Governing Enterprise AI: The Role and Responsibilities of the Board

What Has the Enterprise Authorized?

A board needs a clear account of what its enterprise has authorized AI to do, what value that activity is expected to create, and who acts when outcomes depart from expectations. A report listing pilots, licenses and deployment milestones does not answer those questions.

The boundary changes when AI moves from drafting a recommendation to shaping a decision, directing a workflow or initiating a transaction. Each step can change enterprise value, delegated authority, dependency and accountability. Management must design and operate the controls. The board must determine whether the enterprise consequences remain within strategy, risk appetite and documented delegation.

The practical response is one Enterprise AI Governance System. It connects direction, authority, assurance, performance and accountability across the board mandate. The system governs enterprise consequences as models participate more deeply in decisions and execution, while management retains responsibility for model-level operations.

Executive Summary

Enterprise AI should create measurable value within explicit limits on authority, risk and accountability. As AI becomes embedded in decisions, workflows and transactions, the board mandate needs to follow the enterprise consequences rather than the technology label. Management remains responsible for implementation and operation. The board sets the conditions under which material AI activity can proceed, expand or change route.

Recent evidence illustrates why that distinction matters. An ISS STOXX analysis of 3,048 US companies, using January 2026 disclosure data, found that 8% disclosed board-level AI oversight (Zeru & Schultz, 2026). In EY's May-June 2026 survey of 202 senior AI decision-makers at large US public companies, 47% reported bypassing governance processes for urgent deployments while 98% reported formal policies (EY, 2026). These are different measures and populations. They do not establish the effectiveness of any individual board, but they show why formal policy and operating practice should be examined separately.

This paper advances one central proposition: boards need an Enterprise AI Governance System that connects five governing functions - Direction, Authority, Assurance, Performance and Accountability - across eight responsibility domains: strategy; value and investment; authority and autonomy; accountability; risk and assurance; data and intelligence; organization and workforce; and maturity and readiness. The five functions explain how the board governs. The eight domains define what must remain visible in the mandate. They are one integrated system, not competing frameworks. The result is a practical board-level decision architecture that connects what must be governed to the evidence management must provide, while preserving management ownership of implementation and operations. R8, Maturity and readiness, operates as a cross-cutting governance gate within this architecture: it tests whether the enterprise is ready to expand investment, permissions or autonomy, rather than adding a competing governance model.

The governance route should then change with materiality and operating state. Routine decisions remain with management under delegation. Material changes in value, authority, risk, dependency, workforce impact or autonomy move to board visibility or the designated approval authority. Readiness is the gate before investment, permissions or autonomy expand.

The immediate outputs are practical: an Enterprise AI Governance Charter, risk appetite, delegated authority framework, maturity baseline, board dashboard and competency plan. A board can establish the baseline, reconcile delegations, test a consequential workflow and assign corrective actions within a ninety-day cycle. The purpose is clearer decisions, traceable ownership and evidence that the enterprise can operate within the authority it has granted. Each artifact should support a decision, evidence requirement or corrective action.

1. Enterprise AI changes what the board governs

Enterprise AI changes the object of board oversight when it materially alters how the business senses, decides, operates, transacts or learns. A drafting assistant and a payment agent may both use AI, but they create different questions about decision authority, capital allocation, operational dependency, risk concentration, workforce design, cybersecurity and data governance.

The useful progression is AI as Tool, AI as Capability, AI in Workflow, AI as Agent and AI as Economic Actor. Economic Actor describes participation in authorized transactions or resource allocation. It does not imply legal personhood or independent liability. The progression matters because the governance question changes as AI moves closer to consequential action.

The 6xD interpretation is that the organization is part of the AI architecture. Decision rights, process ownership, incentives, skills and information foundations shape what AI-enabled operations are authorized and equipped to do responsibly. D2, Digital Cognitive Organization, is therefore the primary perspective. D3 addresses the shared platform and information foundations, D4 connects design to coordinated execution and realized outcomes, and D5 addresses human-machine work and capability. D1 provides the external context of changing markets and business models.

Management should still test whether poor results come from task suitability, output quality, data, integration cost or organizational readiness. A board should not assume that every AI shortfall is an organization-design problem. It should require evidence of the limiting factor before approving larger investment or wider delegation.

Figure 1. Context lens: The Enterprise AI governance shift

Governance scope follows material enterprise consequences as AI moves from tools and projects into authority, enterprise systems, accountability and organizational redesign. Source: DigitalQatalyst, 6xD proprietary synthesis (2026).

