A Caremark-style oversight claim resolves, in discovery, to one question: who, by name, was supposed to be watching this. Not a committee. Not a function. A name, attached to a job that person actually held and a performance cycle they were actually measured against. Most organizations building an AI governance defense right now can produce the policy, the committee charter, and the steering-committee minutes. Almost none can produce the name, because AI oversight exists everywhere in policy language and nowhere in a job description.
That gap is not a training problem an awareness campaign closes, and it is not a technology problem a better dashboard closes. It is an organizational design defect, sitting inside the one function built specifically to convert diffuse obligations into individually measured accountability: Human Resources. A board can adopt every framework available to defend an oversight claim, and the defense still fails at the same point, because a policy that names "Compliance" as the owner of a red-flag registry is not naming an owner. It is naming a department, and departments do not get deposed.
The numbers measure a design gap, not a maturity gap
WilmerHale's analysis of NACD's 2025 Board Practices and Oversight Survey found that 36 percent of boards have adopted a formal AI governance framework, and 6 percent have established AI-specific management reporting metrics. Read as an adoption curve, that gap between 36 and 6 looks like a company that wrote the policy and has not yet gotten around to building the dashboard.
Read structurally, it says something sharper. A reporting metric cannot exist in a board package until someone is accountable for producing it, and no one is accountable for producing it until that accountability appears in a written role with a consequence attached. The 6 percent figure is not primarily a measurement gap. It is a record of how few companies have decided, in writing and in a specific person's file, whose job it is to build the metric. The dashboard sits downstream of the ownership decision. It cannot come first.
That distinction changes what fixing it requires. A maturity gap closes with patience: give the market another eighteen months and the number moves on its own, the way cybersecurity metrics eventually became standard board fare. A design gap does not close on a market clock, because nothing about elapsed time creates a named owner. A company can wait three years and still show close to zero AI-oversight metrics tied to a compensated individual, because the missing ingredient was never time. It was a decision, in a specific quarter, about a specific role, that someone still has to make.
Legal owns the substance. HR owns whether anyone is accountable for it.
The objection a CHRO hears first is reasonable on its face: AI oversight is a legal and technical question, not an HR question, and a function that tries to own the substance of a red-flag threshold or a vendor liability map is overreaching into ground that belongs to the CISO and General Counsel. That objection is correct about substance. It is wrong about design.
A governance policy is not a job description. It can state, in good faith, that Compliance monitors red-flag thresholds without that duty ever appearing in a single person's written objectives or carrying a compensation consequence for anyone. The policy exists. The accountable individual does not. Closing that specific gap, translating an organizational responsibility into one person's measured performance, is not a legal skill or a technical skill. It is the same discipline HR already applies to safety-incident ownership and SOX control accountability, applied here to a category of risk the function has simply not yet been asked to own. This is the Accountability Contract Model at work: a stated duty, without a name, an authority, a measure, and a deadline attached to one person, is not an accountability. It is a hope.
A second version of the objection pushes further: why should HR audit the CISO's own objectives, rather than each function head simply updating their own team's goals. The answer is structural, not territorial. The instrument that makes an accountability survive a compensation cycle, a performance calibration, and a reorganization has always been HR's instrument, and it has to be run consistently across every function or the resulting ownership map means nothing. Three functions each amending their own objectives independently produces exactly the failure this paper is describing: three plausible fragments of ownership, and no single document a plaintiff's attorney would recognize as binding.
Three functions gave three sincere answers. None of them was a name.
A CHRO who finally asked the ownership question directly, rather than the policy question, found three sincere and contradictory answers pointing at the same document. Security believed a vendor's contract clause made Procurement the owner of the red-flag registry. Procurement believed Compliance owned it, because Compliance chaired the AI steering committee. Compliance believed the CISO's team owned it, because the drift-monitoring dashboard lived inside the security platform. Each answer was an honest read of one real fragment. None of the three could produce a single document naming one person as accountable for the registry's currency, appearing in that person's actual performance plan.
A parallel gap turned up in the response log. Two vendor-flagged performance events from the prior year had, in fact, been reviewed and resolved, but the record lived in one engineer's email inbox rather than a standing, dated log anyone was assigned to maintain. The information existed. The institutional memory did not, because institutional memory of that kind is a job, not a byproduct of otherwise competent people doing their work well.
The fix was not a new committee. The company already had one. It was four position-description amendments, each naming a single individual as the accountable owner of one artifact, each written into that year's performance objectives. Nothing about the underlying AI system changed. The board's next readiness assessment moved from a self-assessed 14 to a 24, because the gap being measured was never a technology gap.
The fix is four documents, not a new committee.
The work is sequential, and skipping the order produces the same fragmented picture the audit above found. First, inventory every AI system material enough to touch a regulated workflow, and list the oversight artifacts each one requires: a reporting cadence, a red-flag threshold registry, a vendor liability map, a response log. Second, pull the current, actual position descriptions and the last completed performance cycle for whoever is presumed to own each artifact, and log where the ownership is inferred from a title rather than stated as a measured line item. Third, draft the amendments closing every gap the audit finds, naming one accountable person per artifact with a real deliverable and cadence. Fourth, brief the compensation committee on which roles now carry a consequence tied to AI oversight, before the next review cycle runs, not after.
Each step uses a mechanic HR already runs for every other category of material accountability in the enterprise. Nothing about it requires new law, a new vendor, or new board appetite. It requires treating four documents as this quarter's work instead of next year's.
If a red-flag registry's owner field is ever found blank, or filled with a department name instead of a person, that condition should escalate to the CHRO and the audit committee chair within five business days of discovery, not at the next scheduled governance review. The evidentiary value of naming an owner depends on the gap closing before the system produces a flag, not after one already has.
The Legacy Test for this work has two clauses, and both have to be true. First, the successor who inherits this CHRO's seat inherits four position descriptions that already name an owner for every DOS artifact on the company's material AI systems, not a committee roster she has to decode from scratch. Second, that inheritance is conviction rather than crisis: the architecture is not built in response to a subpoena that already named the gap, but finished on a quarter the CHRO chose herself, before one ever arrives. A CHRO who runs the audit this quarter hands her successor the first kind. One who waits hands her successor the second, and a plaintiff's attorney who already knows which quarter that was.