Four ways boards can support the effective use of AI

“Garbage in, garbage out” are watchwords of those who use data to support business and operating models and for decision-making. They are especially resonant within the context of board oversight of AI and other emerging technologies. Generative AI (GenAI), for example, requires clean and useful data – ranging from text and code to pictures and audio – to build robust models that lead to compelling and productive outputs. Preparing data correctly can take substantial resources. Additionally, building the technology infrastructure, including storage, access and organizational systems, is critical for enterprise-wide use of GenAI and other new or emerging technologies.

Organizations spend millions to address data quality issues – and not always successfully. Moving forward, these efforts will be critical to making efficient use of technology investments including AI usefulness.

Much of this work is manually intensive and not professionally rewarding. Interestingly, GenAI itself may be able to reduce some of the pain this work has traditionally required, and data may not need to be perfect. Third-party data may prove to be a better option for some, but even though other ways of accessing it, such as data pooling, are emerging, it may be cost prohibitive for many companies. Further, without the right infrastructure, it will be difficult to embed new technologies and processes into employee workflows and achieve strategic objectives. For companies, failure to do this well will create real risks, ranging from reputational to security (including cyber breaches). The vendor landscape for AI is also constantly evolving, requiring decisions across multiple layers of data infrastructure and potentially increasing risk due to increased access points.

Why boards should care

Clean and remediated data and changes in IT infrastructure are necessary to maximize the use of AI and other emerging technologies. Management teams recognize the importance, and according to the October 2023 EY CEO Outlook pulse survey, 37% of CEOs planned to reallocate capital from other investment budgets to support AI development in 2024. Thirty-four percent said they would primarily raise new capital and 26% indicated they would reallocate capital specifically from technology budgets. These are large and expensive efforts that require significant capital expenditures and close integration with talent and organizational strategies.

Technology investment choices that are not aligned to a longer-term strategic vision may be difficult to unwind and could significantly inhibit the organization’s ability to take advantage of these technologies in a way that aligns with management’s vison. 

How boards can help

Boards play an active role in overseeing the large capital expenditures necessary for AI success and must elevate the importance of data and related infrastructure. Management plans are likely to be overly optimistic and may call for holding on to investments already made rather than prioritizing investment in critical AI enablers. As directors told us, recognizing the planning and sunk cost fallacies is helpful when holding management accountable for clean data. As with data preparation, boards should confirm that management has carefully evaluated infrastructure deployment in terms of the options, chosen what makes sense for the company’s future direction, and is then held accountable for execution. Boards should also ask for regular updates from management to understand the pace of technical enablement work and how it supports the long-term strategy of the company.

The full-scale use of AI will alter the way work gets done in nearly every organization, challenge existing business models and change the ways companies engage with individuals and each other. AI-driven automation improves the efficiency of operations and technology teams; creates individualized approaches to marketing and sales; customizes products and services for individuals; and brings enormous and previously unreconcilable forms of data and inputs to financial forecasting, risk management and strategic decision-making. At the same time, embedding AI in policy, procedures and controls can improve the ways in which organizations manage and mitigate risk and evaluate strategic advantage.

Companies that take advantage of AI and other emerging technology for it transformation capability will go further. These companies may be better prepared to change how work gets done and create new business and operating models. Sixty-two percent of CEOs believe that their organization must act now on GenAI to avoid ceding ground to competitors. Successful implementation can improve knowledge of the corporate genome – people, assets, customers, suppliers and history – and organizational decision-making. This in turn creates the conditions for the company to transform how it connects products and services to customers. From our discussions with directors, leading companies are now pushing to leverage AI to further enable value creation and, in some cases, to create new businesses and operating approaches. 

Why boards should care

Given the potential impact of AI from incremental to transformational, boards will play a pivotal role in encouraging the appropriate pace of integration of these new technologies into the business – particularly in light of the change management that will be needed as this new technology disrupts old processes and decision-making.

Specifically, companies should balance smaller one-off AI uses within the company with a broader strategic framework so that there is real business value to the many AI use cases that might be underway. After all, a proof of concept or specific use case does not require that all risks and interdependencies be accounted for across the organization. Directors are in a unique position to support management in determining a strategic approach to AI. Because of the board’s longer-term perspective and often longer-tenured experience, it can help management pause to create a broader strategic framework. Such a framework can align the firm’s resources to the most fruitful initiatives.

Directors are noting the growing importance of organizational change management to seeing that AI is integrated and leveraged, particularly since it is so different from traditional software solutions and training. In our discussions we heard that learning to work with AI is akin to learning to work with a new colleague. As one director put it, “Boards are asking, ‘How are we using AI?’ instead of asking, ‘How are we making sure our people are ready?’”

How boards can help

Boards can guide management to take a broader perspective around AI by setting expectations and accountability accordingly. Instead of centering discussion on whether AI can improve a specific process, they can direct management to determine how AI can help the business as a whole to differentiate itself from competitors. As Dan Diasio, EY Global Artificial Intelligence Consulting Leader, writes, “AI should drive major shifts in revenue  and business model transformation, help a firm enter a new market, or fend off a major threat.” Boards can help management keep these transformative aspects in their plans. They can also ask questions about potential new competitors, as the democratization of AI will increasingly enable smaller organizations to break apart and challenge the value chains of larger companies. Boards can also ask whether management is including the people aspect of change management needed for AI to become embedded in the business.