2. The Enterprise AI Governance System: 5 functions, 8 domains, 1 boundary

The Enterprise AI Governance System is the paper's single master framework. It is deliberately simple: five governing functions explain how the board governs, eight responsibility domains define what must remain connected, and one governance boundary preserves management ownership of implementation. Every later diagram in this paper is a supporting lens that answers a narrower implementation question. None is a competing framework.

Figure 2. The Enterprise AI Governance System

The master framework: five governing functions, eight responsibility domains and one governance boundary. All subsequent visuals are subordinate lenses that show when governance should intensify, where oversight should sit and what evidence the board should receive. Source: DigitalQatalyst, 6xD proprietary synthesis (2026).

Preserve the board-management boundary

The board sets strategic expectations, approves reserved matters and oversees management. Management develops the roadmap, selects models and vendors, configures workflows, operates controls and delivers outcomes. Corporate-governance guidance supports strategic direction and management monitoring while recognizing that board structures and legal duties vary by jurisdiction (OECD, 2023).

Materiality determines escalation. Routine changes remain with management within delegation. Changes that exceed approved limits, alter consequential customer or workforce decisions, create critical dependencies or expand machine authority should move to the designated governance route. Board visibility and board approval are different requirements.

The five functions are the operating logic

Direction: govern strategic intent and readiness

A material AI proposal should state the business problem, the intended customer or operating outcome and the capabilities being built. Management should compare AI and non-AI options, identify assumptions that would change its recommendation and explain where human leadership remains important. The board output is an agreed ambition with priorities, operating conditions and review triggers.

Readiness belongs inside Direction because the target state should not advance simply because the technology can. Different parts of an enterprise may operate at different levels. The board needs to know which unresolved condition prevents further scale or autonomy.

Authority: govern delegated machine action

Authority becomes a distinct governance issue when an AI-enabled capability moves from recommendation into consequential action. Management should translate permissions into enforceable limits covering systems, data, spending, duration, approval points and further delegation to other agents. Material expansions should return to the designated approval authority.

Local approvals can also accumulate. A refund agent, procurement agent and scheduling agent may each sit within separate limits while their combined commitments create an enterprise exposure that no single approver considered. Management should report aggregate authority and shared dependencies when material. Stopping further action and reversing completed action are different capabilities, so intervention evidence should reflect both.

Assurance: govern risk, data and resilience as one evidence system

Risk is one responsibility within the wider mandate. Management should translate risk appetite into restricted uses, acceptance criteria and escalation thresholds, then test model risk, cybersecurity, privacy, unsupported output, bias, drift, compliance exposure, continuity and third-party concentration as relevant to the use case. NIST's Generative AI Profile provides a voluntary cross-sector reference for this work (Autio et al., 2024).

Data and intelligence foundations should be visible where they become material to the board decision. Directors need evidence of provenance, permitted use, ownership, quality, access, information security, intellectual-property treatment and critical upstream dependencies, without taking over platform engineering. Contractual exit rights do not by themselves demonstrate operational readiness.

Performance: govern value rather than activity

Material investments should have a baseline, benefit owner, realization period and total cost. Cost should include integration, data preparation, evaluation, human review, monitoring and work redesign. Finance should distinguish cash savings from released capacity and forecast benefits from measured results.

Brynjolfsson et al. (2025) estimated a 15% average increase in issues resolved per hour among 5,172 customer-support agents at one company, with effects varying across workers. Dell'Acqua et al. (2026) found task-dependent benefits and reduced correctness on a task outside the tested model's capabilities, using a 2023-generation model. These findings support local evaluation, not a universal return forecast. Pilot counts and adoption remain supporting indicators, not proof of enterprise value.

Accountability: keep ownership explicit as work changes

Every materially consequential AI-enabled decision domain needs a named human owner. The record should identify approval, exceptions, escalation, override rights, incident ownership and corrective action. OECD's accountability principle links responsibility to an actor's role and context and distinguishes accountability from legal liability (OECD, 2024). Boards should preserve that distinction.

Organization and workforce design sits inside the same accountability question. Management should explain which roles change, which decisions become AI-supported or AI-executed, what competencies are required and how service quality will be protected during transition. Training attendance is a limited measure. Competence should be demonstrated through relevant tasks, including detecting errors, handling exceptions and deciding when to escalate.

