The Part of AI Governance You Cannot Delegate to AI
Exploring this for your team? Talk to CrmWare →
Boards are debating what to delegate to AI and taking AI off the agenda
More than four in five boards — 84% — are debating which decisions should remain human-led versus AI-led.[1] The delegation question is already live in the boardroom. Board attention, meanwhile, is moving the other way: a majority of directors report their boards place only some or limited focus on disruption from emerging technologies such as AI.[2] Deloitte's global boardroom survey points the same direction on a different measure: in an independent sample, 31% of its respondents say AI is not on the board agenda at all.
The combination produces a specific failure: delegation by default. No board resolves to hand judgment to AI. The AI-assisted reporting stack absorbs a little more synthesis each quarter, what reaches the board thins, and the human-led-versus-AI-led question gets answered by drift rather than decision. Directors already know what unexamined process costs: 86% say board processes have contributed to a delayed, rushed or poor decision in the past six months.[1]
What AI cannot do: judgment under irreducible uncertainty
"The problem isn't automation, it's uncertainty."[3]
That is Richard Seiersen — chief risk officer at Qualys and co-author, with Douglas Hubbard, of How to Measure Anything in Cybersecurity Risk, a programme for quantifying uncertainty through calibrated estimates and Bayesian methods.[4] His line is a practitioner's method judgment, not a theorem, and it draws the boundary that matters here. Where historical data binds the future — monitoring known risks, synthesising reports, flagging anomalies — AI is excellent, and boards should let it absorb that work. Where history does not bind the future — an unprecedented technology shift, a novel strategic bet, the adequacy of the company's own oversight — AI trained on that history offers limited guidance. "Using AI based on previous data to manage future risk is not going to make the huge difference that some might think," Seiersen says; what regains importance, on his forecast, is "expert judgment and structured forecasting".[3]
Cross that boundary with a second question — is the decision assigned to the board's own judgment? — and the undelegable set falls out: decisions under irreducible uncertainty that the law expects the board to make itself.
The oversight duty is already the board's
That second question is not rhetoric. Across three decades and three jurisdictions, the duty to judge the adequacy of oversight sits with the board itself.
The spine starts in Delaware. Caremark (1996) makes it the board's own task to exercise "a good faith judgment that the corporation's information and reporting system is in concept and design adequate".[5] Marchand (2019) sharpened the requirement: the board must try "to put in place a reasonable board-level system of monitoring and reporting" — management-level reporting that never reached the board did not satisfy the duty.[6]
The UK Corporate Governance Code assigns risk appetite the same way: the board itself determines the nature and extent of the principal risks the company is willing to take, and from January 2026 reporting periods it must declare the effectiveness of its material controls in the annual report.[7] The EU AI Act adds the operational floor for high-risk systems: oversight by people who understand the system's limits, stay alert to over-reliance on its output, and can override, reverse or interrupt it.[8]
The newest statute makes the point by omission. California's SB 53 requires large frontier developers to publish the "internal governance practices" that ensure their risk processes are implemented — and names no board, no committee, no corporate organ.[9] The law forces governance decisions someone senior must own, and leaves the assignment question open. Deciding who owns that judgment is itself judgment under irreducible uncertainty — the one decision no reporting stack can make for you.
Name the undelegable set — then allocate board judgment to it
The practical move treats board time as the scarcest governance resource the company holds. Boards are already debating which decisions should remain human-led;[1] the discipline is making that debate produce a named list. Name what this board will not delegate — to AI or to anyone: risk appetite for AI itself, the deploy-or-not judgments SB 53 forces someone senior to own,[9] the adequacy of the oversight system, and the assignment question itself. Spend board judgment there, and nowhere else.
Everything outside that set can be delegated — on condition of visibility. For each governance task handed to the reporting stack or a supplier, the board demands the four operational levers that define owning a digital workforce: suspend, audit, evaluate, change. Undelegability is the apex of the same arc — own the capability, don't rent the dependency — applied to the board's own work.
The other limb of the thesis we state plainly. We predict that boards which name their undelegable set will outperform boards that delegate by default. That is a falsifiable prediction, not a research finding. We have not seen the study. If you have it, we want to see it.
References
[1] Board Intelligence. Board decision-making under pressure as AI forces leaders into higher-stakes choices (Board Value Index summer 2026 global press release). 2026. https://www.boardintelligence.com/blog/board-value-index-summer-2026-global-press-release
[2] Board Intelligence. Board Intelligence Releases Second Edition of the Board Value Index (press release, GlobeNewswire). 2025. https://www.globenewswire.com/news-release/2025/12/09/3202654/0/en/Board-Intelligence-Releases-Second-Edition-of-the-Board-Value-Index.html
[3] Governance Intelligence. How AI will redefine compliance, risk and governance in 2026 (Natalie Bannerman, 2026-01-05). 2026. https://www.governance-intelligence.com/regulatory-compliance/how-ai-will-redefine-compliance-risk-and-governance-2026
[4] Wiley. How to Measure Anything in Cybersecurity Risk, 2nd Edition (Douglas W. Hubbard & Richard Seiersen). 2023. https://www.wiley.com/en-us/shop/general-introductory-business-management/how-to-measure-anything-in-cybersecurity-risk-2nd-edition-p-9781119892304
[5] Delaware Court of Chancery. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996) (Allen, C.). 1996. https://scholar.google.com/scholar_case?case=14782220911008163269
[6] Delaware Supreme Court. Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). 2019. https://scholar.google.com/scholar_case?case=11357134939420858969
[7] Financial Reporting Council. UK Corporate Governance Code 2024. 2024. https://media.frc.org.uk/documents/UK_Corporate_Governance_Code_2024_a2hmQmY.pdf
[8] European Commission. AI Act Service Desk — Article 14: Human oversight. 2024. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14
[9] California Legislature. SB-53 Artificial intelligence models: large developers (Transparency in Frontier Artificial Intelligence Act) — chaptered bill text. 2025. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53