficult questions it raises about values, morality and the capacity to refuse an instruction.

Conclusion

The closing discussion addressed insurance and the evolving role of advisers. Companies should identify which adverse outcomes their existing directors and officers, cyber and other policies do or do not cover, and negotiate AI-related protection against concrete use cases rather than in the abstract. Lawyers will increasingly be expected not only to advise on compliance, but also to help boards understand AI-assisted decision-making, reconcile management’s operational priorities with oversight duties and establish a record of due care. The panel’s practical message was concise: be ambitious about the opportunity, disciplined about the risk and clear about who is accountable when things go wrong.