How boards can strengthen AI oversight and governance

Despite the opportunities, many boards are now wary of the rising governance and security risks posed by shadow AI.

Presented by Nasdaq

Artificial intelligence is now widely regarded as a board-level concern. Not only as a driver of productivity and insight, but as a growing governance and security risk. Boards across Australia are increasingly expected to oversee how AI is used across the enterprise – and the gap between adoption and oversight is where risk is beginning to concentrate.

One of the most consequential developments is the rise of shadow AI where such tools are used outside approved systems and governance frameworks. In practice, it often looks harmless. For example, a scenario may include a director pasting draft disclosures into a public AI tool to refine language, or summarising papers ahead of a meeting. These actions are typically driven by time pressure and efficiency, not by any intent to breach policy.

The issue is the sensitivity of confidential board information. Once information leaves a governed environment, organisations and directors lose visibility over where data is stored, how it is retained and whether it may be reused to train external models.

IBM’s 2025 Cost of a Data Breach report found that 13 per cent of organisations have experienced breaches involving AI systems, with 97 per cent of those affected lacking proper AI access controls. In addition, 60 per cent of AI-related incidents resulted in compromised data, with nearly one-third leading to operational disruption. IBM links ungoverned systems to a higher likelihood of breach risk and higher costs.