Eight domains, eight board tests

The eight domains are not a second framework. They are the board tests inside the Enterprise AI Governance System. Each test should resolve into a clear governance output before material investment, authority or exposure expands.

From AI risk governance to Enterprise AI governance

This comparison defines the category shift that the master framework addresses. Enterprise AI governance retains model, legal and compliance controls while widening the board lens to the enterprise consequences created when intelligence is embedded in decisions, workflows and transactions.

3. Supporting lens 1: Match governance to the operating state

This lens answers one question: when should governance intensity change? Governance should become more demanding when enterprise consequence, delegated authority or systemic dependency increases. The eight-level Enterprise AI progression provides a common vocabulary from Manual to Autonomous System. It describes operating states. It is not an externally certified maturity scale and a higher level is not evidence of better governance.

AI Assisted emphasizes model quality and human validation. AI Augmented adds human-machine decision accountability. Agentic Workflow requires explicit agent boundaries and delegated authority. Programmable Transaction adds identity, transaction limits, contracting and settlement governance. Autonomous System raises systemic autonomy, resilience and enterprise accountability.

Readiness is the gate across the progression. Management should establish evidence gates across strategy, investment, design, development, deployment, operation, change and retirement. Material changes to data, models, permissions or context should trigger reassessment. The board reviews the effectiveness of that process and material exceptions; routine releases remain with management under delegation.

Figure 3. Supporting lens 1: Enterprise AI maturity and governance progression

Match oversight to capability, delegated authority and systemic dependency. Higher autonomy is an operating state, not a governance-quality score. Source: DigitalQatalyst, 6xD proprietary synthesis (2026).

The practical escalation test

For each material change, ask three questions: Does the change alter enterprise value or exposure? Does it expand what AI may decide or do? Does it increase dependency or reduce the time available for human intervention? If the answer is material, the governance route should change before the operating state expands.

4. Supporting lens 2: Choose the governance configuration

This lens answers where oversight should sit. No single committee structure is appropriate for every enterprise. Three configurations can work when the governance contract remains explicit and the full board retains visibility of enterprise strategy, material consequences and unresolved cross-committee issues.

Across all three models, the governance contract should record decision rights, reporting obligations, escalation thresholds, assurance requirements and accountable ownership. The company secretary or governance officer can maintain charters, agendas and decision records, but that role does not substitute for board or management accountability.

Management owns execution and coordinated reporting. Risk and compliance provide monitoring and challenge. Internal audit can provide independent assurance without assuming delivery ownership, consistent with the IIA Three Lines statement (Institute of Internal Auditors, 2026). Test the arrangement against a cross-functional deployment and an incident: who recommends, who decides, who reports, and who acts? Authorized containment should not wait for a scheduled meeting.

Decision rights: make the governance route explicit

The framework does not prescribe one committee model. It does require each material AI matter to distinguish management authority, delegated committee oversight and full-board reserved matters before authority, investment or exposure expands.

The exact allocation depends on the enterprise governance configuration. The non-negotiable requirement is a documented route for decision, reporting, escalation and corrective action before material exposure grows.

5. Supporting lens 3: Use evidence to change decisions

This lens answers what evidence the board should receive. An Enterprise AI Board Dashboard should start with decisions requested, material changes and overdue corrective actions. Detail belongs behind that view, available for challenge. The dashboard is an operating artifact of the master framework, not another governance model.

Figure 4. Supporting lens 3: Enterprise AI Board Dashboard

Four connected views organize the evidence needed for board decisions: strategic value, authority and autonomy, assurance, and enterprise readiness. Source: DigitalQatalyst, 6xD proprietary synthesis (2026).

Interpret measures in context. Low intervention can indicate reliable operation or weak detection. More reported incidents can reflect worse performance or better reporting. Distinguish estimates from observed results, identify missing evidence and make the reporting period, comparison and escalation rule explicit. Directors should be able to trace a headline measure to the approval, test or outcome record behind it.

Mechanisms in practice

JPMorganChase - controlled enterprise access. Its 2024 annual report describes LLM Suite as a controlled environment with shared capabilities for integrating generative AI into workflows. The relevant governance mechanism is a common access and integration foundation. Comparable arrangements still require the board to understand the data controls and material dependencies behind that access (Piepszak, 2025, p. 60).

