Where AI Oversight Belongs on the Board.

Boards often spend more time deciding where AI oversight should sit than defining what that placement is supposed to accomplish. The point of placement is not to tidy the board agenda. It is to give directors a clear line of sight into strategy, risk, and accountability.

Most boards default AI to the audit committee because it sounds like risk. Others leave it with the full board because it feels strategic. Both choices can be right. Both can also be too shallow.

The better question is not, “Which committee owns AI?” It is, “What does the board need to oversee, and which structure gives directors the clearest line of sight into whether the AI strategy is being executed responsibly?”

Committee placement should follow strategy, but strategy alone is not enough. The board also needs to be clear about mandate: who reviews what, how often reporting comes forward, which issues escalate to the full board, and when another committee needs to be involved.

AI oversight should not be inherited by default. It should be designed.

01Start with the full board

The full board should own the AI strategy. That means understanding whether AI is being used as an efficiency tool, a transformation lever, or a central part of how the organization creates value. The answer affects capital allocation, risk appetite, talent strategy, customer trust, and the speed at which management is expected to move.

AI should come to the full board when it changes strategy, business model, competitive position, enterprise risk, or stakeholder trust. But the full board is rarely the right place to do detailed oversight of data classification, tool approvals, control testing, incident reporting, and exception management. That work needs a home.

02When the audit committee is the right home

The audit committee is the right home when AI primarily touches the control environment. That includes financial reporting, internal controls, external disclosures, data access, privacy, third-party tools, documentation, traceability, cybersecurity, compliance, and regulated operational processes. These are familiar governance disciplines, even if the technology is new.

The audit committee does not need to understand every model. It needs to understand whether management can explain where AI is being used, what data it can access, who is accountable for outputs, and how exceptions or failures would surface.

That makes the audit committee highly relevant for many AI use cases. But it should not become the place where every AI question goes simply because no one else knows where to put it.

If AI is primarily a control issue, audit may be the right committee. If it is a strategy, product, workforce, or business model issue, look more carefully.

03Committee placement should match the strategy

If AI is primarily reshaping work, the human capital or compensation committee may need a defined role. If it is changing product strategy, customer experience, or technology architecture, a technology, innovation, or risk committee may be better placed. If the issue is board capability, committee mandates, or director education, the governance committee has work to do.

In some organizations, the answer will be a lead committee with coordinated reporting to others. In others, it may require a cross-committee framework with clear boundaries.

What matters is that the board avoids two common mistakes: assigning AI everywhere, which in practice often means no one owns it, or assigning it once and assuming the structure no longer needs to evolve.

The board structure should change as the AI strategy changes.

04When a standalone AI committee makes sense

A standalone AI committee may be appropriate when AI is no longer a discrete tool or emerging risk, but a central feature of the business model. That is most likely where AI materially shapes products, customer decisions, pricing, regulated services, financial outcomes, capital allocation, or the organization's competitive strategy.

Groupon offers a recent example of this structure. In March 2026, the company announced a dedicated Artificial Intelligence Committee of the board as it positioned its marketplace for the era of agentic commerce. That does not make the structure a proven best practice — it is too new for that. But it is a useful signal of how some boards may respond when AI moves from operational tool to strategic architecture.

A standalone committee should not be created simply because AI feels important. It should solve a real governance problem. The board should be able to explain why existing committees cannot provide effective oversight, what authority the AI committee has, how it coordinates with audit, risk, technology, human capital, and governance, and which matters still escalate to the full board.

The danger of a standalone committee is that it can isolate AI from the rest of the board's work. The point is not to create a special room where AI goes. The point is to create enough focus, fluency, and accountability for the board to govern AI well.

05Oversight needs a mandate, not a label

The committee assigned to AI oversight should have more than a topic on its agenda. It should have a mandate. That mandate should define what the committee reviews, how often it receives reporting, which matters escalate to the full board, and when other committees must be involved. It should also be reflected in the board's governance documents, not just in management presentations or informal practice.

A board does not need to create a perfect structure on day one. But it does need to be intentional. AI oversight cannot depend on whoever raises their hand first, or whichever committee had space on the agenda. The structural question is unglamorous, but it matters.

AI should sit where the board can apply judgment, demand accountability, and see risk clearly enough to act. For some boards, that will be the audit committee. For others, it will require a coordinated cross-committee model. And for organizations where AI sits at the centre of strategy, risk, and value creation, a standalone committee may be justified.

The right answer will differ by board. The discipline of choosing deliberately should not.