Amer Al Ahbabi is a serial entrepreneur, global board member and CEO at Vertix Holdings based in the UAE.
getty
A board I once observed had just approved the rollout of an automated underwriting model when I asked what would happen if its decision rate on a single portfolio segment shifted by 10 points overnight. The room went quiet, not because the question was complicated but because nobody had thought to ask it before the vote passed.
That is the pattern I have watched repeat itself across audit and risk committees for years: The oversight line item gets checked, and almost no one in the room could explain what happens the moment the system underneath it is wrong. That gap is not a technology problem. It is a governance problem, and it is the one many boards are currently least prepared to admit to themselves.
The Comprehension Gap Behind The Committee
For decades, the instinct in the boardroom has been to treat an emerging risk the way institutions have always treated new risk: by adding a committee, amending a charter or naming a responsible officer. That approach served reasonably well for compliance risk and reputational risk, where the underlying logic, if not every technical detail, remained familiar to most directors. Artificial intelligence breaks that pattern. A director can vote to approve an AI oversight committee without being able to ask a single substantive question about the systems that committee now exists to supervise. The structure gets built. The comprehension required to use it does not follow automatically.
The available data supports this more starkly than most institutions would prefer. Even as more than 88% of organizations report using AI in at least one business function, only 39% of Fortune 100 companies have disclosed any form of board oversight of AI, whether through a dedicated committee, a director with relevant expertise or an ethics function, according to McKinsey’s December 2025 analysis of board governance and AI. More telling still, the same research found that 66% of directors describe their own boards as having limited to no knowledge or experience with AI, and nearly a third say the subject does not reliably reach the board agenda.
Read that finding carefully, because it inverts the usual assumption. Oversight is being formally claimed by boards that, by their own admission, lack the fluency required to exercise it in substance.
What Decades Of Auditing Control Failures Teaches
My own professional grounding sits on the other side of this exact problem. Years spent reviewing the financial controls of government entities as an external auditor, followed by service on boards and audit committees across several industries, taught a lesson that has outlasted every subsequent role. Control failures are rarely the product of a missing policy. They are, far more often, the product of a policy that exists on paper but that nobody in the room has the standing or the technical grounding to question. A control that cannot be interrogated in substance is not functioning as a control. It is a liability given the outward appearance of a control, discovered only after the loss has occurred.
This distinction changes where the real exposure sits. A board that has formed an AI committee but cannot interrogate the systems under its nominal authority has not reduced its risk. It has relocated that risk into a structure that looks, on a disclosure form, like a solved problem. Regulators and shareholders tend to discover the difference between form and substance at the worst possible moment, precisely when an automated system has already caused material harm and the board is asked what it knew and when.
45 Minutes That Redefined Oversight Failure
One of the clearest illustrations of this dynamic did not originate in artificial intelligence at all, though it anticipated the failure mode many boards now face with algorithmic systems more broadly. In August 2012, a coding error at a major firm caused the firm’s automated trading system to flood the market with unintended orders over 45 minutes before anyone inside the organization could halt it, a mistake that cost the firm more than $400 million and nearly ended it as a going concern.
The Securities and Exchange Commission’s subsequent order was not, in substance, a finding about a software bug. It concluded that the firm lacked adequate safeguards to limit the risks posed by its own market access, and that this deficiency allowed millions of erroneous orders to reach the market unchecked. The technology had moved faster than the organization’s capacity to interrogate it, and no one positioned to stop the deployment had the standing, or the fluency, to ask what would happen if the update failed. That is a governance failure wearing the appearance of a technical one, and it is the exact shape of the exposure sitting quietly inside many AI oversight committees today.
Building The Harder Half
None of this argues against forming AI committees, naming accountable directors or updating governance charters to reflect the technology’s growing weight. Those steps matter, and boards without them remain exposed. But they are the easier half of the work, and a growing number of boards mistake that half for the whole of it. The harder half is building directors who can ask a chief technology officer what happens when a model drifts from its original parameters, who verifies the integrity of its training data and what the escalation path looks like when an automated decision causes harm before a human notices. That capability cannot be delegated to a committee charter, however well drafted. It has to live in the actual judgment of the people seated around the table.
The boards that avoid repeating the errors of that 2012 firm will not be the ones holding the most detailed AI policy documents. They will be the ones whose directors made themselves uncomfortable enough to genuinely understand what they were approving. Governance was never primarily about the structure erected around a risk. It has always been a question of whether the people inside that structure know which question to ask next and whether anyone is prepared to wait for a real answer before moving on.
The information provided here is not investment, tax or financial advice. You should consult with a licensed professional for advice concerning your specific situation.
Forbes Finance Council is an invitation-only organization for executives in successful accounting, financial planning and wealth management firms. Do I qualify?
