Why AI and Geopolitical Risk Are Now the Top Fears for Corporate Boards in 2026

Corporate boards spent most of the last decade treating artificial intelligence as a strategy topic — something for the innovation committee to monitor once or twice a year. That posture broke down in 2026. New director-and-officer research from Willis Towers Watson (WTW), covered in detail by Board Agenda and the Harvard Law School Forum on Corporate Governance, shows board AI oversight has become one of the defining governance issues of the year, alongside a geopolitical risk shock that few directors saw coming twelve months ago.

What is board AI oversight and why does it matter in 2026?

Board AI oversight is the formal process by which directors govern how an organization designs, deploys, and monitors artificial intelligence systems. It matters in 2026 because AI has moved from pilot projects into core operations, and regulators, insurers, and shareholders now expect boards to demonstrate active supervision, not passive awareness.

The shift shows up clearly in the numbers. According to the 2026 WTW Directors and Officers survey, 56% of directors globally rate AI as a “very” or “extremely” important risk to their organization, rising to 71% among North American respondents. Three specific concerns dominate: AI-generated errors and misinformation (cited by 50% of respondents), AI-enabled fraud and social engineering (40%), and the strategic risk of failing to adopt AI fast enough (38%).

Why is geopolitical risk suddenly a top board concern?

Geopolitical risk is a top board concern because it jumped from 15th place to inside the top 7 global risks for directors and officers in a single year, with 59% of directors now calling it very or extremely important. Trade fragmentation, sanctions exposure, and cross-border data rules are now standing board agenda items rather than annual footnotes.

Board Agenda’s coverage of the same research period reinforces this: its weekly governance round-up flagged “AI and geopolitical uncertainty” as the two concerns directors raised most often in board evaluations conducted this quarter, ahead of long-standing staples like cybersecurity and succession risk. Fewer than 40% of directors believe their organization has an adequate strategy for managing geopolitical exposure today, which is precisely the kind of gap that shows up in post-crisis governance reviews.

Do boards actually have the skills to oversee AI?

Most boards do not yet have sufficient AI oversight skills. Only 55% of directors believe their board has adequate capability to oversee AI, and fewer than 40% of AI and data leaders inside those same companies believe the board understands AI well enough to provide meaningful challenge.

This gap is exactly why AI literacy has moved onto director recruitment criteria at a growing number of listed companies. Search committees are now asking candidates to describe prior experience sitting on an AI or technology risk committee, treating it the way financial-expert status was treated on audit committees a generation ago.

How are boards responding — what does an AI risk committee actually do?

An AI risk committee is a board-level or delegated management body that reviews AI use cases, model risk, vendor dependencies, and incident response before and after deployment. Its job is to make sure AI decisions get the same structured scrutiny as capital allocation or M&A decisions already receive.

In practice, boards are building this oversight in one of three ways, based on patterns visible across recent governance disclosures and Board Agenda’s ongoing coverage of board appointments:

• Extend an existing committee’s charter — most commonly risk or audit — to explicitly cover AI model risk and data governance, rather than create a new body from scratch.
• Stand up a dedicated AI or technology risk committee, typically at larger or more AI-exposed companies, with its own charter, reporting line, and named chair.
• Appoint a management-level Chief AI Risk Officer or equivalent who reports quarterly to the full board, used when the company wants faster iteration than a formal committee structure allows.

Whichever structure a board chooses, the charter has to define scope, authority, and reporting lines explicitly — the same discipline that already applies to every other board committee, and one of the most common gaps auditors flag when AI oversight is added as an afterthought.

What is driving the widening FTSE 100 CEO pay gap, and why does it connect to AI oversight?

The FTSE 100 CEO pay gap is widening because remuneration committees are increasingly linking executive pay to AI-driven productivity and transformation targets, which can inflate awards even when underlying financial performance is flat. Board Agenda’s July 2026 governance coverage flagged this as a live shareholder-engagement issue heading into the next proxy season.

The connection to AI oversight is direct: if a board cannot credibly demonstrate it understands and monitors the AI initiatives behind a large incentive payout, investors and proxy advisors are far more likely to vote against the remuneration report. Boards that already run a functioning AI risk committee have a much easier time defending pay-for-AI-performance links in shareholder letters.

What should a board do in the next two board cycles?

In the next two board cycles, a board should benchmark its current AI oversight against the WTW findings, close the specific skills gap identified above, and put a named AI risk owner and reporting cadence in place before the next annual proxy statement is drafted.

A practical sequence that fits inside a normal governance calendar:

1. Add a standing AI risk item to every risk committee meeting for the next two cycles, not just an annual update.
2. Run a short, structured AI literacy session for all directors — treat it as seriously as cybersecurity training was treated five years ago.
3. Formalize ownership: name who reports on AI risk to the board and how often, in writing, inside a committee charter.
4. Fold geopolitical exposure into the same risk review, since the two concerns are now tracked together by directors in the WTW data.
5. Document the process before the next board evaluation cycle, since regulators and proxy advisors increasingly expect written evidence, not verbal assurance.

None of this requires a board to become a technical AI committee. It requires the same governance discipline boards already apply to financial risk: clear ownership, a defined review cadence, and a paper trail that shows the oversight actually happened.

Why do audit committees keep hearing that execution, not design, is the problem?

Audit committees keep hearing this because most companies already have reasonable audit frameworks on paper; the recurring finding is that testing frequency, documentation, and follow-through on prior findings are inconsistent from one reporting period to the next.

Board Agenda’s July 2026 audit coverage put this plainly: audit quality is “improving” year over year at an aggregate level, but the improvement is uneven, and the same root cause keeps surfacing — controls exist, but nobody consistently checks that they were actually followed between audit cycles. AI oversight is walking straight into this same trap. A board can approve a well-written AI governance policy in January and have no evidence by December that anyone checked whether business units actually followed it.

The fix auditors recommend is unglamorous but effective: put AI governance checks on the same recurring internal-audit calendar as financial controls, rather than treating them as a one-time policy rollout. A policy that is never re-tested is not oversight — it is a memo.

How should smaller and mid-sized companies scale this down without losing the substance?

Smaller and mid-sized companies should scale AI oversight down by combining it with an existing committee and reducing the reporting frequency, not by skipping the governance structure entirely. The core elements — named owner, defined scope, recurring review — apply regardless of company size.

A workable lightweight version for a company without a full-time risk function looks like this: the audit or risk committee adds a standing 15-minute AI risk agenda item each quarter; one senior executive is named in writing as the point of accountability for AI risk reporting; and the board reviews a short written summary — even one page — before every quarterly meeting. This is far short of what a large, heavily AI-exposed company needs, but it closes the single biggest gap regulators and proxy advisors flag: the complete absence of a documented, named owner.

Frequently Asked Questions

Is AI risk now more important than cybersecurity for boards?

Not yet, but the gap is narrowing. Cybersecurity remains a top-3 board risk in most 2026 surveys, while AI risk has moved from a secondary topic into the top tier alongside it, often reviewed by the same committee.

Should every company create a separate AI risk committee?

No. Smaller or less AI-exposed companies typically extend the existing risk or audit committee’s charter instead of creating a new body, reserving a standalone AI committee for larger or heavily AI-dependent organizations.

What is the single most common gap in current board AI oversight?

The most common gap is the absence of a named, accountable owner for AI risk reporting to the board. Surveys consistently show boards discuss AI informally but few have documented, charter-level ownership of the topic.

Last updated: July 26, 2026. Sources: Willis Towers Watson 2026 Directors and Officers Survey (via Board Agenda and Harvard Law School Forum on Corporate Governance), Board Agenda weekly governance coverage.