Board Director AI Governance Report, November 2026

The decision in brief

Put AI on the board agenda when it changes a material commitment, exposure or operating dependence. Ask management to connect its business case to the authority delegated, the evidence supporting continued operation and the response if assumptions fail. A quarterly dashboard should reveal those decisions and unresolved uncertainties, without asking directors to supervise individual releases.

Executive summary

The board's most useful question is what the company has become committed to. A promising application can change staffing, customer obligations, access to sensitive information and dependence on a supplier before management explicitly acknowledges the combined commitment. Reviewing the software budget alone may miss that change. Reviewing every experiment creates the opposite problem: directors spend their time on implementation while strategic decisions remain implicit.

OFF's November evidence helps identify questions for oversight. In the updated security sample, 142 of 207 respondents selected agent identity, access and permissions as a priority. The carried-forward operator instrument records 54 of 91 respondents selecting deployed or embedded stages. Neither measure is a board survey. Neither establishes that the respondents represent distinct companies, that controls failed or that adoption caused a financial result. The measures describe concerns and reported operating states within selective registration samples. [SEC; MATURITY]

This report proposes an agenda based on material changes to exposure and dependence. Management should identify which decisions it can make within existing authority and which require escalation under the company's governance arrangements. The board should receive evidence about the assumptions on which a material commitment rests, including limits to that evidence. An attractive headline metric without a relevant population, operating scope or accountable owner provides little assurance.

November's practical contribution is a quarterly dashboard and an escalation matrix that join strategy, financial qualification, operating resilience and legal review. These are proposed tools, not measured OFF practices. They distinguish an adverse event from a decision that has become too consequential for its original delegation. They also distinguish a test that has passed from management's judgment that the remaining uncertainty is acceptable.

Another AI dashboard adds reporting burden when it duplicates existing risk, investment and operating systems. The recommended board record is therefore an index to those systems, organized around a small set of material commitments and changes. Its purpose is to support an identifiable oversight decision: continue under existing authority, require further evidence, revise a limit or revisit the strategic commitment.

What November adds

Earlier OFF material addressed committee allocation and the information an AI leader should report to the board. This edition goes further into the boundary between an operating decision and a material change that deserves director attention. The central question is no longer simply which committee receives AI information. It is what has changed sufficiently to require a different decision, and what the board needs to know to make that decision responsibly.

The first addition is a materiality discussion that separates size from consequence. A modest software purchase can become important if it supports a critical service or receives authority over customer funds. A large experimental budget can remain comparatively reversible if spending is capped, information access is limited and no operating dependence has been created. The board should understand both financial scale and the character of the commitment, assessed in the company's own circumstances.

The second addition is an assurance boundary. A report may establish that a test was completed without establishing that the system remains within the tested conditions. A management attestation can identify responsibility without independently verifying performance. A vendor certificate can address a platform control without covering the application built on it. November's dashboard asks each assurance statement to name its scope, date, owner and unresolved limitation.

The third addition is a worked escalation sequence. It shows how management can bring a decision to the appropriate committee without sending directors a technical incident log. The sequence connects a change in customer commitments to the evidence needed for oversight, then records the resulting decision and conditions. It is intended for use alongside existing company policies and jurisdiction-specific advice.

The edition deliberately retains Preview status. Only two respondents selected the board seat category in the operator instrument's 101 seat responses. That is insufficient for a director sentiment analysis or a comparison with executive groups. The substantive contribution is an oversight method informed by broader evidence, with its limits made explicit. [SEAT]

Evidence and sample boundaries

The November collection uses authorized event-registration exports downloaded on 1 November. Eligible records are non-invited applications through the stated cutoff; they are not confirmed attendees. Byte-identical exports are removed. Each question uses the latest eligible nonblank response per normalized respondent identifier, so denominators differ between questions and repeated participation does not simply add observations.

Security priorities now have 207 responses. The operator maturity question has 91 and is carried forward from the previous edition. These are different populations with different instruments. Combining them into a statement such as the share of deployed companies lacking security would be invalid. The dataset does not link the reported concern to an observed control failure, a loss or an organization's materiality decision.

