Loading home page
Boards do not need to approve every AI use. They do need to set the seven enterprise boundaries that determine how far management can go.
Curated by

Mark Kerry
Research LeadershipDigital Transformation & Enterprise Architecture
DigitalQatalyst
Mark Kerry is a Digital Transformation and Enterprise Architecture leader at DigitalQatalyst, enabling change through the practical application of enterprise architecture, agile and associated best practices.
Enterprise AI becomes a boardroom matter when a decision materially changes value, authority, risk, work, dependency or autonomy. The seven decisions below turn that threshold into a practical boardroom lens. The board sets the enterprise conditions. Management operates within them.
AI is moving from isolated tools into decisions, workflows and transactions. As that happens, choices that once looked technical can change enterprise investment, delegated authority, workforce design, critical dependencies and the level of machine autonomy the organization is prepared to accept.
The governance question is therefore narrower than “Should the board oversee AI?” The useful question is which enterprise choices require board direction, limits, visibility or designated approval. Routine implementation remains with management. Material changes follow the governance route defined by enterprise consequence and documented delegation.
The risk is accumulation. AI investment can spread across separate initiatives, authority can expand in small steps, and dependencies can concentrate across models, data, platforms and providers. Each choice may sit inside an existing approval limit while the combined enterprise consequence becomes material.
External evidence illustrates why operating governance deserves attention. ISS STOXX reported that 8% of 3,048 US companies in its January 2026 disclosure dataset disclosed board-level AI oversight. EY separately reported that 47% of 202 senior AI decision-makers at large US public companies surveyed in May and June 2026 had bypassed governance processes for urgent deployments while 98% reported formal policies. These are different measures and populations. They do not establish governance effectiveness, but they reinforce the need to test how governance works under operating pressure.
Through D2, Digital Cognitive Organization, the organization is part of the AI architecture. Decision rights, process ownership, human review, information quality, skills, escalation and accountability shape what AI-enabled operations can responsibly do.
RP01 provides the master Enterprise AI Governance System: five governing functions explain how the board governs, eight responsibility domains define what must remain visible, and one board-management boundary preserves management ownership of implementation. The seven decisions below are the boardroom application lens. They translate that architecture into recurring choices directors can recognize and act on.
| Board decision | Board question | Required governance output |
|---|---|---|
| 1. Enterprise AI ambition | What enterprise outcome justifies AI, and what would change the direction? | Set ambition, boundaries and review triggers. |
| 2. Investment and enterprise value | What measurable outcome justifies continued investment? | Require a baseline, benefit owner, total cost and evidence to scale, correct or stop. |
| 3. Authority and accountability | What may AI recommend, decide, execute or transact, and who owns the consequence? | Set delegated authority, approval points, intervention rights and accountable ownership. |
| 4. Risk, ethics, compliance and assurance | What exposure is acceptable, and what evidence shows controls work? | Set risk limits, assurance requirements, exceptions and escalation conditions. |
| 5. Organization and workforce | What operating-model or workforce change must accompany the capability? | Make role, skill, supervision and decision-right changes explicit. |
| 6. Data, technology and third-party dependency | Which dependency is material, and what happens if it fails or changes? | Require visibility of concentration, provenance, access and tested fallback. |
| 7. Agentic AI and machine autonomy | How much autonomy should the enterprise authorize now? | Match permissions, intervention and recovery to the operating state and readiness. |
Start with the enterprise consequence, then identify which of the seven decisions is changing. A routine change can remain within management delegation. A material change may require board visibility and challenge. A reserved matter or threshold breach should move to the designated approval route before investment, exposure or AI authority expands.
Readiness is the cross-cutting gate. Before the enterprise scales a material capability, management should be able to show the intended outcome, accountable owner, delegated authority, material limits, current evidence, critical dependencies, intervention arrangements and the condition that would trigger reassessment.
For each material AI item, the board pack should make the decision visible before the technology detail. It should state the enterprise outcome, which of the seven board decisions is changing, the management recommendation, the authority already delegated, the evidence supporting the recommendation, any material dependency, and the event that would trigger escalation or reassessment. This keeps the discussion focused on the enterprise boundary being set while leaving implementation choices with management.
At the next Board or Technology/Digital Committee discussion, pick one material AI initiative and ask three questions: Which of the seven decisions does it change? Which governance route applies? What evidence shows the organization is ready for the proposed level of investment, authority or autonomy?
If those answers are unclear, the board does not need more AI inventory. It needs a clearer enterprise decision before the boundary moves.
ASSESS GOVERNANCE READINESS
A software release can turn an AI agent's recommendation into a transaction. Before granting consequential permissions, record who approved the action, what limits apply and who can intervene.
Successful AI pilots prove bounded feasibility, not enterprise value. Value depends on whether the enterprise can connect AI to measurable outcomes through Strategy, Organization, Governance, Work, Platform and Execution.
A software release can turn an AI agent's recommendation into a transaction. Before granting consequential permissions, record who approved the action, what limits apply and who can intervene.
When an AI tool moves from recommendations to transactions, technical ownership cannot determine who may approve the business action. Boards and executives need traceable decision rights, escalation, and stop authority.