The board that lists "AI risk" as one line among two dozen on its enterprise risk register has not built oversight. It has built a sentence. When an AI system touching a regulated asset fails, the question put to the directors will not be whether AI appeared on the register. It will be whether the board had a reporting system designed to surface that specific failure, in that specific system, before it happened.

Where the Law Comes From

The law is drawn from two sources that agree with each other. The first is the Delaware Court of Chancery's oversight doctrine, beginning with In re Caremark International (1996) and sharpened in Marchand v. Barnhill (Delaware Supreme Court, 2019), which held that a board must make a good-faith effort to put a reporting system in place for the risks that are mission-critical to the company. Not risk in general. The risk that can end the company. As of August 31, 2026, no Delaware court had decided an AI-specific Caremark claim, so applying that doctrine to AI is reasoned analysis rather than decided law. The analysis does not change the standard. It changes only what a court has yet had occasion to say about it.

The second source is thirty years of watching boards confuse coverage with oversight. A director who has been told that the audit committee "covers technology risk" believes something is being watched. In most of those rooms, nothing is. A category has been assigned. No one has been asked to gather evidence about a named system against a named threshold before the meeting, so no evidence arrives, and the absence of evidence is read as the absence of trouble.

Why Boards Retreat to Generality

The pattern persists because specificity feels like management. Naming a system, writing down the threshold that would count as a red flag for it, assigning an owner, and fixing a reporting cadence all look like operational work, and directors are trained, correctly, to stay out of operations. So they keep to the altitude where they feel safe. That altitude is exactly the one from which nothing can be seen.

This is where the Governance Boundary Principle is usually misread. The board governs and management manages, and the principle is most often invoked against boards that drift downward into running the company. It cuts the other way with equal force. Deciding what the board must be able to know, about which systems, and by when, is not management. It is the one act of governance that cannot be delegated, because it defines the information system through which everything else the board does becomes possible. A board that declines to specify because specificity looks operational has not respected the boundary. It has abandoned its own side of it.

A second mechanism holds the pattern in place. A general risk report is assembled by whoever owns the agenda, from whatever surfaced on its own. A named report forces a named person to go and look before the meeting. The discipline of preparing the report is what surfaces the flag. The report itself is only the proof, after the fact, that the discipline existed.

What the Violation Costs

Consider a composite drawn from several boardrooms and attributable to none. A health system's board approves a three-year expansion of its clinical AI vendor into triage suggestions. Two directors ask who would notice if the model's competency degraded. Management answers that the vendor runs its own quality reviews. No one asks whether the company has an internal owner for that signal, distinct from the vendor. The minutes record that the relationship was "discussed and approved."

Six weeks later a junior clinician mentions in a hallway that the triage tool has started assigning lower acuity to one presenting complaint than the department's own protocol would. The department head raises it with the vendor's account manager at the next check-in, three weeks on. The vendor calls it expected variance. No one inside the company's governance structure hears about it, because no one inside that structure was ever designated to. The only channel the department head knew was the vendor, the party with the least incentive to escalate.

Whatever the clinical outcome, the governance question is fixed: was there a system, independent of the vendor's assurances, by which the board could have learned of that hallway conversation? There was not, and the minute that reads "discussed and approved" will read very well in a deposition and explain nothing. In a Caremark analysis the documentary record is the only evidence that exists. An oversight practice that was never specified and never written down is, for litigation purposes, indistinguishable from one that never existed.

How a Board Applies the Law

A board applies the law by being able to produce four things on demand. A standing, named agenda item for each material AI system touching a regulated asset, with a defined recurrence, rather than a technology update that mentions AI. A written set of trigger conditions per system (competency-assessment failure, drift past a stated threshold, a vendor breach notice, a regulatory inquiry), each assigned to a named owner. A per-system comparison of the vendor's contractual liability cap against the company's actual exposure, reviewed by someone with authority to renegotiate rather than merely to note the gap. And a contemporaneous log of what happened the first time a trigger was crossed: who was told, when, what was decided, and what changed.

None of this requires a new committee. It requires that the existing audit or risk committee carry AI-specific items by name, and that the board adopt, in its minutes, one escalation condition: any triggered threshold on the material AI inventory reaches the full board in writing within five business days, whether or not a meeting is scheduled. The full evidentiary architecture, including how this board-level record sits above the technical assurance layer management owns, is developed in The Fiduciary Vacuum Executive Leadership Playbook.

An overview cannot tell a particular board which of its systems is material or where its thresholds belong. That is the work Touch Stone Publishers does with boards and executive teams who would rather build the record now than reconstruct it under oath.

A risk you can only name in general is a risk you are not watching.

Touch Stone Publishers Limited | 2026 | touchstonepublishers.com