In April 2026, KPMG International and the INSEAD Corporate Governance Centre released AI Governance Principles for Boards—the first globally applicable, sector-agnostic framework defining what boards must know, decide, and oversee in the age of artificial intelligence. The timing is not academic. KPMG’s concurrent Global AI Pulse Survey found that nearly three-quarters of boards are perceived to have only moderate or limited AI expertise, even as the 2026 proxy season places AI oversight at the top of shareholder expectations.
The framework organizes board-level AI governance around five foundational pillars. Each pillar is both a domain of oversight and a signal of boardroom readiness. The table below maps each pillar to its core question and the governance gap it addresses.
The Five Pillars: Board-Level AI Governance Framework
| Pillar | Domain | Core Board Responsibility | The Governance Gap It Addresses |
|---|---|---|---|
| 1 | Strategy | Provide strategic oversight for long-term value creation in uncharted AI territory, balancing speed and experimentation with fiduciary discipline. | Most boards approve AI initiatives reactively. This pillar requires them to own the strategic question: how does AI reshape our competitive position and long-term obligations? |
| 2 | Security | Oversee technology sovereignty, cybersecurity, data protection, and AI-specific security risks—while balancing the agility and scale benefits of vendor partnerships and outsourcing. | AI expands the attack surface and introduces supply-chain dependencies that legacy security frameworks do not cover. Boards need visibility into AI security architecture, not just IT audit summaries. |
| 3 | Workforce | Balance productivity gains from AI automation with forward-looking workforce transformation—preserving human judgment and ensuring accountability is not automated away. | Nearly half of corporate directors report no clear accountability for AI governance between the board and the technology team. The workforce pillar closes that gap by demanding human accountability chains. |
| 4 | Trustworthy AI | Embed trust, accountability, and transparency as foundational enablers of AI-driven innovation—not as constraints on it. Oversee model governance, explainability standards, and bias monitoring. | Boards have routinely treated ethics and compliance as legal functions. Trustworthy AI requires boards to view them as strategic assets that directly affect stakeholder confidence and regulatory exposure. |
| 5 | Leadership Evolution | Recognize and govern how AI is reshaping the nature of leadership itself—compressing decision timelines, redistributing information power across the organization, and challenging where strategic judgment resides. | This is the pillar most boards have not formally engaged. AI is not merely a tool executives deploy; it is restructuring the conditions under which leadership decisions are made and accountabilities assessed. |
How the Framework Is Designed to Be Used
The KPMG-INSEAD principles are explicitly sector-agnostic and calibrated to be applicable regardless of an organization’s current level of AI maturity. They are designed to sit alongside—not replace—local regulatory requirements and cultural governance norms. This makes them a practical starting point for any board building its first AI oversight structure, as well as a diagnostic tool for boards that already have AI governance in place but want to pressure-test its completeness.
- Pillar Sequence Matters
- The five pillars progress from the outward (strategy, security) to the inward (workforce accountability, trustworthiness, leadership identity). A board that governs Pillars 1 and 2 without reaching Pillars 4 and 5 has oversight infrastructure without organizational integrity.
- Competency Precedes Oversight
- The framework’s implicit premise—reflected in the finding that 74% of boards lack adequate AI expertise—is that governance quality is bounded by director knowledge. Organizations should embed AI education in new director onboarding and maintain it as a standing agenda item, not a one-time briefing.
- Accountability Must Be Named
- Effective use of this framework requires the board to identify who, by name and role, owns each pillar at the management level. The executive owner for AI governance—typically the COO or CIO—must be the accountable party when decisions need to be made or escalated to the board.
How to Apply This
The fastest path from framework to practice is a structured board self-assessment against each of the five pillars. For each pillar, the board should be able to answer three questions: Who in management owns this? What information do we receive on it, and how often? And what decision authority does the board retain versus delegate? Boards that cannot answer all three for even one pillar have identified a governance gap that requires immediate attention—not a future agenda item. The KPMG-INSEAD framework gives directors the language and structure to have that conversation with management before the next proxy season makes it unavoidable.
Source: KPMG International and INSEAD Corporate Governance Centre, AI Governance Principles for Boards, April 2026.