Who owns AI risk? What Emerging NEDs took from a closed roundtable in London
AI is being adopted faster than boards can govern it. An IoD Emerging NEDs roundtable looked at what to do about that.
On 23 September, a group of senior leaders met at the BCS, Chartered Institute for IT, in London to discuss a problem many boards are facing. Organisations are adopting artificial intelligence quickly. The structures, knowledge and accountability needed to govern it have not kept up.
The roundtable, Risk and Governance in an Age of AI, was organised by IoD Emerging NEDs with the Thomson Reuters Foundation and supported by BCS, The Chartered Institute for IT. Attendees came from business, government, academia and civil society. It ran under the Chatham House Rule, so nothing below is attributed to individuals. That lets people speak plainly.
What the survey found
The session opened with findings from the AI Company Data Initiative, which surveys how organisations approach responsible AI. Practice was uneven. Some organisations have introduced AI strategies, principles and staff training. Many have not gone further than that.
Impact assessments were a weak point, especially on wider human rights questions. Transparency, and checks on the data used to train AI systems, also remain difficult.
One question ran through the whole afternoon: how do organisations move from saying responsible AI matters to building oversight that works?
AI strategy is business strategy
This point came up again and again. AI strategy is now business strategy. It is not a side project for the IT team.
That matters for boards. Several participants worried that directors and senior leaders may not know enough to challenge AI decisions. When a subject feels complicated, it is easy to hand it to compliance or technical teams and move on.
For a non executive director, that is the risk to watch. Your job is not to understand how a large language model works. Your job is to ask good questions and to know when an answer is not good enough. Participants said AI’s capabilities and limits need to be explained in plain terms, so boards can oversee it properly.
The type of AI also matters. A machine learning tool used for forecasting carries different risks from a generative AI tool that staff might paste confidential information into. Good governance starts with knowing what you are automating, which systems you are using and what data they touch. Being able to trace how information enters an AI system, moves through it and leaves it was seen as a basic requirement.
Who owns the risk?
The room was clearer on the principle than on the practice. Many felt AI risk is a business responsibility. Technical teams can manage cybersecurity and system risks, but senior leaders remain accountable for the decision to use AI.
Yet nobody could say which person, committee or function should own AI risk at board level. If you sit on a board, or hope to, that is worth raising at your next meeting. An unanswered question about ownership is a governance gap in itself.
Participants also noted that banking and healthcare already work under heavy regulation and audit. Other sectors have more freedom, which means responsible AI principles can stay voluntary. That led to a wider debate about whether firmer regulation is needed to set minimum standards.
Can AI govern AI?
This was where people disagreed most. Some argued that AI systems run at such a scale that automated monitoring may be the only way to keep up, with models checking other models against agreed rules.
Others called the idea of AI regulating itself overoptimistic. Generative systems can be unpredictable, and misinformation is already a large problem. Their concern was that if AI has flaws, using it to find those flaws raises obvious questions.
The room did not settle it. The more cautious view was that technology can support governance but should not replace human accountability.
Who is in the room when the rules are written?
The conversation also turned to representation. Participants pointed out that the teams shaping responsible AI frameworks do not always reflect the people affected by the technology. Women and people from global majority backgrounds are underrepresented in parts of the field, and Western perspectives dominate how AI is built and regulated.
This is a governance issue as well as a fairness one. If the people defining risk and acceptable harm share similar experiences, some risks will go unseen. IoD Emerging NEDs often bring different backgrounds and career paths to the boardroom, which puts them in a good position to ask whose perspective is missing.
Broader questions followed. Who benefits from AI, and which communities carry the costs? Participants also asked whether AI used in human-sensitive areas such as therapy or mental health support should face much stricter safeguards than lower risk tools.
The UK in a global picture
The group also looked at the UK’s place in an international landscape that includes the EU AI Act. The UK is strong in intellectual property and knowledge intensive industries. It is less well placed to lead on energy and hardware, which is a major bottleneck in AI development. International cooperation will therefore matter. AI supply chains, data and regulation cross borders, so governance cannot be thought of only in national terms.
What boards can do now
The roundtable ended with a push towards action. Participants agreed on several priorities:
- Build AI literacy at board and C suite level, and across the organisation.
- Set clear lines of accountability for AI risk.
- Improve traceability and auditability of AI systems.
- Treat security as a concern throughout the AI lifecycle, not an afterthought.
- Look beyond commercial risk to inequality, human rights, jobs and wellbeing.
The main agreement was that a responsible AI policy on paper is not enough. What counts is whether principles turn into practices, systems and oversight.
IoD Emerging NEDs will share insights from the session and explore future member surveys on AI, with results that could be taken to the national government.
For anyone preparing for a first board seat, the lesson is encouraging. You do not need to be a technologist to add value to AI. You need curiosity, a willingness to ask plain questions and the confidence to keep asking until the answers make sense.
What questions is your board asking about AI? Share your thoughts in the comments.
