AI: Are Boards Paying Attention?

In the wake of a number of shareholder proposals, as well as first-of-their-kind enforcement actions and public statements by the U.S. Securities and Exchange Commission, many companies are considering how their use of artificial intelligence and the associated risks should be overseen and managed by the board.

A recent report by proxy advisor Institutional Shareholder Services analyzed S&P 500 company proxy statements filed between September 2022 through September 2023. ISS found that over 15% of companies filing those proxy statements disclosed board oversight of AI, including 38% of companies in the Information Technology sector and 18% of companies in the Health Care sector. Less than 13% of S&P 500 companies had at least one director considered by ISS as having AI expertise, based on, among other things, employment experience related to AI and formal AI certifications. Information Technology companies again led the way with over 30% having at least one director with AI expertise. The study also found that AI is rarely the sole focus of a newly created committee. Most companies instead delegate oversight of AI to an existing committee, such as the audit committee or committees responsible for technology, corporate responsibility or risk management.

ISS concluded that AI’s expansion will likely cause institutional investors to expect companies, particularly those in industries heavily impacted by AI, to establish appropriate processes for board oversight of AI risks and opportunities, including disclosure of “relevant board skills and oversight responsibilities.”

Accordingly, boards of companies for which AI has become (or is likely to become in the near future) a mission-critical regulatory compliance risk should consider:

• Board Oversight: Board oversight over AI can reside with the full board, an existing committee or a newly formed committee dedicated to AI.
• Board Expertise: If the board is concerned that it does not have the necessary expertise to oversee AI opportunities and risks, it should consider offering training to existing directors or adding one or more directors with relevant experience.
• Board Minutes and Materials: Boards should ensure that their AI-oversight activities, as well as management’s compliance efforts, are well documented in board minutes and supporting materials. Boards should also ensure that they are appropriately briefed on the company’s response to serious AI incidents.
• Compliance: Boards should consider whether there are effective compliance and reporting structures to facilitate board oversight, which may include periodic AI risk assessments and monitoring of high-risk AI systems, as well as written AI policies, procedures and training.

In light of the SEC’s focus on AI, particularly on “AI-washing”—hyperbolic or inaccurate AI disclosures, which may lead to fraud claims under existing provisions of the federal securities laws—we expect directors will be focused on AI and related disclosures. Public companies should prepare to face SEC scrutiny in connection with their AI disclosures, policies and procedures. For example, in March, the SEC brought enforcement actions against two investment advisers, Delphia (USA) Inc. and Global Predictions Inc., for marketing to their clients and prospective clients that they were using AI in certain ways when, in fact, they were not. In June, the SEC filed a complaint against the founder and Chief Executive Officer of Joonko Diversity, Inc. alleging that in order to raise funds from investors, the founder marketed the company as having AI capabilities it did not have. The complaint is the SEC’s first litigated AI-washing matter.

The full text of the ISS report is available here.