The board AI policy gap: 96% say nothing left the system, 49% have heard otherwise

96% of public company directors say they know of no case where board material was put into a tool outside the company's approved environment. In the same survey, 49% say they have heard of board members using public, consumer AI tools for board work.

Those answers came from the same 104 directors, polled in June by the Diligent Institute with Corporate Board Member. Set side by side, they do not both hold. Either those consumer tools are being used on something other than board business, or the 96% measures what directors have been told rather than what has happened.

I'd say it's the second. And that is the useful finding here, because it tells you what a board actually knows about its own conduct.

Adoption is not the question any more

In the same poll, 82% of directors had used generative AI for board work in the previous six months, up from 66% last September. OnBoard's 2026 survey of more than 500 directors and executives puts it at 92%, against 69% a year earlier.

Both firms sell board software, so treat the levels as directional rather than precise. Two separate samples, run by two competing vendors, moving the same way is the part worth keeping.

Now the governance side. 54% of directors say there is no guidance at their company on how directors should use AI. Only 6% report a policy written specifically for the board.

The moratorium nobody follows

The standard board response to this is to wait. Let the tools settle, let the regulatory picture firm up, then write something durable. One director quoted in the survey put the case well: better to let AI mature and real products arrive than to dive into what is "probably still the 'Myspace' days before Facebook."

There is something in that. A detailed policy for a technology that changes every quarter is wrong by Christmas.

Then look again at the 49%. A moratorium is not a control if it is not being followed, and that number is what following it looks like in practice. The board that chose to wait did not stop directors using these tools. It stopped hearing about it.

A board that has not written the rule has still made a decision. It has decided the rule will be whatever each director privately thinks it is.

What the gap costs you

30% of the directors surveyed had used generative AI to summarise board books or meeting papers. Those are among the most sensitive documents a company produces, covering draft results, deal terms, litigation and people matters.

If that summarising happened in a personal account, the company has an exposure it cannot scope. It cannot tell you which documents, whose account, or what the retention terms were. Discovery in a shareholder action is a poor moment to establish that for the first time.

There is a second clock running here too. A director's duty does not wait for a regulatory deadline to arrive. It runs continuously under company law and it is enforced by shareholders and insurers on their own timetable, not on the AI Act's.

Three things for the next agenda

None of these needs a finished policy, and all three fit on one page that you revise every six months as the tools change.

• Which tools directors may use, named, with the approved environment specified.
• What must never be pasted into anything outside it, listed by document type rather than by principle.
• Who owns this, whether that is audit, risk or the full board, with a date against it.

Ask your board today whether any board material has left the approved system, and the honest answer from most is that they don't know. Worth finding out before somebody else does.