The AI Fiduciary Gap: What Every Board Must Document Before the First Claim Arrives
The board that cannot produce a governance document has already failed the Caremark standard for AI oversight
The question every board chair needs to answer before the Q3 2026 shareholder engagement season: if your organization’s AI systems produced a material adverse outcome tonight, what document would your board produce to prove it discharged its oversight obligation?
For 64% of boards, the answer is nothing that satisfies the standard.
Three Delaware and federal triggers that close on every board simultaneously
Caremark Standard (Del. Ch. 1996 / Del. 2006): Boards must implement and monitor a reasonable information system for mission-critical risks. Failure to do either, or implementing a system and ignoring red flags, is bad faith liability. AI deployment in consequential decision domains triggers this obligation.
McDonald’s Extension (Del. Ch. 2023): Caremark oversight duties now apply to officers within their delegated domains. Every CFO, COO, CHRO, CRO, and CIO who operates AI systems without a documented accountability contract carries personal fiduciary exposure.
SEC IAC Recommendation (December 4, 2025): The SEC Investor Advisory Committee voted to advance AI disclosure guidance requiring boards to disclose the nature of their AI oversight. Only 15% of S&P 500 companies currently do so. The guidance is not yet a formal rule. The proxy season governance questions will not wait for the rule.
Colorado Repeal Signal (May 14, 2026): Colorado SB 24-205 was repealed before its June 30, 2026 effective date. The state-statutory compliance anchor boards were using is gone. The Caremark obligation is doctrinal and permanent. The repeal strengthens, not weakens, the governance urgency.
Current state of board AI governance: a gap measurement, not a trend report
of boards have a formal AI governance framework (NACD 2025)
of boards have AI management reporting metrics (NACD 2025)
of S&P 500 companies disclose board AI oversight (SEC IAC, 2025)
Four elements. Ninety days. The governance position becomes defensible.
1. Committee Charter Amendment. Formal charter amendment naming the committee responsible for AI oversight. Informal designation does not appear in the governance record. A derivative plaintiff asks for the charter. If the charter does not reflect the AI oversight mandate, the board cannot prove it existed.
2. Quarterly AI Governance Report. Eight-section structured report from management to the designated committee. Red flag threshold status, incident log, officer accountability contract status, disclosure review. The distinction: a compliance affirmation (“systems operating normally”) is not a governance signal. The eight-section structure produces signal.
3. Pre-Deployment Impact Assessment. Before any AI system deploys in a consequential decision domain: accountability assignment, review and override mechanism, post-deployment monitoring plan — documented. Deploying without documentation is the Caremark failure mode.
4. Officer Accountability Contracts. Each C-suite officer with AI oversight responsibility: domain, red flags, authority, escalation protocol — in writing. The McDonald’s extension makes the absence of this contract personal exposure at the officer level.
Q3 2026 is the practical deadline; the 18-month derivative horizon is not far behind
Q3 2026: Shareholder engagement season opens. ISS and Glass Lewis are developing AI governance scoring criteria. Institutional investors will ask boards directly about AI governance architecture. The board that has none has no substantive answer.
18-month horizon: First AI-specific Caremark derivative claim (Matera/Oxford estimate, March 2026). The board that enters that horizon without documented architecture enters it exposed.
The 90-day governance build produces the minimum viable architecture: chartered committee, first quarterly report on file, executed officer accountability contracts, documented impact assessment process. That is the Caremark standard, discharged.
What the board that builds this architecture leaves behind
The board that builds documented AI oversight architecture before the first AI-specific Caremark derivative challenge arrives has built something its successors will inherit as institutional strength, not institutional liability. That is what governance architecture looks like when it is not built in response to litigation.
- In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996)
- Stone v. Ritter, 911 A.2d 362 (Del. 2006)
- In re McDonald’s Corporation Stockholder Derivative Litigation, Del. Ch. 2023
- Matera, F., “From Red Flags to Black Boxes: Caremark in the Age of Algorithmic Governance,” Oxford Law Blogs / SSRN (March 27, 2026)
- SEC Investor Advisory Committee, AI Disclosure Recommendation (December 4, 2025)
- National Association of Corporate Directors, 2025 Board Governance Survey
- WilmerHale, AI Governance Playbook for Boards (January 2026)
- Colorado SB 26-189 (signed May 14, 2026) repealing SB 24-205
The four working artifacts that operationalize this architecture — committee charter amendment language, officer accountability contract template, quarterly report template, and AI Governance Readiness Scorecard — are available in the Executive Leadership Playbook and functional White Paper suite.