The operator question offers four stages, including an embedded category defined by dependence affecting cost structure or hiring plans. It is a cross-sectional choice, not a measured journey from one stage to another. The sample cannot tell directors how quickly a typical enterprise should progress or whether the highest stage is desirable.

External sources add governance principles, a large-company finance perspective and a specific public-company disclosure example. They do not validate the OFF sample. Recommendations below are the author's synthesis. Hypothetical examples are explicitly illustrative. The report provides no legal conclusion about a particular organization and no claim that a proposed dashboard satisfies every applicable duty.

Exhibit 1. Operating evidence that warrants a question, not a board benchmark

Exhibit note: SEC is multiple selection; MATURITY and SEAT are single selection. Samples are selective and self-reported. Categories across instruments must not be combined into an exposure rate.

1. Define the commitment before judging its materiality

A board paper should describe the business commitment in terms that survive a change of vendor or model. Consider a company that plans to provide customers with faster contract responses. The commitment might include a response time, a service price, a smaller review team and a new method for escalating exceptions. The model is only one component. If the board approves a strategy based on the resulting service economics, it needs to know which of those assumptions depends on successful AI operation.

Management should distinguish authorization to learn from authorization to depend. An experiment can be valuable even when its economics remain uncertain. It should have a spending limit, a defined question and a point at which the result changes the next decision. Dependence begins when the organization removes an alternative, makes an external promise or changes its staffing and operating plan in reliance on the system. That transition can be material even when the experiment itself was properly delegated.

Materiality cannot be reduced to a universal AI spending threshold. Financial size matters, but so do reversibility, concentration, affected stakeholders and the consequences of an error. A small workflow that initiates payments may require more attention than a larger drafting tool. Conversely, the existence of a sensitive data field does not automatically put every implementation decision on the board agenda. Management must explain the exposure in context and use the company's established escalation standards.

The proposed board record should identify the commitment, the alternatives considered, the assumptions supporting it and the authority under which management is proceeding. The board can then distinguish a strategy question from an implementation question. Whether to enter a market using an AI-dependent service is a strategic choice. Which routine monitoring library to use is generally an operating choice, unless that decision materially changes the exposure or undermines an assurance previously given.

This approach also improves the treatment of uncertainty. A board may knowingly support a strategic experiment with uncertain returns. What should be avoided is allowing an uncertain experiment to acquire the status of a proven operating plan without an explicit decision. Management should state which evidence remains incomplete, what would make the commitment unacceptable and when the board will next receive a decision-relevant update. Uncertainty becomes part of the approved judgment rather than a footnote added after a problem.

2. Ask what each assurance actually establishes

An assurance statement should be read as a bounded claim. A test passed for a particular workflow, user population, configuration and period. An internal review examined a defined set of records. A supplier provided evidence about specified services. Those statements can be useful without proving that every application is safe, accurate or economically sound. The board's task is to understand whether the evidence supports the commitment under consideration.

Management should separate three forms of support. Observed performance describes what happened under stated conditions. Control evidence describes how authority and exceptions are managed. Management judgment explains why the residual uncertainty is acceptable in the company's circumstances. Combining all three into a green status obscures their differences. A workflow may perform well while its revocation process remains untested, or have strong access controls while its promised financial benefit remains unqualified.

Dates matter because the operating boundary can change. An evaluation conducted before a new customer segment was added may provide limited support for that segment. A supplier's control report can be current while a local integration has changed. The dashboard should show the relevant change since the last review and the evidence renewed because of it. Directors do not need every test artifact, but they need to know when an earlier assurance is being carried beyond its original scope.

Independent challenge should be proportionate to consequence. The author of a business case can supply useful operational evidence, yet may have incentives to emphasize successful outcomes. Finance, risk, internal audit or an external specialist can examine the assumptions most material to the decision. Their involvement should have a defined purpose. Adding signatures without clarifying what each reviewer checked creates the appearance of assurance without improving the board's understanding.

