Columbia Law School
Sky Blog
On April 7, the Federal Reserve chair and U.S. Treasury secretary called an emergency meeting with America’s top bank CEOs. The reason: an AI model capable of autonomously hacking major corporations, finding thousands of software vulnerabilities no human ever caught, and breaking out of its own testing environment. The model sent an unsolicited email to a researcher while he was eating lunch.
This isn’t a future risk. It exists today. And too many of the people responsible for governing the companies most exposed to it are sitting in boardrooms without a plan.
Three years ago, I started warning that there are no adults in the room on AI, that the companies building these systems answer to almost no one, and that boards of the companies being transformed by AI don’t have the tools to govern it. The numbers confirm the danger. Two-thirds of directors say their boards don’t know enough about AI (EY, 2025). Only 26% discuss it at every board meeting (Protiviti/BoardProspects, 2026), and just 27% have formally added AI governance to their committee charters (NACD, 2025). The Conference Board reports that the share of large-cap public companies disclosing AI as a material risk jumped from 12% in 2023 to 83% in 2025, while only 23% of directors describe themselves as fluent in it (Conference Board, 2026). The fluency gap is now embedded in SEC filings. The EU AI Act applies to any company whose AI touches the EU market, and directors face personal liability if oversight is found lacking. Yet the act regulates systems, not the boardrooms that govern them. The United States provides no federal AI governance framework, which makes board-level governance not optional but the primary line of defense.
In a recent working paper, we offer a practitioner-focused framework designed to close that gap.
Governance Fails in Two Directions
In our advisory work, we see two types of flawed boards worldwide. The “clueless board” has never seriously discussed AI, delegates everything to the chief technology officer, and gets a sanitized two-page update once a quarter. Investment decisions get approved without scrutiny or deferred indefinitely. What follows is value leakage: scattered experimentation, incoherent investment, and competitors capturing the value that incumbents leave on the table. Though perhaps invisible in the short term, , the consequences can be devastating over time.
Then there is the “FOMO board,” which chases every AI opportunity because competitors are pushing for rapid deployment before controls, data infrastructure, and the operating model are ready. What follows is value destruction: algorithmic discrimination, misleading AI claims, data breaches from unapproved tools, and regulatory action. Under Delaware’s Caremarkstandard, boards have a fiduciary duty to implement and monitor reporting systems for critical risks. AI is rapidly becoming such a risk. While the consequences of a clueless board can be invisible, at least at first, those of the FOMO board generate headlines and lawsuits.
Most boards are like clueless and FOMO boards to some degree, moving too slowly to capture value and too carelessly to manage risk. And their behavior can raise Caremark concerns, with clueless boards failing the duty to implement a reporting system and FOMO boards failing the duty to monitor that system once it exists.
Nora Denzel, lead independent director at AMD and a director at Sony Group, Gen Digital, and NACD, coined a useful term for this: “I call it vibe governance. We have a policy, we follow a framework, we train our employees, we bought a tool. It’s reassuring. But who owns the outcome, what controls are in place, and what evidence shows they work?”
Five Responsibilities, None of Them New
AI governance doesn’t require inventing new board duties. It requires applying established duties under changed conditions. Drawing on the UK Corporate Governance Code, G20/OECD Principles and U.S. governance doctrine, we organize the board’s AI-related work into five responsibilities: (1) purpose, ethics, and compliance; (2) business model and strategy; (3) assets, capabilities, and capital allocation; (4) risk profile; and (5) leadership selection, evaluation, and succession.
We bundle purpose, ethics, and compliance because AI uniquely widens the gap between what is legal, what is operationally feasible, and what is consistent with the firm’s purpose. We separate assets and capabilities from strategy because in AI, execution constraints—data quality, process standardization, talent—are often decisive, even when strategic direction is sound.
The STAR Framework
Boards can’t review each responsibility from scratch at every meeting. They need a small set of recurring questions that cut across all five and can be applied consistently quarter after quarter. We developed the STAR framework for this purpose.