AI creates new risks for companies in areas such as intellectual property rights, bias, and model transparency. Responsible AI programs add a governance and oversight layer to managing risks in the development and deployment of AI. Businesses building such programs can look to multiple external principles documents and risk management frameworks, such as the OECD AI Principles, the National Institute of Standards and Technology (NIST) AI Risk Management Framework and an applied ethical framework that aligns an organization’s priorities and guardrails to its values and purpose, creating a north star to orient the governance of the AI program. The global EY organization pledges to follow a framework of nine responsible AI principles: accountability, data protection, reliability, security, transparency, explainability, fairness, compliance and sustainability, and many companies are using this list as a starting point for their policy decisions.

Although government regulation of AI is starting to appear on the horizon, there is some skepticism around whether it will move quickly enough to provide adequate safeguards. Meanwhile, companies have unique access to talent and capital to develop AI models to enhance existing governance and oversight structures.

A robust and responsible AI framework can help resolve potentially competing priorities when building and deploying products on an AI journey. Consider two ethical AI priorities, reliability and explainability. Is the model consistent over time and can what it does be explained? Optimizing reliability in an AI model may require a black box algorithm that does not reveal specifics about how data is processed or analyzed but that may itself inhibit the explainability of the model, creating a tension between the two principles. A responsible AI program can help employees understand how to balance priorities such as these and manage risks within an organization’s AI risk appetite.

Why boards should care

Getting AI wrong may cause harm both to companies and their boards, and thus, AI policy oversight should be a key board mandate. Institutional investors are beginning to establish expectations for the responsible development and use of AI, with several recently releasing formal guidance. The Federal Trade Commission (FTC) and Delaware courts have both taken positions that may lead boards to oversee AI as part of a mission-critical operation. It is crucially important for boards to confirm that management teams incorporate responsible AI at the start of an AI journey. The desire to optimize for efficiency and speed to market should be carefully balanced with establishing that the necessary safeguards are in place to help mitigate the numerous risks AI poses to companies and society. To be effective, responsible AI principles must be translated into actions that are in accordance with corporate values and the company’s risk tolerance.

How boards can help

Successfully governing a responsible AI program aligned to corporate purpose and value can be difficult to achieve in practice; but policy setting at the board level can help ensure that a thorough assessment occurs. Boards can support management teams by vetting barriers to implementing a purpose-based, responsible AI framework.

Finally, a responsible AI framework should be integrated in the company’s overall risk management program. Boards may seek to establish regular and systematic updates from management on AI opportunities and risks, confirm that AI is on the agenda for board meetings and act on any noted red flags. It may be helpful to designate a single person from management with overarching responsibility to manage AI risks.

Boards sit at the nexus of a complex business environment where the rapid pace of change is about to be supercharged by emerging technologies; they must enhance their effectiveness to be positioned not just for today but for the future.

While boards have had to contend with myriad topics that have emerged and become integrated into business and governance in the last few years, the exponential usage of AI brings unique challenges into the boardroom.

In our discussions with directors, they emphasized the importance of having the right conversations about technology, risks and opportunities. With board and committee agendas becoming more crowded, determining where discussions about AI take place has become an open question for many boards. At a recent gathering of directors, when asked where AI is discussed on their boards, nearly all noted the issues come up most naturally for audit committees as part of risk oversight. However, this can fracture the conversation around AI and other emerging technologies, leaving the strategic value-creating, non-risk-focused topics to ad hoc agendas. As for the who, boards continue to seek ways of rounding out skill sets by adding technology proficiency through a business lens but recognize the challenge of overfocusing on one or two technology experts. On the management side, boards are also questioning who should be the designated owner of AI as they recognize the unique enablement it brings across multiple functions and new business models.

To help their organizations fully leverage the benefits of AI, boards will need to have discussions that go beyond risk and compliance policies. Given time requirements and crowded agendas, a question that comes up is whether there should be a designated technology committee, and the answer — as is so often the case for governance issues — is “it depends.” Our analysis shows that while the number of committees beyond the core three is declining or remaining unchanged, the prevalence of technology committees among S&P 500 companies has nearly doubled, from 7% in 2018 to 13% in 2023. These numbers do not capture subcommittees or ad hoc committees as those are not regularly reported. Notably, when a technology committee was added, in most cases it was new rather than repurposed.

A technology committee is only one option, of course, and below is a range on where the necessary discussions and deep dives can take place.

• Chartering a new committee to focus on technology, cyber and AI
• Incorporating AI into an existing committee where related risks and opportunities are already overseen
• Creating a subcommittee to focus on AI
• Creating an ad hoc committee centered on a particular AI challenge
• Creating an advisory board of AI experts to provide continuous learning and assistance