There's a question moving through boardrooms now, and it isn't "should we use AI." It's the one most CIOs are least prepared to answer:
"If something goes wrong with our AI, would we know before our customers, our regulators, or the press do?"Ask a room of directors that question and watch what happens. Some will point to the CIO. Some will look at the audit committee chair. A surprising number will just go quiet. That silence is the real finding here — not that boards are asking about AI, but that most organizations don't have an answer that survives the follow-up questions.
Boards have moved past curiosity into accountability
For the last two years, board-level AI conversation has mostly meant "are we using this enough." That framing is dead. Directors reporting strong returns from AI are far more likely to keep it on every board agenda — roughly 63% do, according to Protiviti's 2026 Global Board Governance Survey — compared with about 13% among organizations reporting weaker returns. The boards paying closest attention are the ones already seeing results, and that correlation should worry everyone else.
Deloitte's Global Boardroom Program, surveying nearly 700 directors and executives across 56 countries, found that the share of organizations saying AI isn't yet on the board agenda has fallen from 45% to 31% in a single survey cycle. AI is showing up on the agenda faster than most governance functions can build the muscle to answer for it.
That's the gap. NACD's 2025 director survey found 62% of boards now hold regular AI discussions — but only 27% have formally written AI governance into a committee charter. Discussion has outpaced structure. Directors are asking; most organizations haven't yet built the thing that answers back.
The question underneath the question
"Would we know before regulators do" is really three questions stacked together, and a CIO's ability to answer all three — cleanly, with evidence, on the spot — is becoming a proxy for whether the board trusts the whole AI program:
- Do we have a complete list of every AI system in use, including the ones nobody signed off on? Most companies don't. ISS-Corporate's research on S&P 500 disclosures found that while AI risk disclosure surged from 12% to 83% of companies, director-level AI expertise on those same boards barely moved — from 1.5% to 2.7% over the same period. Boards are disclosing exposure to a risk they still don't have the internal fluency to evaluate.
- Do we know which of those systems could actually hurt us, and how badly? Grant Thornton's 2026 AI Impact Survey found that only 11% of business leaders said their board had done all three basics of AI oversight — briefings, established policy expectations, and integrated risk review. Barely one in ten boards clear a fairly low bar.
- Is someone accountable for catching a problem before it becomes a headline, or is everyone assuming someone else has it covered? McKinsey's State of AI research found only 17% of organizations say their board takes direct responsibility for AI governance oversight, and just 28% put that responsibility on the CEO. That leaves a majority of companies where AI oversight technically belongs to everyone, which in practice means it belongs to no one.
Put those three together and you get the real shape of the board's question. It isn't really about AI capability. It's about whether the organization has built an operating system for catching its own blind spots — the same thing boards have expected of finance and cybersecurity for decades, now applied to a much faster-moving risk.
A scenario that's becoming routine
A 900-person logistics company gets a new board member with a fintech background. Three meetings in, she asks the CIO a version of the question above. The CIO has a good answer for the flagship systems — the routing optimization tool, the customer service AI, the demand forecasting model. All reviewed, all documented, all with named owners.
Then she asks about the AI features quietly turned on inside tools the company already pays for — the summarization feature in the CRM, the drafting assistant in the project management tool, the copilot bundled into the productivity suite last quarter's IT renewal auto-enabled. The CIO doesn't have a clean answer, because nobody was tracking those as "AI systems" — they were just software updates. That's not a gap in effort. It's a gap in inventory, and it's the most common way this question catches a CIO flat-footed.
The board doesn't need every organization to have zero shadow AI. It needs to see that someone is actively looking, tracking, and prioritizing — that the absence of a complete list is being treated as an open risk rather than an invisible one.
What a credible answer actually requires
Directors aren't expecting CIOs to eliminate AI risk. NACD's own guidance for boards is explicit that this isn't a request for perfection — it's a request for evidence that someone has built a repeatable process: a current, maintained inventory of every AI system in use; a clear view of which systems carry the most risk and why; a named owner for oversight, rather than a responsibility everyone assumes someone else holds; and a way to show progress over time, not just a point-in-time snapshot before an audit.
That's a different kind of answer than most CIOs currently have on hand, mostly because it depends on infrastructure that doesn't exist yet in most mid-market organizations — a living system of record for AI, not a spreadsheet somebody updates before board season.
This is exactly the layer Evum is built to provide. The Systems Registry gives a CIO a real-time, always-current answer to "what AI do we actually have" instead of a best-guess inventory assembled the week before a board meeting. The Maturity Dashboard turns "are we governing this well" into a specific, trackable score instead of a gut-feel assurance. And the Initiative Portfolio shows the board that gaps aren't just identified — they're being actively closed, with visible ownership and progress. Together, they're the difference between a CIO who has to reconstruct an answer under pressure and one who can pull up the current state of the program live, in the meeting.
If your board hasn't asked this question yet, it will. The organizations in the best position won't be the ones with the fewest AI systems — they'll be the ones who can already answer, clearly and with evidence, when someone finally asks.
See what a board-ready answer looks like: Request a demo