AI Is No Longer an IT Decision. It Is a Boardroom Decision.

Artificial intelligence is already changing how organisations sell, serve customers, manage employees, assess risk, produce information and make decisions.

Yet AI implementation is still frequently treated as an IT responsibility: select a platform, engage a vendor, complete the integration and train employees to use it.

That is a category error.

AI may be delivered through technology, but its consequences extend across the organisation. It can change:

• how employees perform their work;
• how customers are assessed or treated;
• which decisions are automated;
• what information leaders rely upon;
• how organisational knowledge is created and retained;
• where confidential data travels;
• which third parties become operationally critical; and
• whether the organisation can continue delivering its brand and service promises.

These are not merely technology considerations. They concern strategy, operating models, accountability, risk appetite and stakeholder trust.

That places AI squarely within the responsibility of leadership.

The appropriate model is:Board-governed.
Executive-led.
Technology-enabled.

The opportunity and the risk are both real

The business case for AI cannot simply be dismissed as hype.

In its 2025 discussion paper, based on a 2024 survey of 120 financial service providers, Bank Negara Malaysia reported that 71% of banking institutions and development financial institutions and 77% of insurers and takaful operators had implemented at least one AI application. More than 60% of banking institutions and insurers viewed AI as a strategic priority for the following one to three years.

But evidence also shows why implementation requires more than enthusiasm.

A field experiment involving 758 knowledge workers found that people using AI completed 12.2% more tasks and worked 25.1% faster on tasks within the technology’s capabilities. On a task outside that capability boundary, however, AI users were 19% less likely to reach the correct answer.

The research describes this as AI’s “jagged technological frontier”: AI can significantly improve performance in one part of a workflow and reduce decision quality in another, even when the tasks appear similar.

This combination—material opportunity, uneven reliability and enterprise-wide consequences—is precisely why AI governance belongs in the boardroom.

Why AI falls within corporate governance

Corporate governance is fundamentally concerned with the allocation of authority, decision rights, oversight and accountability.

The G20/OECD Principles of Corporate Governance state that boards are responsible for providing strategic guidance, monitoring management and overseeing the organisation’s risk-management systems. The principles expressly include digital security, data privacy and personal-data protection within that oversight responsibility.

The logic extends naturally to AI.

When AI begins influencing customer eligibility, pricing, recruitment, fraud detection, financial reporting, management recommendations or operational decisions, it is no longer simply processing information. It is participating in the organisation’s decision system.

The board does not need to select models, write prompts or manage technical configurations. It does, however, need to determine:

• where AI may be used;
• which decisions must remain human;
• what level of error or uncertainty is acceptable;
• who owns the resulting business outcome;
• what evidence is required before scaling;
• how affected stakeholders will be protected; and
• when an AI system must be stopped.

The distinction is important. Board responsibility does not mean board operation.

The board governs purpose, risk appetite and accountability. Management translates that direction into an operating model. Business owners remain accountable for outcomes. Technology, data and cybersecurity teams enable and protect the system.

This division is also reflected in the National Institute of Standards and Technology’s AI Risk Management Framework. Its “Govern” function calls for clear accountability structures and states that executive leadership should take responsibility for decisions about the risks associated with AI development and deployment.

AI is not a tool. It is a system.

Governance frequently fails because an AI product is mistaken for the entire AI system.

An organisational AI system consists of more than a model. It includes:

• the business objective and decision being supported;
• the model, application or automated agent;
• the data used to train, configure or inform it;
• prompts, instructions, retrieval sources and business rules;
• technical infrastructure and system integrations;
• employees who operate or supervise it;
• customers and other people affected by its output;
• external providers and subcontractors;
• approval and escalation processes;
• monitoring, logging and validation;
• human review and override mechanisms; and
• the business process into which the AI is introduced.

Buying an AI product therefore does not transfer accountability to the vendor.

The organisation remains responsible for deciding where the system belongs, whether its outputs are suitable for the intended purpose, and what happens when it fails.

Bank Negara Malaysia’s responsible-AI considerations make this explicit for financial institutions: board and senior management are accountable for AI strategies and outcomes, and institutions remain accountable for both internally developed and externally sourced AI applications.

Cybersecurity provides the governance precedent

Cybersecurity followed a similar path.

It was once framed primarily as an IT-security concern. It became a board issue when organisations recognised that a cyber incident could interrupt operations, expose customers, trigger regulatory obligations, damage reputation and threaten the continuity of the business.

Malaysia’s regulatory architecture demonstrates this shift.

For financial institutions within its scope, Bank Negara Malaysia’s 2025 Risk Management in Technology policy requires the board to approve the technology risk appetite, oversee the risk-management and cyber-resilience frameworks, and designate a board-level committee for technology oversight. That committee must include at least one member with relevant technology experience and competencies.

