Executive Summary

Artificial intelligence is becoming a board-level issue whether boards are ready for it or not. 

AI increasingly intersects with strategy, workforce decisions, privacy, cybersecurity, procurement, reputation and organisational risk. Where its use is material, oversight cannot remain solely the responsibility of technology teams or executive management.

This does not mean directors need to become artificial intelligence experts. It means they must understand AI sufficiently to govern organisations that increasingly depend upon it.

An AI-ready board knows where material AI is being used, who is accountable for it, what risks and opportunities it creates, and how the organisation knows its governance is working. It can challenge management, seek appropriate assurance and recognise when additional expertise is required.

Technical unfamiliarity may explain a capability gap. It cannot justify a governance gap.

This insights paper examines what effective board oversight of artificial intelligence looks like in practice. It argues that boards should focus not on mastering rapidly changing technology, but on strengthening the enduring capabilities of good governance: informed judgement, effective challenge, clear accountability and appropriate assurance.

For regional institutions, getting this right matters beyond the boardroom. The quality of board oversight will influence whether AI strengthens organisational capability and public confidence, or introduces risks that institutions and the region were insufficiently prepared to govern.

Introduction

Artificial intelligence has moved beyond the technology function. It is increasingly influencing strategy, workforce design, procurement, information management, customer interactions and organisational risk. As that influence grows, responsibility for AI governance inevitably has  reached the boardroom.

This does not require directors to become technologists. 

Boards have always governed areas in which individual directors are not subject-matter experts. Cybersecurity, financial systems, workplace safety and complex regulatory obligations all require specialist knowledge, yet boards remain responsible for ensuring that appropriate oversight, capability and accountability exist. Artificial intelligence should be approached in the same way.

What directors cannot reasonably do is treat a lack of technical knowledge as a reason to disengage.

ASIC has consistently emphasised that directors must understand the business sufficiently to exercise care, diligence and effective oversight; their responsibilities are not confined to the knowledge they possessed when they joined the board. AI does not create an exemption from these expectations simply because the technology is complex. (ASIC)

This distinction is becoming increasingly important. 

ASIC has already warned of the potential for a governance gap where AI adoption develops faster than the arrangements established to oversee it. More broadly, Australia’s national AI assurance framework places clear accountability, senior leadership, risk management and human oversight at the centre of responsible AI governance. (ASIC)

An AI-ready board is therefore not one whose directors can explain how a large language model works. It is one that understands where AI materially affects the organisation, can challenge management about its use, knows where accountability resides and seeks appropriate assurance that opportunities and risks are being governed effectively.

Technical unfamiliarity may create a capability gap. The responsibility of the board is to close it before it becomes a governance gap.

AI Is Already a Board Issue

For some boards, artificial intelligence still feels like an emerging issue: important enough to monitor, but not yet significant enough to warrant sustained board attention. That position is becoming increasingly difficult to maintain.

AI is already embedded within many of the systems organisations use every day. It appears in productivity software, customer platforms, recruitment systems, analytics tools, cybersecurity products and specialised industry applications. Employees may also be using publicly available AI tools independently of formal organisational adoption (whether approved or not). Partners, and other third parties will have their own policies, tools and processes they use when engaging with your organisation. 

The board’s first AI governance challenge may therefore not be deciding whether the organisation should adopt artificial intelligence, but establishing where it is already being used.

Australian regulatory experience demonstrates how quickly this can develop. ASIC’s 2024 review of 23 financial services and credit licensees identified 624 AI use cases that were either deployed or under development. Around 60 per cent of the organisations reviewed intended to increase their AI use, while ASIC warned that governance arrangements risked falling behind adoption. (ASIC) More recent ASIC work with market intermediaries found a similar pattern: AI use was growing while many organisations lacked AI-specific documented governance arrangements. (ASIC) Given the pace of AI capability increases, this will almost certainly underestimate the true current state now.

The lesson extends beyond financial services.

A health service using AI-assisted clinical documentation, a university deploying AI-supported student services, a council introducing automated customer interactions or a utility applying AI to asset management may face very different operational risks. At board level, however, the governance question is similar: does the organisation understand where AI materially affects its operations, people and obligations, and is somebody clearly accountable for those uses?

Boards do not need visibility of every minor software feature containing artificial intelligence. They do need a reliable line of sight to material use: applications capable of affecting strategic objectives, significant decisions, sensitive information, customers, employees, community outcomes or organisational reputation.

This is where board responsibility begins.

Waiting until an AI incident reaches the boardroom is not oversight. By that point, the governance decision has already been made by default.

An AI-ready board establishes visibility before it needs intervention.

Govern the Organisation, Not the Technology

One of the greatest barriers to effective board oversight of artificial intelligence is the belief that directors must first understand the technology in technical detail. This sets the wrong standard and risks distracting boards from the responsibilities that actually belong to them.

