AI Is Entering the Corporate Decision Chain. Board Governance Must Follow.

AI does not become a board matter simply because the technology is sophisticated.

It becomes a board matter when its output begins to influence a corporate decision.

An AI system may not have formal authority to approve a loan, appoint an employee, change a price or accept a business risk. But it may determine which information management sees, which candidate is shortlisted, which customer receives attention or which recommendation a leader is asked to approve.

A person may still make the final decision.

But the decision has already been shaped.

The governance question is therefore not only whether AI is making decisions on its own. It is whether AI is changing what a person—or another system—does next.

That is the point at which board governance must follow.

Why this is no longer only an IT matter

AI is often introduced through a technology conversation.

Which platform should the organisation use? What data does it require? How will it connect to existing systems? What security controls are needed?

These are necessary questions, but they are not sufficient.

Once AI begins influencing management judgement or an operating process, it may also affect:

how authority is exercised;
how customers or employees are treated;
what information leaders rely upon;
whether a decision can be explained;
where accountability remains; and
whether the organisation can continue delivering its promises.

These are questions of strategy, risk, internal control and stakeholder trust.

Malaysia’s Malaysian Code on Corporate Governance states that the board is responsible for the company’s risk-management and internal-control systems. The board is expected to determine the organisation’s level of risk tolerance, monitor key business risks and seek assurance that its controls are working effectively.

The G20/OECD Principles of Corporate Governance take a similar position. They place strategy, risk management, internal control and clear accountability within the board’s responsibilities.

AI does not create a completely new responsibility for the board.

It changes what the board must now consider within its existing responsibilities.

This does not mean that directors should select AI models, review technical configurations or approve every productivity tool used by employees.

Board responsibility does not mean board operation.

The board sets direction and risk appetite. Management is responsible for implementation. The business leader who owns the affected process remains responsible for the outcome. Technology and specialist teams provide the expertise and controls needed to support it.

AI may be enabled by technology.Its governance cannot be owned by technology alone.

Cybersecurity provides a familiar precedent

Cybersecurity followed a similar path.

It was once treated primarily as an IT-security responsibility: protect the network, manage access and respond when a system fails.

It became a boardroom issue when organisations recognised that a cyber incident could interrupt operations, expose customers, trigger legal obligations, damage reputation and threaten the continuity of the business.

Cybersecurity did not stop being technical when it became a board responsibility.

It became more than technical.

The OECD’s approach to digital-security risk reflects this distinction. It focuses on the economic and social consequences of technical incidents and states that organisational leadership should own digital-security risk while working with technical experts to manage it.

The NIST Cybersecurity Framework reinforces the same principle. Its governance component covers risk tolerance, responsibilities, policy, oversight and alignment with the organisation’s wider risk-management system.

This gives directors a familiar way to think about AI.

The detailed controls may differ, but the governance questions are recognisable.

Do we know where it is being used?

An organisation cannot govern what it cannot see.

Management should know where AI is already being used, including employee experimentation, features embedded in existing software, externally supplied models and automated functions introduced by vendors.

The board does not need an inventory of every writing or productivity tool.

It does need assurance that management can identify AI use that may affect an important decision, sensitive information, a regulated activity or a significant stakeholder.

Which uses require greater attention?

Cybersecurity does not apply the same level of control to every system. The controls depend on the importance of the system and the possible consequence of failure.

AI should be approached in the same way.

Using AI to reorganise non-confidential meeting notes is not equivalent to using it to influence recruitment, pricing, credit, safety, financial reporting or customer access to an important service.

The greater the effect on people, money, safety, regulation or the organisation’s reputation, the greater the need for testing, approval, monitoring and human review.

Who owns the outcome?

Cybersecurity governance makes a distinction between the people who operate the controls and the leaders who own the business risk.

AI needs the same clarity.

A committee may coordinate the organisation’s approach, but it should not become a place where accountability disappears.

Every material AI use case needs a named business owner.

If AI supports a recruitment decision, the responsible business owner does not become the technology department. If it supports a pricing, customer-service or financial decision, the leader responsible for that process remains accountable.

The technology may come from another team or an external vendor.

The accountability for the business outcome remains inside the organisation.

What happens when it goes wrong?

Cybersecurity governance assumes that incidents will occur. It establishes a process to detect the problem, escalate it and respond.

AI also needs a clear incident and escalation process.

An AI-related problem may involve confidential information being exposed, a harmful or unfair output, an incorrect recommendation, an unexplained change in performance or a system taking an action beyond the authority it was given.

Employees need to know how to report the problem. Management needs to know who can suspend the system. The board needs to know which incidents are serious enough to require its attention.

What evidence do we require?

Cybersecurity does not rely only on the team operating a system to declare that it is secure. It uses testing, monitoring, audit and, where appropriate, independent assurance.

AI should be treated in the same way.

Management should be able to demonstrate that a material use case has been tested for its intended purpose, that human review works in practice and that the initiative is producing the value used to justify it.