Morgan Stanley - bounded professional assistance. Its Debrief launch describes client consent, meeting summaries and an email draft that an adviser can edit and send at their discretion. The mechanism is an identifiable human decision point. The governance lesson is to distinguish preparation from authorization (Morgan Stanley, 2024).

DBS - materiality-based review. The bank describes risk-based model governance, a registry, defined roles and senior-management accountability, alongside cross-functional review and stronger clearance for generative AI. The mechanism links escalation to consequence and specialist review rather than using one approval route for every use (DBS, 2025).

These are company-reported practices. They illustrate mechanisms and are not independently verified control outcomes.

6. Put the system into operation

A working governance system depends on six artifacts that connect the mandate to decisions, evidence and corrective action.

Make the cadence explicit

At each scheduled board meeting, review material developments affecting strategy, risk, performance, major investment and incidents. Urgent events should escalate between meetings under approved thresholds.

Quarterly, examine the portfolio, value realization, maturity progression, significant changes in autonomy, assurance findings, critical dependencies and workforce effects. Annually, approve or revisit AI ambition, risk appetite, delegated authority, governance configuration, maturity targets, director competencies and critical dependencies. The enterprise should adapt frequency to its exposure and existing governance commitments.

Within the first 30 days, commission the baseline and confirm accountable owners. During days 31-60, reconcile delegations, receive the integrated dashboard and prioritize gaps. By day 90, test one consequential workflow and one incident scenario, review the findings and assign corrective actions. Management owns delivery; the board checks that commitments close with evidence.

Research Basis and Evidence Scope

This paper is a selective synthesis of five evidence classes: academic studies of task performance, institutional governance guidance, industry research on disclosed or reported practice, company-reported cases and 6xD interpretation. Source selection follows the claims being examined rather than a systematic literature-review protocol. External references in the supplied research base were checked in September 2026.

Disclosure research describes published information; surveys describe respondents' reports; workplace studies support findings within their tested settings; company cases explain stated mechanisms. None independently validates the 6xD Enterprise AI Governance System or the maturity progression. Cross-sector transfer requires local assessment, and much of the cited governance evidence concerns US public companies or large financial institutions.

Independent evaluation should test decision traceability, exception closure, intervention performance, reviewer agreement and cost-adjusted benefits over time. Recommendations also require adaptation to applicable law and governance arrangements. DigitalQatalyst developed the 6xD governance framework and operates the Navigator diagnostic. Readers should treat the framework as proprietary 6xD interpretation and assess its fit against their own governance context.

Leadership Move: Govern the Enterprise Being Created

The board needs a defensible basis for AI ambition: strategic intent, measured value, explicit authority, accountable ownership and evidence that controls operate. As AI participates more directly in workflows and transactions, those conditions become one connected governance problem rather than separate technology, risk and performance discussions.

The Enterprise AI Governance System is the paper's one master architecture: five governing functions, eight responsibility domains and one governance boundary. The maturity progression, governance configurations and dashboard remain supporting lenses. They show when governance should intensify, where oversight should sit and what evidence should reach the board.

The board does not need to govern every model. It does need to govern the enterprise consequences those models are helping to create. Within 6xD, that connects board oversight to the development of the Digital Cognitive Organization, supported by platform foundations, disciplined transformation and accountable human-machine work.

Key Takeaways

• Use one Enterprise AI Governance System: 5 governing functions, 8 responsibility domains and 1 governance boundary.

• Material enterprise consequences determine the board's AI mandate.

• Management implements and operates within defined governance boundaries.

• Consequential machine action requires explicit limits and accountable human ownership.

• Governance intensity should change with capability, delegated authority and systemic dependency.

• Board reporting should connect investment and authority to outcomes, assurance and readiness.

• Enterprise AI governance is part of designing and directing the future organization.

Leadership Reflection

• What material enterprise consequences are we authorizing AI to create or influence?

• Which decisions and actions may our AI systems recommend, make or execute?

• Can we identify a named accountable human owner for each materially consequential decision domain?

• Can management demonstrate enterprise value beyond adoption, activity and pilot counts?

• Would our current governance remain adequate if a material capability moved from assistance toward agentic or autonomous operation?

How Ready Is Your Board to Govern Enterprise AI?

Use the 6xD Navigator Board AI Governance Readiness Assessment to identify gaps in decision rights, evidence, accountability and oversight, then prioritize the issues that require board attention first.

Assess Your Board's AI Governance Readiness →