Editor's note — September 12, 2026: Added an attributable financial-sector reference and separated that source from the author's broader operating recommendations. This article does not establish a supervisory deadline for all organizations.
The Governance Gap
THE TAKE
Cybersecurity has always been a board issue.
But AI is changing the size, speed, and systemic nature of the risk.
My concern is that interconnected systems and shared providers can transmit operational disruption beyond the organization where an incident starts. The Bank of England's June 30, 2026 speech discusses AI's implications for finance; the broader enterprise recommendations here are my own.
That is the real shift.
AI does not just make phishing emails better. It can help attackers find vulnerabilities faster, automate reconnaissance, generate attack paths, create convincing misinformation, and exploit weak systems with less manual effort.
For boards, this means the old cyber questions are not enough.
It is no longer sufficient to ask:
“Are we secure?”
The better question is:
“Can we operate through an AI-accelerated cyber event?”
That requires visibility, crisis management, vendor resilience, communication discipline, patch speed, and leadership alignment before the incident happens.
THREE THINGS BOARDS SHOULD KNOW
Test response speed — Assess how automated attacks and automated business actions affect detection and containment in your environment.
Systemic risk is now part of the discussion — Shared technology, common vendors, payment systems, and industry concentration can turn isolated incidents into broader disruption.
Cyber resilience must be tested, not assumed — Boards should expect management to prove readiness through crisis exercises, incident simulations, patch metrics, and third-party risk reviews.
THE QUESTION I'M HEARING
“What should boards ask management right now?”
Start with operational readiness.
Not generic confidence.
Not a colorful dashboard.
Boards should ask:
- What are our most critical internet-facing systems?
- Which systems are hardest to patch quickly?
- Which third-party providers could create concentration risk?
- What AI-enabled attack scenarios have we tested?
- How fast can we identify and contain an incident?
- Who makes decisions during a cyber crisis?
- When did we last run an executive-level tabletop exercise?
- Can we communicate clearly to customers, regulators, and partners under pressure?
This is where the governance gap shows up.
Policies should be supported by exercises that test actual decisions and dependencies.
The exercise results should guide remediation priorities.
The companies that handle this well will not be the ones claiming they have the best tools. They will be the ones that can move fast, make decisions under pressure, and prove they understand their operating dependencies.
THE BOTTOM LINE
AI cyber risk is no longer just a security operations issue.
It is becoming a resilience, regulatory, and board governance issue.
Boards should expect management to prove the organization can operate through AI-speed disruption.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.