AI governance is a board problem now

For the last two years, AI governance sat with whoever bought the tool. A marketing team adopted a copywriting model, an engineering team wired an API into a product, and the paperwork followed later if it followed at all.

That era is ending. The EU AI Act's obligations are landing in stages, UK regulators are publishing sector guidance, and insurers have started asking about AI use in renewal questionnaires. When a customer, a regulator and an underwriter all ask the same question, it has become a board question.

The uncomfortable part is that most boards cannot yet answer it. Not because they are careless, but because nobody has drawn the map: which systems use AI, what decisions those systems touch, and who signs off when one of them is wrong.

The fix is not a hundred-page policy. It starts with an inventory a single page long, an owner for each entry, and a standing agenda item that keeps the picture current. Boards that do this now will find the regulation manageable. Boards that wait will meet it in the incident report.

This is the kind of work the club's lunches exist for: leaders comparing real inventories, real sign-off chains and real board papers, off the record.