The board should also ask how management knows that a control works in practice. A policy may state that an agent can be stopped, while downstream work continues under separate credentials or queued instructions. A recovery plan may exist without having been demonstrated for the service being expanded. These are questions about effective operation. Directors can request a concise demonstration result and unresolved limitation without prescribing the technical design themselves.

An adverse finding should not automatically invalidate the entire initiative. It should change the decision according to its significance. A limited test population may justify a restricted release; an untested material authority may justify withholding that authority. Clear boundaries allow the company to continue useful work while directing attention to the uncertainty that actually constrains the next commitment.

3. Route the issue without losing the whole decision

AI decisions often cross committee boundaries. A proposed service can affect financial reporting, customer commitments, cyber exposure, workforce plans and strategy. Allocating each topic to a committee is useful, but fragmentation can leave nobody considering the combined commitment. The lead committee should therefore be identified for the decision, with explicit input from other relevant committees and management functions.

The OECD governance principles describe committees as supporting board work while preserving the board's overall responsibility, subject to applicable legal arrangements. That is a useful starting point for AI oversight. It does not prescribe one universal AI committee. The right allocation depends on the organization's size, structure, industry and existing committee mandates. The November recommendation is to route according to the decision's principal consequence and bring cross-cutting assumptions together before approval. [E-OECD]

For example, a material AI-enabled acquisition thesis may belong principally with the full board's strategy and transaction review. The audit committee may examine the reliability of financial benefits and relevant controls. A risk committee may consider concentration and operating resilience. Legal and compliance teams may identify constraints on data use or customer commitments. The final paper should show how those inputs affect the acquisition decision, rather than presenting disconnected approvals.

Escalation should also be separated from incident reporting. A system can operate without an incident while a planned expansion exceeds its original authority. Conversely, an incident can be contained within an established management process without requiring a new strategic decision. The company needs both an event response route and a route for changes in commitment. The second is often easier to overlook because nothing visibly failed.

Committee chairs and management should agree how urgent matters reach the appropriate directors between scheduled meetings. A quarterly reporting cadence is inadequate for a decision that must be made this week. The escalation record should identify who can convene the relevant review, what interim authority management retains and what information is required immediately. Those arrangements should fit the company's governance documents and applicable obligations.

Finally, the board should receive the result of its own conditions. If approval depended on a validated recovery capability or a revised customer term, the next report should say whether that condition was satisfied and who verified it. An action list that repeatedly rolls forward without affecting permission to proceed weakens the meaning of conditional approval. The record should distinguish completed conditions, accepted exceptions and decisions that remain unauthorized.

4. Use a dashboard that preserves unknowns

A useful dashboard starts with material commitments, not a count of tools. Tool counts can help management maintain an inventory, but they rarely explain whether the company's exposure or dependence has changed. The board view should concentrate on the services, investments and operating assumptions that matter to strategy and resilience. Supporting inventories can remain available through the management record.

Each row should contain an outcome measure and the boundary within which it is valid. A customer-service initiative might show accepted resolution, rework and service cost for a defined class of requests. A financial benefit should state whether it is observed capacity, avoided expenditure, realized cash or a forecast. This prevents different claims from being added together into a single benefits total that has no consistent meaning.

Unknowns should have their own status. A blank field can mean not measured, not applicable, unavailable or disputed. Those conditions imply different actions. Management should identify the missing evidence, the decision it constrains and the accountable person responsible for resolving it. A material unknown is not automatically a reason to stop, but it should not disappear into an average score or a general assurance that implementation is progressing.

The dashboard should also identify changes in operating dependence. Relevant changes include removing a manual alternative, expanding an agent's authority, concentrating service delivery in one supplier or making a new customer promise. These changes can increase exposure even when the headline error rate improves. Directors should see what changed, why management considers the change acceptable and whether the supporting evidence was renewed.