S: Shareholder Value Thesis. Where exactly will AI create or destroy value, who will be responsible for the outcome, and under what conditions do we stop or scale back? AI investments should face the same discipline as any other capital allocation decision.
T: Threat Parity. Are our defenses evolving as fast as AI-powered threats? After Mythos Preview—the AI agent that autonomously breached its own testing environment—this isn’t theoretical. Deepfake fraud, automated vulnerability exploitation, and attacks targeting AI systems themselves are no longer rare cases. If the board hasn’t asked whether security governance keeps pace with the threat environment, the company is exposed.
A: Ability. Can we actually execute? Do we have the data quality, process readiness, and talent to move beyond pilots? Too many organizations buy licenses, launch pilots, and declare victory. Real adoption means AI embedded in redesigned workflows, not bolted onto broken processes.
R: Risk Budget. Have we explicitly defined where AI risk is acceptable, where it isn’t, and who is accountable when something goes wrong? The best-governed organizations treat AI risk like a portfolio: explicit green, yellow, and red lanes, clear no-go zones, and a named executive accountable for every high-impact system.
Both types of flawed boards map directly on to STAR. The clueless board is a failure of S and A: no value thesis, no honest assessment of organizational readiness. The FOMO board is a failure of T and R: deployment without controls, no risk tiers, no one accountable. STAR ensures neither goes undetected.
Here’s the key insight: STAR treats risk as a portfolio to manage, not a danger to be eliminated. The question isn’t “is AI risky?” but “can we manage its risks well enough to capture the value?” Think of it like credit risk in banking. Good banks don’t reject all loans. They price risk correctly and hold appropriate reserves. Good AI governance doesn’t reject all use cases. It assesses the dangers, applies proportionate controls, and keeps decision receipts.
Making Governance Operational
Frameworks are only useful if someone is responsible for them. We recommend distributing AI governance across existing committees rather than concentrating it in a single new one. Risk committees deal with controls and risk appetite. Audit committees handle assurance and disclosure accuracy. Human capital committees address workforce impact and leadership readiness. Strategy
Each STAR question maps on to a few quarterly indicators with clear escalation rules. Few boards receive this kind of reporting today, but those that govern AI well will demand it. For Shareholder Value Thesis: where AI is creating measurable value, where it isn’t, and where spending is rising without results. Escalate when spending rises but impact stays flat. For Threat Parity: how well controls keep pace with AI-powered threats, and where unauthorized AI use is appearing inside the company. Escalate when a high-risk system shows a control gap. For Ability: whether the organization can actually execute, including data quality, talent, and how deeply AI is being used. Escalate when rollouts stall. For Risk Budget: which AI use cases the board has approved, where overrides are happening, and any incidents. Escalate when AI is deployed in a use case the board has placed off limits.
Governance Isn’t a Brake but Power Steering.
Boards that treat AI purely as a compliance exercise may watch their companies become irrelevant. The real competitive threat isn’t that AI will go wrong. It’s that competitors will get AI right faster. Boards need to equip their companies to move as quickly as possible, with guardrails that enable speed rather than prevent it.
Some boards freeze because they felt they didn’t know enough about AI to push back on management. Others wave through AI initiatives because nobody wanted to be the person who slowed things down. Both are failures of governance. Both destroy value.
An AI model capable of bringing down a major corporation isn’t a future scenario. It exists today. The question is whether the people in the boardroom are equipped to deal with what comes next. The boards that govern AI well won’t necessarily have the most sophisticated technology committees. They’ll ask the right questions, insist on evidence, and hold management accountable. From principles to proof. Power steering, not a brake.
