How directors can connect responsible AI, sound management and measurable business results

---

A company can have an AI policy, a growing collection of pilot projects and a busy technology committee, yet still struggle to explain what its AI investments have achieved. For directors, that is the gap worth examining: not simply whether AI is being adopted, but whether it is being managed well enough to earn its place in the business.

Adoption is Moving Faster than the Evidence of Value

PwC’s 29th Global CEO Survey, released in January 2026, offers a useful reality check. Of 4,454 CEOs surveyed across 95 countries and territories, 56% said AI had brought neither higher revenue nor lower costs over the preceding 12 months. Only 12% reported both benefits. Some 30% reported higher revenue and 26% lower costs. These are executives’ reported experiences, not audited calculations of return on investment, but the message is hard to ignore: using AI and benefiting from it are two different things.

PwC also found an association between stronger AI foundations and better reported financial results. These foundations included the ability to integrate AI into business operations, a clear road map and formal arrangements for responsible use and risk management. That does not prove governance alone produces a return. Market conditions, the choice of applications, data and execution all matter. It does suggest that buying a capable tool is only part of the job.

Board practitioner Mr. Chari TVT recently made a related point in his discussion of AI oversight: AI is a boardroom priority, not merely an IT project. His ten principles cover issues directors would recognise—accountability, data readiness, guardrails, audit trails, people, suppliers and return on investment. The principles make sense. The harder part is turning them into decisions and working practices that survive beyond a board presentation.

The Board Sets the Direction; Management Makes it Work

A director does not need to understand the workings of every AI model. The Board does, however, need to know why the organisation is using AI, where the significant risks sit, who is accountable and what evidence will establish success. Those are governance questions. Management has a different task: to put suitable people, processes, approvals, controls and resources in place, then deal with problems when the system does not perform as intended.

This distinction is easy to lose. A Board may approve a comprehensive responsible-AI policy and assume the matter is under control. Meanwhile, a department may start using a purchased AI service without verifying how customer information is handled or who checks important outputs. The policy exists, but the management arrangements have not caught up.

Two international standards help explain the link. ISO/IEC 38507:2022 gives governing bodies guidance on the implications of AI use. ISO/IEC 42001:2023 specifies requirements for an AI Management System, or AIMS: the organisational arrangements for establishing policy and objectives, managing risks, operating controls, evaluating results and making improvements. They address different responsibilities and can be used together. Neither removes the need for sound judgement.

Figure 1 shows the relationship I believe directors should keep in view. Board oversight leads to management discipline; that discipline is reflected in day-to-day AI use; and the organisation tests the outcome through performance measures and independent challenge. Value is the intended result—not an automatic consequence of having a policy or adopting a standard.

Begin with a Problem Worth Solving

A good AI proposal should be able to answer one simple question: what will be better in the business if this works? Too often the discussion begins with a demonstration of what the software can do. The business case comes later, and is sometimes little more than a list of possible benefits.

Take a manufacturer struggling with unplanned equipment breakdowns. Predictive-maintenance AI may be able to detect patterns before a machine fails. That sounds attractive, but a Board should expect more than a forecast. What is the current cost of downtime? Is the sensor data reliable? Who will decide whether to shut down a machine after an alert? What happens when a warning is wrong? How much will installation, integration, engineering time and ongoing monitoring cost?

Unless those questions are settled, a technically successful pilot may have little effect on production. The value comes when a useful prediction leads to a better decision, a changed maintenance process and fewer losses. The same thinking applies to AI in procurement, customer service, financial forecasting and quality inspection.

I would expect material proposals to have a named business owner, a baseline, a realistic benefit estimate, an assessment of principal risks and a date for deciding whether to continue, change course or stop. A proof of concept should be treated as a test of the case, not as evidence that the investment has paid for itself.

Responsibility Belongs Inside the Workflow

Responsible AI is often described in familiar terms: fairness, transparency, privacy, security and human oversight. These are reasonable expectations, but they mean little unless someone has worked out how they will be met in practice.

Consider an employer using AI to help screen job applications. An instruction to “avoid bias” will not tell the recruitment team whether the input data are suitable, what tests should be carried out, which decisions require human review or how applicants can challenge an outcome. Those matters need procedures, competent staff and records. They also need an owner with authority to intervene when something appears wrong.