This is also where the comparison with cybersecurity reaches its limit.

Cybersecurity asks whether systems and information are adequately protected.

AI governance must also ask:

Is the output suitable for its intended purpose?
Is it accurate enough for the decision being made?
Could it produce an unacceptable or unfair outcome?
Is the human reviewer exercising genuine judgement?
Is the initiative creating measurable business value?

Cybersecurity provides a governance structure.

AI adds questions about judgement.

ESG gives directors a wider perspective

ESG is useful here not because every AI issue must be forced into one of three boxes.

It is useful because directors need to look beyond whether the system works technically.

A functional AI system can still create consequences for people, accountability and the resources on which the organisation depends.

What is the effect on people?

The social question is not limited to whether AI will replace jobs.

It includes how work will change, whether employees retain the knowledge needed to challenge an AI output and whether customers can seek human review when an AI-supported decision affects them.

An organisation may retain a human approval step and still weaken human judgement if employees are not trained, encouraged or given enough time to question the recommendation.

Human presence is not the same as human oversight.

Where does authority remain?

The governance questions are direct:

Who approved the use case?
Who owns the decision?
What authority has been given to the system?
What must remain subject to human judgement?
Who can override or stop it?
What evidence will management and the board receive?

These questions help directors determine whether responsibility remains visible as AI becomes more deeply embedded in the organisation.

Are the resources proportionate to the value?

AI depends on physical infrastructure, data centres and electricity. The International Energy Agency has highlighted both the growing energy requirements of data centres and the significant differences in energy use between simple and more complex AI applications.

This does not mean that every AI interaction requires board-level environmental analysis.

It means that when an organisation plans AI adoption at scale, directors should consider whether the infrastructure, energy and external dependencies are proportionate to the business value expected.

ESG does not provide the controls for AI.

It helps directors see the consequences those controls must address.

The regional direction is becoming clearer

Southeast Asia does not operate under one uniform AI-governance regime. National approaches differ, and many current instruments provide guidance rather than comprehensive AI legislation.

The direction is nevertheless becoming clearer.

Malaysia’s National Guidelines on AI Governance and Ethics address matters including fairness, safety, privacy, transparency, accountability and human benefit. AI Malaysia has also introduced a voluntary Boardroom Primer to help boards, directors and senior management oversee AI adoption and governance.

The ASEAN Guide on AI Governance and Ethics encourages organisations to establish appropriate governance, risk assessment, human oversight and responsible deployment practices. Singapore’s frameworks emphasise clear limits on AI authority and meaningful human accountability, while Indonesia’s guidance calls for internal policies concerning data and AI ethics.

The instruments differ, but the expectations are converging:

Organisations should know where AI is being used, who is accountable, what level of human oversight is required and how risks and outcomes will be monitored.

Directors do not need to become experts in every regional framework.

They should recognise where expectations are heading.

Three starting actions for the board

The starting point does not need to be a new committee, a lengthy policy or another technology purchase.

It should be one material business problem and the decision surrounding it.

Start with the business problem

Management should first identify:

the outcome that needs to improve;
the process or decision involved;
the person accountable for that outcome; and
how success will be measured.

“Using AI” is not a business outcome.

The use case should be connected to a defined improvement in service, quality, revenue, cost, risk, speed or organisational capability.

Trace the decision chain

For the selected use case, management should map:

Business problem→Information→AI output→Human or automated action→Organisational consequence

This makes it possible to see:

where AI enters the process;
how its output will be used;
where human judgement is required;
who may approve, override or stop the system;
which existing cybersecurity and risk controls can be extended; and
who remains accountable for the result.

If the organisation cannot identify the accountable owner, the use case is not ready to scale.

Define the evidence before further investment

Before approving expansion, management should establish:

what would demonstrate business value;
who or what may be affected;
what must remain under human control;
what would indicate failure; and
what conditions would require the initiative to stop.

An initial 90-day direction can then specify ownership, dependencies, human-review points, required approvals and at least three measures of value.

This is not a promise that the transformation will be completed in 90 days.

It is a disciplined way to determine what should happen next, who should act and what evidence the board should expect before approving further investment.

Direction must come before investment

The board does not need to govern every AI interaction.

It does need to govern the decisions in which AI is being allowed to participate.

Cybersecurity shows that a risk does not remain an IT matter when its consequences extend across the business.

AI has reached the same point.

The greatest risk may not be a dramatic system failure.

It may be that the organisation gradually allows AI to shape decisions, redistribute authority and weaken internal judgement without ever deciding where responsibility should remain.

Start with one business problem.

Trace one decision chain.

Establish one accountable owner.

Define the evidence required to proceed.

That is how directors can govern AI without attempting to operate it.

Board-governed. Executive-led. Technology-enabled.Direction Before Investment.

References

Sources and regulatory status checked on 24 September 2026. Organisations should determine the specific requirements applicable to their sector and circumstances.