AI Governance Is a Board Duty, Not an IT Project. Delaware Will Say So Eventually; Boards Should Act First

Ask the directors of a public company who is responsible for artificial intelligence and you will get one of three answers: the chief technology officer, the general counsel, or a shrug. Ask the same directors who is responsible for the company's financial statements and they will tell you, correctly, that they are — through the audit committee, with a charter, a reporting line, outside experts and minutes. The difference is not that financial reporting is more important than the systems now deciding whom the company hires, what it charges and whether its products are safe. The difference is that the law made the board own one of them, decades ago, and has not yet got around to the other. It will.

What Delaware already requires

The duty of oversight has been part of Delaware law since Caremark in 1996: directors must make a good-faith effort to put in place reporting systems that bring material risks to their attention, and must not ignore red flags those systems produce. For twenty years the duty was close to toothless; plaintiffs had to show that the board had consciously failed to act, and boards that held a meeting and received a slide were safe. Then came Marchand v. Barnhill in 2019, in which the Delaware Supreme Court let a claim proceed against the board of an ice cream maker whose products had killed three people, because the board had no committee, no protocol and no reporting system for food safety — the one risk that could destroy the company. Boeing followed in 2021, on the same logic, over airplane safety; McDonald's in 2023 extended the duty to officers. The rule after those cases is simple to state: for a risk that is mission-critical to the business, the board must build a way to know, and must act on what it learns.

Delaware's 2025 amendments to its corporate statute, which gave controllers and directors new safe harbors for conflicted transactions, did not touch Caremark. The oversight duty is where it was. The question is only what counts as mission-critical, and for a growing share of companies the answer now includes the model.

Why AI is a Caremark risk

A company that uses an algorithm to screen job applicants, price insurance, approve credit, triage patients or steer a vehicle has placed a system between itself and the people it affects that can fail in ways no human manager would — silently, at scale, with a consistency that turns an error into a pattern and a pattern into a class action. The legal exposure is already mapped. Colorado's AI Act requires impact assessments and consumer notices for exactly these systems; the EU's AI Act imposes obligations on high-risk uses; the federal anti-discrimination statutes apply to outcomes however produced; the securities laws apply to claims about what the AI does; and the FTC, whatever the Supreme Court decides about its unfairness authority, retains its deception authority. A board that has no inventory of the company's AI systems, no sense of which are consequential, no officer accountable for them and no reporting on their failures is not in a different position from the directors of the ice cream company. It is in the same one, a few years earlier.

For a risk that is mission-critical to the business, the board must build a way to know. The model is now mission-critical, and most boards have built nothing.

Priya Natarajan

What a board should actually do

The objection I hear most from directors is that they are not engineers and cannot be expected to supervise a model. That is true and irrelevant. Audit committees do not supervise the general ledger; they supervise the people and the systems that do, and they ask whether the controls work. The same structure translates.

1. Allocate it. Decide, in writing, which committee owns AI risk — audit, risk, technology or a new one — and amend the charter. A duty nobody owns is a duty nobody discharges.
2. Inventory it. Management should be able to tell the board which AI systems the company builds or uses, which ones make or shape consequential decisions about people, and which are regulated. Most companies cannot answer that question today. That is the first red flag.
3. Name an officer. Someone below the board must be accountable, with the authority to stop a deployment. The title matters less than the reporting line.
4. Adopt a framework and mean it. The NIST AI Risk Management Framework or ISO 42001 gives the board a vocabulary and the Colorado statute a safe harbor; a framework that exists only in a policy document is worse than none, because it documents what the company said it would do.
5. Get reporting, and minute it. Regular reports on incidents, assessments, regulatory contacts and model changes; questions asked and answers given, recorded. The Marchand board lost because its minutes showed nothing. Minutes are how a board proves it tried.
6. Act on red flags. A bias finding, a regulator's letter, a cluster of customer complaints, an employee's warning. The duty is not to prevent every failure; it is not to look away.

The counter-argument, and why it loses

There is a respectable view that Caremark claims remain hard to win, that courts will not turn every operational failure into a breach of oversight, and that boards which over-formalize AI governance will slow the business for no legal benefit. All true, as far as it goes. But Caremark claims are hard to win against boards that tried; they are won against boards that did not. The companies most exposed to AI failure are precisely those where the model touches the core product — and for those companies the argument that AI was not mission-critical will be made, after the failure, by lawyers who have read the company's own marketing. The cost of a committee charter and a quarterly report is trivial. The cost of explaining to a Delaware court why there was none is not.

Boards did not wait for the courts to tell them to oversee financial reporting; the courts and Congress told them because enough boards had not. The same sequence is available here, and the better path is the one that does not require a body count. Build the system. Ask the questions. Write it down.

The views expressed in this column are the author's own and do not necessarily reflect those of The Counsel. This piece is commentary, not legal advice.