Editor's note — September 12, 2026: Removed an unidentified executive-order claim. The oversight recommendations are the author's view, not a statement of universal legal duties.
THE TAKE
AI security belongs in the board's discussion of business resilience. The practical question is where AI can affect sensitive data, payments, identities and critical services.
My concern is the gap between authority granted to a system and management's ability to demonstrate control over that authority.
For directors, the real tension is simple: AI is being pushed into the business to create speed and efficiency, but the same technology can compress attack time, amplify social engineering, and widen the blast radius of a security failure. The companies that treat this as a compliance exercise will underinvest in controls until a loss, an incident, or a regulator forces the issue.
My view: boards should require an AI security posture review now, not after the next incident. That review should cover model access, sensitive-data exposure, vendor dependencies, identity verification, and incident response for AI-enabled fraud.
THREE THINGS BOARDS SHOULD KNOW
AI adds security questions — Assess the systems, data and decisions exposed by each use case; do not treat a federal policy signal as a universal corporate obligation.
Deepfakes are a board problem — Synthetic voice and video are now practical tools for impersonation, fraud, and executive deception, so identity verification and payment controls need to be part of the security conversation.
Governance must move faster than adoption — Organizations still struggle with shadow AI, unclear ownership, and weak lifecycle controls, which leaves them exposed when AI is embedded in day-to-day workflows.
THE QUESTION I'M HEARING
"What should we ask for at the next board meeting so we are not guessing about AI risk?"
Ask management for a one-page AI risk map that shows where AI is used, which systems and vendors it touches, what data it can access, and who owns each risk decision. That is the minimum standard for board oversight because invisible AI is unmanaged AI.
Then ask for three controls: a policy for approved AI use, a process for testing AI-enabled fraud and deepfake scenarios, and a clear escalation path for high-risk model issues. If management cannot produce those within a reasonable timeline, the issue is not the toolset—it is the governance model.
THE BOTTOM LINE
AI security is no longer a niche technical topic; it is a board-level resilience issue tied to fraud, data protection, and operational continuity. Directors should demand visibility, ownership, and testing before AI becomes the weak link in the enterprise.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.