The controls should be proportionate to the consequences of failure. AI used to prepare an initial draft of an internal newsletter does not call for the same level of scrutiny as AI influencing credit decisions, patient care or industrial safety. Human oversight is only useful when the reviewer understands the task, has adequate information and can reject the AI output. A nominal sign-off at the end of a fully automated process is not much of a safeguard.

There is a supplier dimension as well. Many organisations use AI embedded in software they have already bought. Procurement and contract reviews should address how data are used, what testing the supplier performs, who is notified of an incident and how the organisation can leave the service if necessary. A sensible starting point is an inventory of significant AI applications, including those acquired by individual departments.

This is where a management-system approach helps. ISO/IEC 42001 uses the Plan–Do–Check–Act cycle: establish objectives and controls, put them to work, check how they perform and correct what is not working. The discipline should sit within ordinary management activities wherever possible, rather than create another committee and another set of forms for their own sake.

One Dashboard for Bbenefits and Risks

Boards are sometimes given separate reports: one showing the number of AI projects completed, and another listing compliance matters. Neither tells the whole story. For the important applications, value and responsible use should appear in the same report.

Imagine an AI-assisted contact centre. Management might report a reduction in handling time and more enquiries resolved per employee. Useful, certainly. But the Board should also see whether customers received accurate answers, whether complaints rose, how often staff had to correct the system and whether confidential information was exposed. Faster service is not an improvement if customers are repeatedly given incorrect advice.

Financial reporting needs equal care. Time saved by employees is not necessarily cash saved. If people use the released hours for other work, that may be a genuine productivity gain, but it should be described as increased capacity unless a financial effect can be demonstrated. Licensing, integration, data preparation, training, supervision and remedial work belong in the cost calculation. So does the cost of errors.

Targets should reflect the use case, its risks and the organisation’s starting point. There is no single acceptable accuracy rate for every AI system. What matters is whether management can show the baseline, the intended improvement, the result achieved and the consequences of mistakes. That is a much stronger basis for investment decisions than an impressive adoption figure.

Evidence matters more than reassurance

Management remains responsible for operating AI systems and their controls. Risk and compliance functions can provide challenge, while internal audit can independently examine whether the arrangements are designed properly and are working as described. ISO 19011:2026 offers guidance on auditing management systems, including audit programmes, audit conduct and auditor competence.

For an AI-assisted credit assessment system, for example, an internal audit might ask whether the use case was approved, changes were controlled, sensitive information was protected and exceptions received meaningful review. It should also ask whether the performance figures presented to management can be traced to reliable records. These are practical assurance questions, not an invitation for auditors to become data scientists overnight.

The findings should lead somewhere. If an application does not deliver its intended benefit, management should investigate why. If risks exceed agreed limits, it should strengthen controls, restrict use or suspend the system. ISO/IEC 42001 certification, where an organisation pursues it, can provide evidence about its management-system arrangements. It does not certify a return on investment and should never be presented as doing so.

What Should Go on the Next Board Agenda?

There is no need to start with an expensive, organisation-wide programme. I would begin by asking management for a short register of the organisation’s most significant AI uses. For each one, the Board should be able to see the business owner, the reason for using AI, the main risks, the approved controls, the financial case and the latest evidence of results. That exercise often reveals more than a lengthy strategy presentation.

From there, directors can agree what merits regular reporting, what should be escalated and where independent review would be most useful. Seven questions are enough to start a productive discussion:

01 | What business outcome is this AI application intended to improve, and what is the starting point?

02 | Who is accountable for the result, and who can change or stop the application?

03 | What could go wrong, who might be affected, and how would we find out?

04 | Are the data, staff, suppliers and existing processes fit for the intended use?

05 | What benefit has actually been achieved after all relevant costs are included?

06 | What evidence supports management’s claims about performance and controls?

07 | What would justify expanding, redesigning or retiring this application?

The Point of Governance

The Board’s role is not to approve every algorithm or supervise every experiment. It is to ensure that management chooses worthwhile uses of AI, understands the consequences, puts suitable controls in place and reports candidly on results. If a project is failing, that candour matters just as much as a success story.

Governance is visible in the decisions an organisation makes: which applications it backs, which risks it will not accept, what it measures, and when it is willing to change course. A management system gives those decisions a dependable way of reaching the people who must act on them. Performance evidence tells directors whether the arrangement is working.

A Board should not judge its AI governance by the number of policies adopted or pilots launched. The better test is whether responsible AI use is becoming part of normal business practice—and whether the results are worth the investment.

The article was written by Amargit Singh.

Photo by Galina Nelyubova on Unsplash.