A board does not need to understand how a large language model is trained, compare competing model architectures or evaluate the technical configuration of an AI system. Those responsibilities belong with appropriately qualified executives, specialists and advisers. The board’s responsibility is different: it must understand what the organisation is trying to achieve with AI, what material consequences could arise from its use and whether appropriate governance exists around those decisions.

The board does not need to understand how a model works in order to ask whether the organisation should be relying on it.

Consider a regional health service introducing AI-assisted clinical documentation. Directors do not need to evaluate the underlying model. They should, however, be capable of asking whether clinicians remain accountable for records, how patient information is protected, what happens when the system produces an incorrect output, how performance is monitored and whether the organisation can safely operate if the technology becomes unavailable.

The same principle applies elsewhere. A university board does not need to understand the architecture behind an AI student-support system to question its effect on students. A council does not need directors with machine-learning expertise to scrutinise AI influencing community services or administrative decisions. A business board can challenge management about commercially sensitive information, workforce impacts and vendor dependency without becoming a technology committee.

Australia’s national AI assurance framework reflects this distinction. It recommends adapting existing decision-making and accountability structures to govern AI, providing leaders with clear sight of the uses for which they are accountable, while drawing on technical, legal, social and other specialist capabilities where required. (Department of Finance)

This is what mature board oversight looks like.

Directors govern organisations through finance, risk, people, strategy, reputation and accountability. Artificial intelligence increasingly intersects with all of them. The board’s task is therefore not to govern the algorithm.

It is to govern the organisation using it.

Ask Better Questions

Effective board oversight has never depended upon directors possessing every answer. It depends upon their ability to ask questions that expose assumptions, clarify accountability and reveal whether management understands the risks it is taking.

Artificial intelligence is no different.

An AI-ready board should be able to establish a clear picture of material AI use across the organisation. This begins with simple questions: Where are we using AI? Why are we using it? Who is accountable? What information or decisions are affected? If management cannot answer these questions clearly, the board has identified a governance issue before it has identified a technology issue.

The questions should then become more demanding.

What would happen if the system produced a plausible but incorrect result? Where must human judgement remain decisive? How do we know the technology is performing as intended? Who can stop its use if circumstances change? What information is provided to people materially affected by AI-supported decisions? What capability would remain inside the organisation if the vendor relationship ended tomorrow?

These are not technical questions. They are questions about accountability, resilience, trust and institutional capability.

The Australian Government’s AI assurance framework reflects this approach. It calls for clearly identified responsibilities, ongoing monitoring and evaluation, human accountability for AI-influenced decisions, mechanisms for people to challenge outcomes and preparedness to disengage an AI system when serious problems cannot be resolved. (Department of Finance)

Boards should also be willing to ask the most important question of all:

We can use AI here. Should we?

Current AICD guidance makes this distinction explicit, recognising that board oversight may require ethical judgement extending beyond legal compliance and that human oversight and critical thinking cannot simply be transferred to AI. (AICD)

This is where board capability becomes visible. A board that asks only whether an AI initiative is compliant may miss whether it is wise. A board that asks only about efficiency may miss consequences for employees, customers or community trust.

Demand Visibility Without Creating Bureaucracy

As AI use expands, organisations can easily drift towards one of two extremes. In the first, the board receives little meaningful information because AI is considered an operational or technology matter. In the second, concern about emerging risks produces layers of committees, registers, approvals and reporting that treat every AI application as equally significant. Neither approach represents mature governance.

The better principle is proportionality.

Boards need clear visibility of material AI use, significant changes in risk, major incidents and whether agreed governance controls are operating effectively. Higher-risk applications, particularly those affecting people, sensitive information, significant decisions or essential services, should attract greater scrutiny than low-risk productivity tools. Australia’s National Framework for AI Assurance similarly advocates a risk-based approach, with governance structures that are proportionate and adaptable rather than unnecessarily burdensome. (Department of Finance)

Reporting should therefore help directors answer a small number of important questions. Is material AI use changing? Are significant risks emerging? Have there been incidents or unexpected outcomes? Are systems performing as intended? Are management’s controls and accountabilities working?

This is assurance, not administration.

A board that requests every detail risks obscuring the issues that actually require its attention. A board that requests nothing meaningful risks discovering problems only after they have become incidents. Current AICD guidance recommends that boards and management determine appropriate measures and reporting cadence together, providing visibility of AI use, performance and emerging risks. (AICD)

Good governance therefore does not mean governing more.

It means seeing what matters.

An AI-ready board establishes enough visibility to exercise judgement and challenge management while leaving operational responsibility where it belongs. The objective is not to create an AI bureaucracy. It is to ensure that material uses of AI can never become invisible to those ultimately responsible for governing the organisation.

