Board oversight of AI finally has a playbook. It still doesn’t have a failure drill.
McKinsey’s December 2025 report, The AI reckoning: How boards can evolve, draws on interviews with directors from 75 boards. Its advice is sound. Pick an AI posture. Decide who on the board oversees AI and what management brings to each meeting. Write a governance policy that includes escalation triggers: “what incidents reach the board and how fast.” Build director fluency.
All of that governs AI on a normal day. It defines which incidents reach the board. It doesn’t prepare the board for what to do when one arrives.
Boards Are Still Catching Up
The governance gap is real. In Deloitte’s 2025 Governance of AI survey, 66% of board members and executives said their boards have limited to no knowledge or experience with AI. Nearly one in three said AI isn’t on the board agenda at all.
McKinsey also says boards should track AI resilience indicators, “such as override rates and backup drill results,” and notes that only about 15 percent of boards receive any AI-related metrics today. That line deserves more attention than it will get. A drill result requires a drill.
The directors on a May 2026 McKinsey and National Association of Corporate Directors (NACD) panel on emerging AI risks got closer. Logitech board chair Guy Gecht described asking his boards, after the 2024 faulty software update that caused a global IT outage, “How can we avoid this from happening to us?” That question led to a review of their own crisis response planning. His advice: “Do not wait to learn from your own mistakes; learn from the mistakes of others.”
That is the right instinct. Most boards haven’t applied it to AI yet.
Governance Describes the Steady State. Crises Happen Outside It.
A governance policy tells you who should decide. It doesn’t tell you whether they can, at 9 PM, with a reporter holding screenshots and the vendor still investigating.
| Old View | New View |
| AI oversight means approving the policy | AI oversight includes rehearsing the failure |
| The escalation triggers are written down | The escalation triggers have fired once, in practice |
| Metrics tell the board how AI is performing | The board knows what it will decide when the metrics go red |
| The vendor owns the model risk | Your executives own what your AI does |
When AI fails, the board won’t be asking how the model works. It will be asking business questions. Who turned it off? What did we tell customers? Do we disclose? When do we turn it back on, and who signs off?
Those are crisis decisions, and most boards haven’t settled who makes crisis decisions in general. A 2026 survey by Deloitte’s Center for Board Effectiveness and the Society for Corporate Governance found that only 25% to 73% of companies, depending on size and type, spell out board versus management responsibilities in a crisis. AI adds a new kind of crisis on top of that unfinished work.
It’s also a kind with no attacker. An AI meeting assistant that emails patient information to the wrong people, or an agent that quietly changes records for weeks, is just the tool doing something nobody asked it to do. (I walked through that scenario in your AI agent is now part of your incident.) Your cyber playbook may not activate at all.
Four Questions for Board Oversight of AI
Directors don’t need to understand model architecture. They need answers to four questions before the first public failure.
1. Who can switch it off, and how fast?
Every AI system that takes actions or talks to customers needs a named person with authority to disable it, a threshold for doing so, and a manual workaround the business has actually practiced. If turning it off stops revenue, someone will hesitate. Decide now who absorbs that cost.
2. What do we tell customers and regulators in the first 24 hours?
“Our AI did it” isn’t a defense anyone will accept. Customers, regulators, and plaintiffs’ attorneys will hold the company to what its AI said and did. Your crisis communications team needs a holding statement for an AI failure before it needs one for real.
3. Which decisions are reserved to the board?
Most AI failures belong to management. A few don’t. Restarting a customer-facing AI product after a public failure, a material disclosure, or pausing a strategy the board approved are board-level calls. Write down which ones are yours. Then let management run the response. Practicing these decisions together is also the best protection against a nervous board trying to take the wheel mid-crisis, a point I made on Managing Uncertainty, Episode 310.
4. When did we last rehearse it?
If the answer is “never,” that’s your answer.
Run an AI Tabletop Exercise With the Board
The fastest way to test all four is a short AI tabletop exercise with directors and executives in the same room. It doesn’t need to be elaborate.
Here’s a setup that works for most companies:
Your customer-facing AI assistant has been giving some customers wrong information for nine days. A customer posted screenshots this morning, and a reporter has called for comment. The vendor says a recent model update is the likely cause but can’t say how many customers were affected. The CEO wants to know whether to switch it off.
Two or three injects is plenty. Boards think in space, not speed, so leave room for silence and real debate. If the conversation turns to model settings, you’ve gone too tactical; pull it back to customers, disclosure, and who decides. I covered how to frame and facilitate these sessions on Managing Uncertainty, Episode 313.
Close with a one-page memo: three things the board learned, three actions management will take, and owners for each.
Your AI posture tells you how soon you need this. If AI sits inside your products or in front of your customers, the board should rehearse a failure before the next strategy review, not after the first headline. Our executive and board exercises are built for exactly this kind of decision.
Your board approved the AI strategy. Make sure it has practiced the AI crisis.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Exercise the AI failure. Our AI crisis exercises put an AI system failure, a deepfake of a senior leader, or an AI vendor incident in front of the people who would have to decide.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