Comparisons over time require stable definitions. If the eligible workload expands, an apparent decline in performance may reflect a harder case mix. If a cost measure starts including review labor, it may rise without any underlying deterioration. Management should preserve the prior definition and explain the effect of the change. A dashboard that silently redefines success each quarter prevents directors from assessing execution.

The board should resist a universal composite AI score. A high score can conceal a material weakness if unrelated strengths offset it mathematically. A concise narrative about the three most consequential changes may be more useful than a large set of weighted indicators. The test is whether the dashboard supports a clear decision and makes the evidence behind that decision accessible to appropriate challenge.

5. Preserve the option to change direction

Strategic flexibility depends on more than a cancellation clause. The company may retain the contractual right to leave a supplier while lacking the data, skills or operating capacity to do so. A board considering material dependence should ask which alternatives remain credible and what would be required to use them. The answer can be proportionate; it need not require a fully duplicated operating environment for every application.

Management should distinguish the ability to pause an action from the ability to sustain a service. Stopping an agent may prevent further unauthorized activity while creating a customer backlog. Restoring service may require a human process, a restricted mode or another supplier. The board needs to understand the business consequences of intervention, because a nominal stop capability may become difficult to exercise when the organization has removed its alternatives.

The financial plan should account for that flexibility. A lower operating cost achieved by eliminating all fallback capacity is different from the same cost achieved through a resilient redesign. The board may accept either approach in context, but it should understand the tradeoff. Management should explain which contingency resources remain, how they are maintained and what level of service the company can provide during a disruption.

Changes in direction should also be possible when the business case weakens without a technical failure. Customer demand may disappoint, review effort may remain high or a supplier's commercial terms may change. The original approval should identify the assumptions that warrant reconsideration. Otherwise, sunk implementation effort and organizational prestige can keep an initiative expanding after the evidence no longer supports it.

An orderly reduction in scope can be a successful outcome. The company may retain a drafting use case while withdrawing authority to execute transactions, or keep one customer segment while declining a broader rollout. Management should report the resulting economics and service implications, not merely label the initiative stopped or delayed. This makes it possible to preserve useful capabilities without defending the original plan in its entirety.

Directors should judge whether management can explain the current commitment, the evidence supporting it and the alternatives available if circumstances change. That is a stronger basis for oversight than enthusiasm about adoption or a demand for certainty that no strategic investment can provide. It also creates a practical connection between AI oversight and the board's existing responsibilities for strategy, risk and capital allocation.

External evidence and its limits

The G20/OECD Principles of Corporate Governance provide an international governance reference for board responsibilities and committee support. Their relevance here is the connection between strategy, risk oversight and accountability. They are not a substitute for the law, listing requirements or governance documents applicable to a particular company. The committee matrix below is an author recommendation informed by that general principle. [E-OECD]

Deloitte's third-quarter 2026 CFO Signals article reports a survey of 200 North American CFOs at companies with at least $1 billion in revenue. Seventy-four percent reported needing business days to weeks to pause an affected AI use case. This is a useful prompt to examine intervention capability, but it does not establish how OFF respondents operate or whether any particular organization's response is inadequate. Survey wording, company scale and respondent population differ. [E-DELOITTE3]

The SEC's cybersecurity disclosure framework supplies a concrete example of why escalation clocks must be precise. For covered Form 8-K registrants, Item 1.05 generally requires disclosure within four business days after determining that a cybersecurity incident is material, with specified provisions and exceptions. That is not a universal four-day clock from discovery and not a rule for every AI error. Company counsel must assess applicability and the full circumstances. [E-SEC-CYBER]

NIST's voluntary AI Risk Management Framework organizes risk work through Govern, Map, Measure and Manage. It supports a structured discussion of responsibilities and evidence, but using its vocabulary does not certify a deployment or prove compliance. The current official resource page also indicates that the framework is being updated. This report uses the established framework as guidance and does not describe a new 2026 certification standard. [E-NIST]

Together these sources support different parts of the oversight problem: allocation of responsibility, practical intervention, a specific disclosure obligation and a general risk process. They should not be blended into a single compliance checklist. A company can satisfy a reporting deadline while still having an inadequate recovery capability; it can maintain a risk register while overstating financial benefits. Directors need to see the relationship between each requirement and the decision they are being asked to make.

