The Most Dangerous AI User in Your Company May Be on Your Board

A company director could spend a board meeting discussing confidential business plans, then upload those same documents into a public artificial intelligence (AI) tool without fully understanding what happens to the information afterwards. It is the kind of contradiction that is worrying corporate governance experts as businesses rush to adopt AI.

At Constellation Research’s Connected Enterprise 2026 summit, business leaders warned that many company boards are struggling to keep pace with the technology they are encouraging their organisations to embrace. While executives are under pressure to demonstrate that their businesses are not being left behind, questions about data security, accountability and oversight are receiving less attention than they should.

The concern is that companies could be giving AI systems access to sensitive information and important business functions before establishing who is responsible when those systems make costly mistakes.

Lara Druyan, general partner at Private Liquidity Partners, described the situation as a form of boardroom neurosis, with directors caught between the fear of missing out and the fear of getting AI adoption wrong. She also highlighted the mismatch between the speed of the technology and the way boards operate.

“What’s happening with AI is at machine scale and board meetings happen quarterly with snacks,” Druyan said.

The comment captures a problem facing businesses across industries. Directors may only meet a few times a year to review major decisions, but AI systems can process information and execute tasks continuously. By the time a board discusses an issue, an automated system may already have made decisions affecting company finances, customer information or daily operations

The problem is made worse by the experience gap within some boards. Kaylan Adams, principal for Board and CEO Services at Korn Ferry, said many boards were historically populated by retired executives who may not have kept up with developments in technology.

“Because of that, it means that they do not have the relevancy, the currency of what’s happening today,” Adams said.

This does not mean every director needs to become a software engineer. It does mean that people responsible for overseeing a company should understand enough to question where AI is being used, what information it can access and what authority it has been given.

The risks are already extending beyond formal company technology projects. Directors and employees are experimenting with publicly available AI tools, sometimes using them to summarise documents, prepare reports or analyse information that would ordinarily remain within the organisation.

Druyan cited data indicating that 40% of corporate directors had uploaded board materials to generative AI platforms. The disclosure raises questions about how confidential information is being handled, particularly where directors use public tools without first establishing whether the platforms meet their organisations’ data protection requirements.

Board papers can contain sensitive financial information, acquisition plans, legal advice, personnel decisions and commercially valuable discussions. Uploading such material into an unapproved platform could expose a company to confidentiality and data protection risks. The extent of that exposure depends on the tool’s settings, contractual terms and how the information is processed and retained.

This informal use of AI, often called shadow AI, creates a problem for companies trying to enforce internal policies. An organisation may have approved software and written rules governing AI use, yet directors and employees could still be using other platforms without the knowledge of IT, legal or compliance teams.

The challenge becomes more serious when companies move from using AI to draft emails or summarise documents to systems that can take action on their behalf.

Agentic AI can be designed to perform tasks such as processing invoices, managing workflows, analysing financial information and interacting with other business systems. These capabilities may reduce the time spent on routine work, but they also create new questions about authority and accountability.

If an automated system approves an incorrect payment, changes a supplier record or makes a decision that exposes customer information, the company needs to establish what happened. That requires records of the system used, the information it accessed, the instructions it received and the human decisions surrounding its deployment.

Druyan warned that organisations must be able to examine the actions of AI systems rather than treating the technology as an independent decision-maker.

“Can we understand what your agents did overnight? And oh, by the way, I have to be able to audit that. And the answer can’t be the person accountable to that is the AI,” she said.

For company directors, the question is not simply whether an AI system performs well during demonstrations. They must also know whether its decisions can be monitored, challenged and reversed when necessary.

There is also a growing legal dimension to the debate. A September 2026 analysis by law firm Ropes and Gray identified shareholder derivative complaints filed against directors and officers at Adobe, Microsoft and Nvidia between April and July 2026.

The cases raise questions about corporate oversight of AI-related risks, including allegations concerning the use of copyrighted material in training datasets. The complaints do not establish that the directors breached their duties. However, they show how decisions about AI development and deployment can become matters for shareholder scrutiny, particularly where investors believe companies have failed to consider significant legal or commercial risks.

In the United States, such claims can involve the Caremark doctrine, which concerns directors’ responsibility to establish and monitor systems for legal compliance and risk oversight. The doctrine does not make directors automatically liable whenever a company encounters a problem. Rather, the circumstances and evidence surrounding their oversight responsibilities matter.

The prospect of further legal action is already attracting attention. Tracey Cesen, founder and chief executive of Forever Human.ai, warned that:

“2027 is going to be the year of lawsuits” over AI governance and data leaks.

The warnings point to a growing challenge for corporate boards: keeping pace with a technology that is advancing faster than traditional governance structures can comfortably accommodate.