The policy also states that enforcement or supervisory action may be taken against a financial institution—including its directors, officers and employees—for non-compliance with specified mandatory provisions.

Securities Commission Malaysia’s Guidelines on Technology Risk Management similarly emphasise board oversight and accountability. They require relevant capital-market entities to notify the SC immediately, on the day of occurrence, upon detecting defined technology incidents, cyber incidents or near misses, and to ensure that the board is made aware.

For designated National Critical Information Infrastructure entities, regulations administered through the National Cyber Security Agency, Malaysia require an immediate electronic notification when a relevant cyber incident becomes known, followed by prescribed particulars within six hours.

These requirements do not create a universal “two hours, four hours and six hours” reporting sequence for every Malaysian company. Applicability depends on the organisation, its sector, its regulatory status and the nature of the incident.

The more important governance lesson is that regulated organisations must already be capable of:

1. detecting an event;
2. identifying who owns the response;
3. assessing materiality;
4. escalating it quickly;
5. notifying the correct authority;
6. maintaining evidence; and
7. reporting the outcome to the board.

That same governance spine can support AI.

What can be adapted from cybersecurity governance

Organisations do not need to start AI governance with an empty page.

Existing cybersecurity, technology-risk and corporate-governance structures may already provide:

• board and committee oversight;
• defined risk appetite;
• named executive accountability;
• asset and system inventories;
• risk-classification methodologies;
• third-party due diligence;
• change-management controls;
• incident-response procedures;
• escalation and regulatory-reporting channels;
• business-continuity arrangements;
• internal audit and independent assurance; and
• board reporting.

These capabilities should be extended to AI rather than duplicated in a disconnected governance structure.

However, cybersecurity governance cannot simply be renamed “AI governance.”

Cybersecurity is principally concerned with protecting the confidentiality, integrity and availability of systems and information. AI introduces additional questions:

• Is the output accurate enough for its intended use?
• Does the system produce unfair or discriminatory outcomes?
• Can an important decision be explained?
• Is a human genuinely reviewing the output or merely approving it automatically?
• Has the system’s performance changed over time?
• Is the data lawful, representative and suitable?
• Can the organisation trace how an output was produced?
• Could AI-generated content mislead customers or management?
• Does automation exceed the authority originally approved?
• What happens to people affected by an incorrect decision?

Malaysia’s National Guidelines on AI Governance and Ethics, developed by the Ministry of Science, Technology and Innovation, identify seven responsible-AI principles: fairness; reliability, safety and control; privacy and security; inclusivity; transparency; accountability; and the pursuit of human benefit and well-being.

These AI-specific considerations must be added to the existing technology-governance foundation.

Who should own AI governance?

An AI committee can coordinate the process, but it should not become a place where accountability disappears.

A workable allocation of responsibility is:

The organisation may call this structure an AI governance committee, responsible-AI council or transformation steering committee. The title is less important than the decision rights.

Every use case must have a named business owner. Every risk must have an owner. Every approval must be recorded. Every serious incident must have an escalation route.

What an AI governance framework should contain

An effective framework should establish an end-to-end operating process, not simply an acceptable-use policy.

At a minimum, it should contain:

1. An AI inventory

The organisation must know where AI is already being used—including employee use of publicly available tools, embedded AI within existing software and informal departmental experiments.

2. Risk classification

Use cases should be classified according to their potential effect on customers, employees, financial outcomes, safety, regulated activity, personal data, confidential information and critical operations.

Higher-impact uses require stronger approval, testing, monitoring and human oversight.

3. A defined workflow

Every proposed use case should move through a consistent process:

4. Policies, standards and procedures

The policy establishes the organisation’s principles and boundaries.

Standards define the mandatory controls.

Procedures and playbooks explain what people must do—including how to approve a use case, validate an output, report a concern, respond to an incident and shut down a system.

5. Ownership and turnaround times

Governance becomes ineffective when nobody knows who must decide or how long a decision should take.

The framework should specify:

• who reviews each risk category;
• who has approval authority;
• how quickly a request must be assessed;
• what triggers urgent escalation;
• who may suspend a system; and
• who must be informed.

6. A reporting mechanism

Employees need a clear channel for reporting unsafe outputs, confidential-data exposure, suspected bias, unauthorised use or system failure.

Management and the board need different levels of reporting. Board reporting should focus on material decisions and trends rather than technical activity.

7. Monitoring and assurance

High-impact systems require continuing evaluation. Approval at launch is not sufficient because models, data, providers, regulations and business processes change.

Monitoring should examine performance, exceptions, human overrides, complaints, security events, model changes and whether the expected business value is actually being realised.

How frequently should governance be reviewed?

There is no single review frequency suitable for every organisation or every use case.

