From 2023 to 2025, the share of S&P 500 companies disclosing AI as a risk jumped from 12% to 83%. But according to company filings, fewer than 3% of directors have AI expertise. And in the same research, just 23% of executives said their board was highly fluent in AI, and a quarter said it had low fluency or none at all. As AI spreads across the business, that leaves a significant gap between what boards understand and what they are required to oversee.
That gap is untenable—and this is what boards need to do to fill it.
Expertise is necessary but insufficient
If the problem is that boards lack AI expertise, the obvious answer is to recruit directors who have it. Well, yes, but not quite. Boards do need more AI experts, but recruiting experts is not enough to close the gap. There are two reasons for this.
First, AI isn’t siloed. It runs through hiring, pricing, customer service, credit, and operations. There is no single AI agenda item for one expert to own, and every director will vote on matters AI has shaped, whether they realize it or not. Oversight must therefore be distributed across the board, not concentrated in a limited number of expert seats.
Second, expertise is not the same thing as competent oversight. Expertise is what you know about AI; oversight is what you do about it as a director. Expertise is often needed for competent oversight, but it doesn’t guarantee it. For instance, someone can understand exactly how a large language model works without ever asking who in the company is accountable for one, or what an AI agent is allowed to spend.
So boards face two questions about AI. The first is whether the board knows enough. The second is whether each director is competent at oversight. Answering the first doesn’t answer the second—and while everyone focuses on the first, the second is largely neglected.
What the board needs to oversee: The key areas of AI oversight
Before we figure out what competent oversight involves, we need to be clear about what directors are meant to be overseeing. The following areas, drawn from our ongoing research into how directors oversee AI, are foundational. Each of these is a place where AI can do real damage to a company, and a board that covers some of them but not the others is dangerously exposed.
- Governance Oversight: Knowing which individual is accountable for each AI matter, and making sure that they are actually held accountable.
- Data Inquiry: Knowing what data the company’s AI uses, where it goes, and on what legal basis. This must be backed by evidence rather than a vendor’s assurance.
- Explanation & Disclosure: Making sure the company can explain an AI decision to the person it was made about, and that its public claims about AI match what it does.
- Fairness & Affected Parties: Knowing which groups a system could disadvantage, when it was last tested, and whether problems were fixed rather than just recorded.
- Risk & Irreversibility: Knowing what the company’s AI can do that cannot be undone, and how the board would hear about a failure.
- Human Judgment & Workforce: Making sure a person can overrule a system in practice, not just on paper, and that the people whose work AI changes are part of the plan.
- Autonomy & Agent Authority: Knowing what AI agents may do, spend, and commit on their own, and making sure each one has a limit and a way to stop it.
That is what a board needs to oversee. But how do you actually build competent oversight of those areas? Three principles help you get there.
Measure what people do—not what they know
The strongest possible evidence for being able to perform a task is that you regularly perform it to a high standard.
Therefore, rather than only asking if your directors understand AI oversight at a theoretical level, you also need to ask: have you actually performed this basic task of AI oversight recently? How often? Is it something that is a systematic part of your oversight process?
The point is that being aware of something is not the same as doing it, let alone being good at doing it. In PwC’s 2025 survey of public company directors, two-thirds said their board should spend more time on AI, but fewer than half said their board had an approach to actually overseeing it.
For example, almost every director would agree that the board should know which AI systems the company uses. Far fewer have actually asked to see the list, and fewer still ask for it every time the board reviews AI risk.
First Step: Ask each director to name the last AI oversight act they performed, and when and where it happened.
Assess the floor—not the average
A director’s level is set by their weakest competency, not their average. Boards already accept this logic for financial controls. Under U.S. auditing standards, if even one material weakness exists, a company’s internal control over financial reporting cannot be considered effective, however strong everything else is. Nobody averages a material weakness away. AI oversight deserves the same.
Focusing on the floor matters because human beings gravitate to the questions they are comfortable asking. A former CFO interrogates the data; a technologist interrogates the model. To an extent, that’s what a board should want. Directors are recruited for their depth, and that depth should be used.
The problem comes when depth in one area becomes a reason to skip the others. A CFO who never asks what the company’s agents can do is relying on someone else to ask. If that person is absent, distracted, or deferring in turn, nobody asks at all.
So the floor is not a demand that every director become an expert in everything. It is a minimum standard that every director clears in every area. Boards already work this way with finance—under NYSE listing rules, every member of the audit committee must be financially literate.
Competent AI oversight needs a solid foundation: a floor that everyone clears.
First Step: Ask each director which AI oversight question they would be least able to answer. Make it their priority for the next quarter.
Build depth across the whole board—not in a single seat
The floor protects against gaps in individual directors. But a board can have every director clear the floor in every area and still have nobody who goes deep on fairness, on the workforce, or on what the company’s AI agents are allowed to do.
That is a common pattern, because boards recruit for backgrounds, and backgrounds cluster. In 2026, boards again favored directors with CEO and financial experience. So depth piles up around data and models and thins out everywhere else.
This is where the fact that AI isn’t siloed becomes especially relevant. It means that the board needs depth in every area of AI oversight, and that depth shouldn’t sit in a single seat, because one expert’s judgment tends to go unchallenged when no one else on the board is equipped to test it.
Financial controls deal with the same problem through the four-eyes principle: no material transaction rests on one person’s judgment. AI oversight should work the same way, with at least two directors working at depth in every area.
First Step: Map which directors work at depth in each area of AI oversight. Any area with fewer than two is uncovered.
Expertise is what a board has—oversight is what a board does.
Boards need both, and having the first doesn’t guarantee the second. And while expertise can be judged by looking at a resume, building real competence at AI oversight means measuring what directors actually do. It means judging each director by their weakest area, not their average, and making sure the board’s depth reaches every area of AI oversight, held by more than one director in each.
In the meantime, directors who want to see where they stand can take part in our research by completing the scorecard and receive their own results.