A board cannot wait for perfect information during a fast-moving event or strategic opportunity. The practical response is to specify the decision that can be made now, the uncertainty being accepted and the conditions for review. Evidence should support judgment at the relevant moment. It should not become a reason to postpone every difficult choice or to claim a level of certainty that the available material cannot provide.

The board should ask which part of each source is being used in the proposed decision. A survey of response times can prompt a question about the company's intervention capability, but only an exercise or operating record can answer that question locally. A disclosure rule can establish a reporting obligation without deciding whether service should continue. A governance principle can allocate oversight while leaving execution to management. Recording those distinctions prevents a familiar source name from becoming a substitute for evidence about the company. It also makes the pack easier to review when circumstances change: directors can see which assumption changed and which obligation remains.

Evidence comparison

A quarterly review and an illustrative escalation

The following dashboard is a proposed template. It contains no measured company results. Management should populate it from existing investment, operating, risk and legal records, then bring the material changes to the board. The board version should be short enough to support discussion while preserving access to the evidence behind each statement.

Exhibit 2. Quarterly board dashboard template

Consider an illustrative business-services company whose management has used an AI workflow to prepare contract responses. The initial scope permits drafting, with employee approval before anything is sent. Management now proposes to commit to a faster customer response time and reduce the staff allocated to routine review. The software cost is modest relative to company revenue, but the service and staffing commitments would make the workflow more consequential.

The first board question is what decision is actually required. Management can continue improving the drafting tool within its existing authority. The proposed customer promise and staffing change require a separate assessment because they alter operating dependence. The CEO should identify the strategic rationale, the CFO should explain the financial assumptions and the operating leader should identify the cases that still require experienced review.

The second question is whether the evidence covers the proposed commitment. Results from straightforward contracts may not support a response-time promise across all customer types. Management should show the eligible case definition, the accepted outcome measure and the effect of exceptions on service capacity. If the evidence covers only one segment, the board can consider a limited commitment while requiring further work on the rest. It need not choose between unrestricted expansion and abandoning the initiative.

The third question concerns intervention and continuity. If management suspends the workflow, can the company still honor the new response time? What backlog would arise, and who would handle it? A demonstration that the application can be switched off addresses only part of the problem. The board should receive the business effect of intervention and the resources required to maintain an acceptable service.

The fourth question is how legal and financial judgments affect the decision. Counsel should review the proposed customer terms and relevant data uses. Finance should separate observed time savings from expenditure that will actually cease, including any continuing review and contingency cost. These reviews should inform one decision paper. They should not become separate approvals whose conditions conflict or whose combined effect nobody has assessed.

Committee routing and escalation matrix

The resulting decision might authorize a restricted customer segment while retaining review capacity and requiring a defined service demonstration before further expansion. That is an illustrative governance outcome, not a recommendation for every company. The decision record should say who may expand the scope, what evidence must precede expansion and what change requires the board to revisit its approval.

At the next meeting, management should report against those conditions. A new green status is insufficient if the original conditions remain unresolved. The board should see the evidence obtained, any change in assumptions and the resulting recommendation. This closes the connection between oversight and execution without turning directors into release managers.

The next board conversation

Ask management to select the few AI commitments whose consequences most affect the company's strategy, finances or ability to serve customers. For each, request a concise statement of the commitment, the operating boundary, the evidence supporting it and the uncertainty that could change the decision. Avoid starting with a comprehensive inventory presentation that leaves no time to discuss the material choices.

The most productive discussion will often concern a change rather than an incident. A new customer promise, a staffing decision, an expanded action permission or a supplier concentration can make an existing workflow substantially more important. Directors should know which changes remain delegated and which require escalation. Management should know what evidence the board expects before approving a consequential commitment.

This Preview offers a method for that conversation. It does not establish how directors generally view AI, rank governance maturity or prescribe a universal committee structure. Its value is in making the board's judgment more explicit: what the company is prepared to depend on, why the available evidence is sufficient for that decision, and what would cause the decision to change.