A proportionate model would include:

• continuous monitoring for critical or high-impact systems;
• prompt escalation of material incidents and control failures;
• periodic management review of the AI inventory and risk profile;
• quarterly or otherwise risk-appropriate board reporting;
• a formal annual review of the overall AI governance framework; and
• an event-driven review following a major incident, regulatory change, model update, provider change or material change in use.

Governance should evolve with the organisation’s experience. It is a management system, not a one-time policy exercise.

Which comes first: the build or the policy?

This is often presented as a choice between writing a comprehensive policy before any experimentation and allowing teams to build first so the organisation can learn.

Neither extreme is necessary.

An organisation does not need a hundred-page policy before testing a low-risk use case. It does need minimum governance before allowing AI to influence real people, confidential information or material decisions.

Before a pilot begins, leadership should define:

• the business problem;
• the intended outcome;
• the named owner;
• the permitted data;
• the boundaries of use;
• the validation method;
• the required human review;
• the incident and escalation process; and
• the conditions under which the pilot will stop.

This is the principle behind Tuju’s transformation delivery framework:

Direction Before Investment.

The process moves through five stages:

Governance begins before deployment, but it continues to develop through evidence gained from controlled implementation.

What should the board ask?

The board does not need to become a technical review panel. It should ask decision-quality questions:

• Which business decisions will this AI influence?
• What measurable value is expected?
• Who is accountable if the output is wrong?
• What information can the system access?
• Which customers, employees or stakeholders could be affected?
• How was the system tested against the intended use?
• Where is human judgement mandatory?
• Can the decision be explained and challenged?
• What dependencies are being created on external providers?
• How will failure be detected?
• Who can suspend the system?
• Which regulatory or contractual obligations could be triggered?
• What will the board be told, and how quickly?
• What capability will remain inside the organisation?

These questions allow leaders to govern AI without attempting to operate it.

Does every organisation need AI governance?

Yes—but not every organisation needs the same structure.

A small business using AI for internal drafting does not need the governance machinery of a bank deploying AI for credit decisions.

It still needs basic rules concerning confidential information, personal data, output verification, ownership and acceptable use.

Governance should become more rigorous as the system gains:

• access to sensitive information;
• influence over important decisions;
• autonomy to take actions;
• exposure to customers or employees;
• integration with critical operations;
• regulatory significance; or
• potential to cause financial, legal, safety or reputational harm.

The principle is universal. The implementation should be proportionate.

The consequence of weak governance is not only regulatory

Regulatory exposure matters, but the deeper consequence is a gradual loss of control over how the organisation creates and delivers value.

Without effective governance:

• employees may disclose confidential information through unapproved tools;
• different departments may purchase overlapping systems;
• business decisions may rely on outputs nobody has validated;
• customer treatment may become inconsistent or unfair;
• intellectual property may be compromised;
• vendor dependence may become difficult to reverse;
• automation may weaken internal knowledge and capability;
• management reporting may appear persuasive while being materially wrong; and
• the organisation’s actual delivery may drift away from its stated brand promise.

The greatest risk may not be a dramatic AI failure.

It may be that the organisation quietly begins outsourcing judgement without deciding where responsibility should remain.

Governance should enable—not prevent—AI adoption

Good governance is sometimes portrayed as a brake on innovation.

Properly designed, it does the opposite.

It allows low-risk opportunities to proceed quickly, concentrates scrutiny on high-impact uses, gives employees clear boundaries and provides the evidence leadership needs to invest with confidence.

The purpose is not to govern AI for its own sake. It is to ensure that AI strengthens the organisation’s strategy, operating model and distinctive value rather than weakening them.

AI may be implemented by technical teams, but it changes the decisions, relationships and promises through which the organisation creates value.

That makes it more than an IT project.

It makes AI a boardroom decision.

References and further reading

1. Bank Negara Malaysia — Artificial Intelligence in the Malaysian Financial Sector, August 2025.
2. Bank Negara Malaysia — Risk Management in Technology, November 2025.
3. Securities Commission Malaysia — Discussion Paper on Corporate Governance Framework, December 2025.
4. Securities Commission Malaysia — Guidelines on Technology Risk Management, revised August 2024.
5. National Cyber Security Agency — Cyber Security (Notification of Cyber Security Incident) Regulations 2024.
6. Ministry of Science, Technology and Innovation — National Guidelines on AI Governance and Ethics, September 2024.
7. NIST — Artificial Intelligence Risk Management Framework 1.0, January 2023.
8. OECD — G20/OECD Principles of Corporate Governance 2023.
9. Dell’Acqua et al. — Navigating the Jagged Technological Frontier, Organization Science, 2026.

Regulatory references were checked as at 11 September 2026. Organisations should determine the precise requirements applicable to their sector, licence, designation and circumstances.