Build Board Capability Before a Crisis Requires It

No director can reasonably be expected to keep pace with every development in artificial intelligence. Models, products and capabilities are changing too quickly for technical mastery to be a realistic standard.

But that does not make a lack of knowledge an acceptable permanent position.

Directors routinely govern complex areas in which they are not specialists. They develop sufficient understanding to interpret information, recognise material risks, challenge management and know when independent expertise is required. Artificial intelligence should be no different. Current AICD guidance explicitly recommends that directors develop a level of AI literacy sufficient to understand the strengths and deficiencies of AI tools relevant to governance, including risks associated with bias, data quality, opacity and security. (AICD)

“I don’t understand AI” may identify a capability gap. It cannot become an excuse for a governance gap.

Boards should also recognise when their collective capability is insufficient. That may require director education, structured briefings, external advice or access to specialist expertise. Over time, AI capability should also influence board skills assessments and succession discussions, particularly where artificial intelligence is becoming material to organisational strategy or risk.

Australia’s national AI assurance framework reinforces the broader principle that responsible AI governance requires appropriate technical, social and legal capabilities, supported by information, training and resources that enable people to exercise judgement and identify and manage risk. (Department of Finance)

The worst time for a board to begin learning about artificial intelligence is after a significant failure.

By then, directors may be asking questions they should have asked months earlier.

An AI-ready board builds sufficient capability before circumstances test it. It accepts that directors need not know everything, but also recognises that not knowing enough to govern is a problem the board itself has a responsibility to address.

Stronger Boards Build Stronger Regions

In a regional city, the consequences of board decisions rarely remain confined to individual organisations.

Ballarat’s major institutions collectively shape healthcare, education, water, employment, economic development, public services and community life. The city itself identifies health services, education and advanced manufacturing among its key industries, while major organisations across local government, health, education, essential services, business and tourism already collaborate on Ballarat’s long-term growth priorities. (City of Ballarat)

Artificial intelligence adds another dimension to that shared responsibility.

A governance failure within a major regional institution can affect employees, customers and communities well beyond the organisation itself. Equally, strong board leadership can create capability that spreads through professional networks, partnerships and the movement of people between regional organisations. Directors who become better at governing AI therefore contribute to something larger than the capability of their own board.

This matters as Ballarat grows. The city’s population reached approximately 121,000 in 2024 and is forecast by the City of Ballarat to exceed 164,000 by 2046, increasing pressure on health, education, infrastructure and community services. (City of Ballarat) AI will increasingly form part of how institutions respond to that growth.

Ballarat does not need every board to develop identical AI policies or governance structures. It does need boards capable of exercising informed judgement about technologies that increasingly affect the region’s people and institutions.

Regional AI capability will ultimately be only as strong as the institutions entrusted to govern it.

Building AI-ready boards is therefore not simply an organisational governance exercise. It is an investment in Ballarat’s long-term institutional capability.

Conclusion

Artificial intelligence will continue to change faster than any board can reasonably follow in technical detail. New models will emerge, capabilities will expand and organisations will discover uses that are difficult to anticipate today.

The standard for effective governance cannot therefore be technical mastery.

It must be sufficient understanding to exercise judgement.

Most importantly, directors cannot wait for certainty before developing this capability. Artificial intelligence is already becoming embedded within the organisations they govern. Where knowledge is insufficient, the responsibility is to strengthen it.

Directors do not need every answer.

They do need to remain accountable for asking the right questions.

Technical complexity does not diminish the responsibility to govern. It makes good governance more important.

About BRAIN

The Ballarat Region Artificial Intelligence Network (BRAIN) is a regional institution focused on understanding the impact of artificial intelligence across Ballarat and surrounding communities and strengthening the capability required to respond. Through research, publications and regional collaboration, BRAIN examines how AI can contribute to regional prosperity and wellbeing while helping institutions navigate its risks and wider consequences. (BRAIN)

About the Author

Matt Bowd is Co-Founder and Chief Executive Officer of the Ballarat Region Artificial Intelligence Network (BRAIN). His work focuses on AI governance, institutional capability and the implications of artificial intelligence for regional organisations and communities.

Next in the Series

From AI Policy to AI Assurance

Writing an AI policy is relatively easy. Knowing whether it is actually working is considerably harder.

The next paper in the BRAIN Governance Insights Series will examine the transition from policy to assurance: how boards and leaders can establish evidence that AI governance is operating as intended, identify where controls are failing and create accountability without building unnecessary bureaucracy.

As AI becomes embedded more deeply within organisations, the governance question must move beyond “Do we have a policy?” toward a more demanding question:

“How do we know our governance is working?”

Written by Matt Bowd, Co-Founder of the Ballarat Region Artificial Intelligence Network (BRAIN).

Each study is a step toward a more intelligent and resilient region.

To participate in regional pilots or research partnerships, in our region or yours, connect via matt@brain.net.au.

The link has been copied!