Questions directors can use

Is this a survey of boards?

No. Only two of 101 operator seat respondents selected board. The report remains a Preview and uses broader evidence to develop oversight questions.

Does 59% deployed or embedded mean companies progressed this month?

No. The 54/91 result is a carried-forward cross-sectional distribution, not a transition rate. [MATURITY]

Does a security priority prove a control failure?

No. The 142/207 access-priority result records a selected concern, not an audited weakness or incident. [SEC]

Must every board create an AI committee?

No. Committee allocation should fit existing mandates, company circumstances and applicable requirements. [E-OECD; recommendation]

Does the SEC example apply to every AI incident?

No. The cited rule concerns material cybersecurity incidents for covered registrants, with specific timing and provisions. [E-SEC-CYBER]

What should a dashboard do with missing evidence?

Identify the missing evidence, the decision it constrains, the accountable executive and the next review point. Do not silently treat unknown as satisfactory.

Citable facts

- Agent identity, access and permissions: 142/207, 69%, updated selective security sample. [SEC]

- Deployed or embedded: 54/91, 59%, carried-forward operator sample. [MATURITY]

- Board seat: two of 101 responses; insufficient for a board-specific benchmark. [SEAT]

Methods and limitations

OFF calculation-v1.1 uses the authorized 1 November exports through the stated cutoff. Byte-identical exports and invited-only records are excluded. Latest eligible nonblank answers are selected per normalized respondent identifier per question. Registration timestamps are not answer-edit dates. Respondents are not necessarily distinct organizations or confirmed attendees.

Security and operator measures have separate instruments and bases. No cross-sample gap, causal result, company-level ROI or representative director estimate is claimed. The board dashboard, routing matrix and business-services scenario are proposed applications. Legal references have specified scope and do not establish a company's compliance.

References

[OFF-DATA] Open Future Forum. Executive AI Statistics, November 2026. Question IDs SEC, MATURITY and SEAT.

[E-OECD] OECD. G20/OECD Principles of Corporate Governance 2023, chapter V, The responsibilities of the board. https://www.oecd.org/en/publications/g20-oecd-principles-of-corporate-governance-2023_ed750b30-en/full-report/component-8.html

[E-DELOITTE3] Deloitte. CFO Signals, third quarter 2026. 21 October 2026. https://www.deloitte.com/us/en/insights/topics/business-strategy-growth/3q-2026-cfo-signals-survey.html

[E-SEC-CYBER] US Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, final rule, 26 July 2023; current Form 8-K staff interpretations consulted 2 November 2026. https://www.sec.gov/files/rules/final/2023/33-11216.pdf and https://www.sec.gov/rules-regulations/staff-guidance/corporation-finance-interpretations-cfis/exchange-act-form-8-k

[E-NIST] NIST. AI Risk Management Framework 1.0, current official resource page. https://airc.nist.gov/airmf-resources/airmf/

Related research and citation

Read the November CEO report for delegated management authority, CFO for benefit qualification, CISO for ending effective authority, and General Counsel for legal allocation and records.

Suggested citation: Newlands, Murray. Board Director AI Governance Report, November 2026, Preview. Open Future Forum. Evidence cutoff 31 October 2026.

Open Future Forum research: https://openfutureforum.com/research/

Editable working tool

Board materiality and assurance record: download the editable CSV worksheet. The worksheet implements the report's recommendation; it is not a validated score, mandatory standard or completed assessment.

November report collection

• Executive AI Leverage Report
• CFO AI Leverage Report
• CEO AI Leverage Report
• CISO AI Leverage Report
• CMO AI Leverage Report
• AI Transformation Report
• AI Leaders AI Leverage Report
• YC Founder AI Report
• VC and CVC AI Investment Report
• Investor AI Report
• Private Equity AI Report
• Investment Banking AI Report
• General Counsel AI Report
• Executive AI Statistics

Share LinkedIn Twitter / X