New European guidance puts AI oversight firmly on the board’s agenda. Its practical test begins with the information directors use to make decisions.
Boards weighing how to oversee artificial intelligence face a question close to home: what happens when AI starts shaping the information they themselves receive?
On 7 October, Accountancy Europe published guidance developed with ecoDa setting out ten principles for effective board oversight of AI. Its accompanying summary calls for attention to confidentiality, reliability, human oversight and accountability. These concerns become especially tangible when an AI tool summarises a board paper, answers a director’s question or helps prepare a meeting record. Accountancy Europe
The practical implication deserves attention. A board can challenge management’s use of AI while leaving its own use insufficiently examined. If directors rely on generated summaries, governance must extend to how those summaries were produced, checked and used.
Three questions provide a useful starting point: what information can the AI access, who validates its output, and how does the board retain accountability? These are an application of the guidance to boardroom workflows, rather than a checklist quoted from the paper.
What information can the AI access?
Consider a hypothetical acquisition discussion. An AI assistant summarises the transaction papers for a director. Before assessing the summary, the organisation needs to establish which documents the assistant was permitted to retrieve.
Could it access only the papers available to that director? Were restricted committee documents excluded? Was it working from the latest version?
These questions turn an abstract commitment to confidentiality into something testable.
For board and committee work, a sensible requirement is that AI access follows the permissions governing the underlying documents. The ability to retrieve information should not quietly expand because a user asks a question through a conversational interface.
Document currency matters too. An accurate summary of a superseded proposal can still mislead. A useful answer should therefore make it possible to identify its sources and establish which versions informed it.
Hosting arrangements deserve scrutiny, but they answer only part of this question. Choosing local infrastructure or an on-premises deployment does not, by itself, establish whether access permissions are correct, documents are current or generated answers are accurate. Those controls require their own examination.
For a board secretary or governance team assessing a proposed tool, a demonstration should include a permission test: ask it for information the user is authorised to see, then ask for information they are not.
Who validates the output?
An AI-generated summary can be readable, persuasive and wrong.
The US National Institute of Standards and Technology identifies “confabulation” as a risk of generative AI: systems can confidently produce erroneous content, including misleading reasoning or citations. Its guidance highlights the consequences when people accept such material and use it in significant decisions. nvlpubs.nist.gov
In board work, the problem need not be an invented fact. A summary might omit a qualification, blur the distinction between a proposal and an approval, or give insufficient weight to an unresolved concern. These are illustrative failure modes, but they explain why checking names and numbers alone is insufficient.
Validation needs a defined purpose and an owner.
For a financial briefing, that may require someone able to check the figures and their context. For draft minutes, the reviewer must establish what was discussed, decided, deferred and assigned. Directors remain responsible for questioning the information on which they rely.
NIST’s framework also addresses automation bias: excessive deference to automated systems. Merely placing a person between an AI output and its use does not establish that meaningful scrutiny occurred. nvlpubs.nist.gov
A credible review process gives that person access to the source material, enough time to compare it, and authority to reject the draft. Its effectiveness should be judged by whether errors and omissions are caught.
How does the board retain accountability?
The third question concerns what happens after an AI answer is accepted.
Suppose a generated briefing informs a committee recommendation. If that recommendation is later challenged, could the organisation reconstruct the evidence considered, identify material corrections and explain the reasoning behind the decision?
This is a practical test of accountability. A polished final document may reveal little about how a conclusion was reached.
INSEAD and KPMG’s separate AI governance framework reinforces the relevance of this issue. Its five principles include human accountability, trustworthy AI and the work of the board itself, placing directors’ own practices within the scope of AI governance. INSEAD
One operational response is to preserve an appropriate record of sources, review, approval and subsequent action. The detail should reflect the significance of the use. An informal drafting suggestion and a briefing supporting a major transaction warrant different levels of scrutiny.
Responsibility also needs to be explicit. Technology teams can assess systems and security. Governance teams can define document and approval processes. Subject specialists can validate content. The board must still exercise judgement over the decision.
Controls must leave room for useful AI
There is a credible objection to demanding extensive review: if every generated sentence requires a lengthy approval process, much of the expected benefit disappears.
That objection should shape implementation.
Accountancy Europe’s summary advocates oversight proportionate to the application and its potential impact. It also recognises that boards must consider the risks of failing to adopt AI. The guidance therefore supports a measured approach to both opportunity and control. Accountancy Europe
For boardroom use, that suggests starting with clearly bounded tasks and testing them against defined expectations. Finding a passage in an approved document is a different task from interpreting competing strategic options. Drafting a summary is different from approving an official record.
This is where board platforms, including Convene, face a useful evaluation standard. Buyers should ask suppliers to demonstrate document permissions, source visibility, review arrangements and approval records wherever AI is proposed. These are criteria to verify in the relevant product and configuration, rather than capabilities to assume from an AI label.
The next boardroom AI demonstration could begin with a deliberately difficult exercise: retrieve a restricted paper, summarise conflicting versions, then explain how a reviewer corrects the result. What happens during those tests will tell directors more about control than a flawless answer to a prepared question.
Sources