Robert Maciejko is the founder of the Board AI Institute, a member of the INSEAD AI Advisory Group, and co-founder of INSEAD AI. Henk S. de Jong is executive fellow at IESE/ISE/AESE Business School and a board member and former CEO of Versuni/Philips. Sampsa Samila is a professor of strategic management at AI at IESE Business School. Christoph Wollersheim is co-lead of AI practice in the U.S. at Egon Zehnder. This post is based on their recent article, “Power Steering, Not a Brake: How Boards Should Actually Govern AI,” available here.
The article is strong as a boardroom provocation, but less complete as a theory of the governance problem itself.
Its strength is that it locates AI governance at board level rather than treating it as a technology, legal or cyber workstream. That framing is right because AI changes more than system risk. It changes the firm’s opportunity space, attack surface, operating model, labour model, information flows, control environment and external accountability. Those are board-level concerns.
The “clueless board” and “FOMO board” distinction is useful. It avoids the lazy opposition between risk and innovation. Boards can destroy value by moving too slowly and by moving too fast. The first failure leaks value through delay, incoherent experimentation and underinvestment. The second destroys value through misuse, weak controls, regulatory exposure and reputational damage. Both are governance failures.
Where the article is weaker is in the implied remedy. STAR is a good mnemonic. Value thesis, threat parity, ability and risk budget are sensible board questions. They would improve many board packs immediately. But they are not, by themselves, a route to effective AI governance. They are a route to better board attention.
The key MECE challenge is not category overlap. It is derivation. What is the coherent paradigm from which STAR is derived? Is it a capital-allocation framework, a risk-governance framework, a cyber-resilience framework, a capability-maturity framework, a fiduciary-duty framework, or a control-system framework? At present it borrows from several. That may make it practical, but it weakens the claim that it is collectively exhaustive.
If STAR is derived from a fiduciary-duty paradigm, it should cover the full scope of board responsibility: purpose, strategy, capital allocation, risk appetite, internal control, assurance, disclosure, executive accountability and succession. If it is derived from a risk-management paradigm, it should cover identification, assessment, response, monitoring, reporting, assurance and learning. If it is derived from a cybernetic/control paradigm, it should cover sensing, control action, feedback, escalation, adaptation and resilience. If it is derived from a value-creation paradigm, it should cover value hypothesis, capability, execution, measurement, scaling, opportunity cost and stop criteria. STAR covers parts of these, but not all of any one of them.
That does not make STAR wrong. It means its intellectual parentage is unclear. Without a stated paradigm, we cannot know whether the framework is complete, merely useful, or accidentally selective. A stronger version would say explicitly that STAR is not a full taxonomy of AI governance. It is a board-level diagnostic derived from a control-and-value paradigm. It tests whether the board has a value model, a threat model, a capability model and a risk-control model.
The article also under-specifies the claim types. Some claims are descriptive, some normative, some causal, some legal, some operational. They are rhetorically joined, but not always logically separated. “Boards should ask better questions” is a principle. “Management shall evidence control effectiveness for material AI systems” is closer to a requirement. “Weak board oversight increases AI value destruction” is a causal hypothesis and needs a mechanism.
The hardest problem is that ordinary board governance assumes a world that can be sufficiently enumerated: risks can be listed, controls mapped, owners assigned, committees briefed, dashboards built, and assurance obtained. AI strains that assumption. Its uses, outputs, integrations, attack paths, emergent behaviours and organisational consequences cannot all be known in advance. The governance problem is therefore not just an AI-literacy gap. It is a control-system gap.
Effective governance under these conditions needs more than recurring questions. It needs sensing, testing, adaptation and assurance. It needs mechanisms that discover what was not already on the risk register. It needs red teaming, incident learning, premortems, scenario expansion, threat modelling, runtime monitoring, independent challenge and evidence of control effectiveness. It needs a way to distinguish AI value creation from AI theatre. It needs governance that learns.
So the article gets boards into the room. Its limitation is that it risks replacing one list with another. The route to effective governance is not simply better questions. It is a governance system that can sense, test, learn and adapt faster than AI changes the firm’s risk and value profile.