Key findings
Clear executive accountability is the foundation of AI oversight. Boards should expect one named executive to be answerable for AI risk across the organisation.
High confidenceAn inventory of AI systems, including AI features embedded in vendor products, is a prerequisite for any credible oversight.
High confidenceIncident response plans rarely cover AI-specific failure modes such as harmful outputs, prompt injection or data leakage through AI tools.
Moderate confidenceRecognised frameworks such as the NIST AI RMF and ISO/IEC 42001 give boards a structure for oversight without requiring technical depth.
High confidence
Context
Generative AI is being adopted faster than most organisations can govern it. Employees use public tools, vendors embed AI features into existing software, and business units build their own applications. Boards are increasingly asked, by regulators, investors and customers, how they oversee these risks.
What we recommend
- Name one executive accountable for AI risk and set a regular reporting rhythm to the board or its risk committee.
- Require an inventory of AI systems in use, classified by risk.
- Approve an AI use policy covering data, human oversight, testing and acceptable use of public tools.
- Ask for AI-specific scenarios in incident response plans and exercises.
- Review how AI use affects obligations under existing law, including the DPDP Act, and in overseas markets such as the EU.
References
- National Institute of Standards and Technology. AI Risk Management Framework (AI RMF 1.0). January 2023.
- National Institute of Standards and Technology. NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. July 2024.
- International Organization for Standardization. ISO/IEC 42001:2023, Artificial intelligence: Management system. December 2023.
- European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act).
- OWASP Foundation. OWASP Top 10 for Large Language Model Applications, 2025 edition.
How we reached these conclusions
This brief draws on 5 published regulations, standards and frameworks, listed in the references, applied through Krynthnode analysis. Vendor claims are never counted as evidence on their own. Each finding is graded in the Krynthnode confidence ledger, described on our methodology page, and the whole brief is due for review by 30 September 2026.