The SEC’s 40+ comment letters in 2025-2026 establish that enterprises whose AI capabilities depend on third-party foundational models must disclose that dependency with specificity in their annual filings. (SEC EDGAR, Division of Corporation Finance Comment Letter Guidance, 2025-2026) “Proprietary AI” claims without supply-chain documentation are treated as potential material misstatements. The CFO certifies SOX Section 302 each quarter: without a documented AI supply chain review process, that certification is made without a documented basis. The board that has not established the materiality standard cannot hold the CFO accountable to a standard it has not defined.

The Audit Committee establishes: (a) the materiality threshold for AI supply chain concentration risk (recommended: any third-party AI dependency powering functions that generate more than 5% of revenue); (b) a quarterly supply chain registry review by the CIO/CTO, confirmed by the CFO before each SOX 302 certification; and (c) an annual external securities counsel review of AI-related risk factor disclosures before each annual filing. These three elements convert the certification from an assertion to a documented process.

“What are our three largest single-provider AI dependencies, and can management show me the documented continuity plan for each one, including what operations would look like in the first 72 hours if that provider modified or discontinued the service?”

The FTC and DOJ have designated algorithmic pricing as a 2026 enforcement priority under a per se illegal theory: autonomous pricing systems that use shared competitor data from common third-party providers produce the economic outcome of a price-fixing agreement regardless of human intent. (Freshfields, “2026 Enforcement Priority: Algorithmic Pricing”; ABA Antitrust Law Magazine, Spring 2026) The per se standard means no rule-of-reason analysis, no consideration of pro-competitive justification, and no intent defense. The only available defense is a documented audit trail showing the system does not reference competitor data from a shared third-party source. Most boards have not established the policy threshold that triggers the audit. Without the threshold, management cannot escalate the exposure to the board, and the audit does not happen.

The full board adopts an algorithmic antitrust policy defining: (a) which systems require annual external antitrust counsel review (recommended trigger: any dynamic pricing or revenue management system that uses aggregated market or competitor data from a third-party source); (b) the CRO’s obligation to certify annual completion of the antitrust audit and present the summary to the Audit Committee within 30 days of completion; and (c) the escalation path when management identifies potential exposure. The antitrust audit should be conducted in conjunction with outside antitrust counsel and retained under attorney-client privilege.

“Which of our revenue management or dynamic pricing systems uses aggregated competitor or market data from a third-party source? Has outside antitrust counsel reviewed each one in the past 12 months? If not, what is the remediation plan before the next FTC enforcement cycle?”

MIT Sloan Management Review’s “The Technical Director Premium” (2026) establishes a 15% valuation premium for companies whose boards include verifiable technical AI directors versus peers with non-technical boards. The market is pricing the board’s capacity to govern enterprise AI risk as a component of enterprise value. The N&G Committee that has not established a technical AI literacy criterion is allowing a measurable shareholder discount to persist. In the same proxy season that Glass Lewis has designated AI governance as its top 2026 oversight priority, a board without this criterion faces shareholder scrutiny it has not prepared for. (Governance Intelligence, 2026; Harvard Law School Corporate Governance Forum, 2026)

The N&G Committee adopts a formal technical AI literacy criterion for the director qualification matrix. The standard should be operational, not aspirational: a director who meets this standard can interrogate a management briefing on AI deployment and ask specific follow-up questions about training data provenance, model dependencies, output monitoring, and failure modes, without relying on management to explain why those questions matter. The N&G Committee reports annually on board composition relative to this standard. The target: at least one director meeting this standard within 12 months of adoption; at least two within 24 months.

“Has the N&G Committee established a technical AI literacy criterion for director qualification? Which current directors meet it? If none do, what is the Committee’s plan to address the gap before the next proxy season review?”