Governing the Gaps

Artificial intelligence is not another pillar of governance. It is the earthquake that tests the whole temple, and the minutes are the evidence of how the board responded.

In Brief

The Problem. Many directors treat the governance of artificial intelligence (AI) as a new and separate duty that belongs to a committee, a consultant, or the chief information officer. In fact, AI tests each of the five duties the board already holds: fiduciary oversight, strategic direction, executive supervision, cultural integrity, and stakeholder relations.

Why It Persists. Adoption has outrun governance. Most health systems use AI, few have mature governance for it, and most directors say their boards lack the skills to question management. Treating AI as a specialty lets the rest of the board look away.

What Boards Should Do. Read each existing governance instrument again with AI in view, and record what the board asked, what it required, and who reports back.

For generations, the architecture of corporate governance has rested on five sturdy pillars: fiduciary oversight, strategic direction, executive supervision, cultural integrity, and stakeholder relations. AI now acts like a seismic shock. The technology does not topple the pillars, but it reveals cracks in their foundations.

The most dangerous misconception for a director today is to see AI governance as a new, separate duty. It is a stress test of all the existing ones. I take each pillar in turn and set out what the board should ask.

The Legal Frame Has Already Moved

Delaware law supplies the clearest statement of the oversight duty. Under In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), directors must make a good-faith effort to ensure that a reporting system exists. In Marchand v. Barnhill, 212 A.3d 805 (Del. 2019), the Delaware Supreme Court applied that duty to a "mission critical" risk: food safety at an ice cream maker (Zauderer et al., 2023). In January 2023, In re McDonald's Corp. Stockholder Derivative Litigation, 289 A.3d 343 (Del. Ch. 2023), extended the oversight duty to officers within their areas of responsibility (Raymond et al., 2023).

The line of cases now reaches life sciences directly. On September 2, 2025, the Court of Chancery allowed oversight claims to proceed against directors of the drug maker Teligent. The complaint alleged that no board committee was responsible for compliance with Food and Drug Administration (FDA) requirements for a prolonged period. It also alleged that management decided whether and when to report compliance issues to the board (Bonadurer, 2026). The court held that reporting left to management's discretion does not meet the Caremark minimum. These remain allegations at the pleading stage.

For a hospital, an insurer, or a drug developer, AI that touches diagnosis, claims, or trial evidence fits the mission-critical description. The standard is procedural. A court asks what the board did, and the minutes are the evidence.

Fiduciary Oversight: An Asset That Changes After Approval

The fiduciary pillar is the first to show cracks. The duty to protect the organization's assets and manage its risks now extends to assets the board has never had to value. A board knows how to value a factory, an asset that depreciates at a predictable rate. An AI model is different. It might become obsolete overnight if a competitor releases a better one, or it might learn a new task that multiplies its value. Its performance can also drift as patient populations, coding practices, or vendor updates change. Overseeing it is less like insuring property and more like insuring a temperamental racehorse.

The gap between duty and capability is measurable. In a 2025 survey of 233 health systems by the Healthcare Financial Management Association (HFMA) and Eliciting Insights, 88 percent used AI internally. Only 18 percent had both a mature governance structure and a fully formed AI strategy (Healthcare Financial Management Association, 2025). The fiduciary question is no longer whether AI is in use. It is whether the board knows where, and who answers for it.

Strategic Direction: Steering by What Is Easy to Count

The pillar of strategic oversight also shows strain. A board's job is to approve a vision and allocate resources to achieve it. If directors cannot measure the value created by their most powerful new tool, they are steering blind. Unable to quantify AI's full contribution, many boards favor projects with easy savings estimates over harder-to-measure investments that could define the organization's future.

The early evidence shows the tilt. In a September 2026 study by Bessemer Venture Partners and Bain and Company, 226 healthcare executives reported returns of 4.0 times spend on provider revenue cycle uses and 2.9 times on provider clinical uses. Pharmaceutical clinical development trailed at 2.3 times (Guerra & Kraus, 2026). The figures are self-reported, and administrative uses are easier to count. A board that sees only the easy numbers will fund only the easy projects. Each AI proposal should therefore state what it will change, how the change will be measured, and when the board will see the result.

Executive Supervision: The Knowledge Gap

How can a board select and supervise leadership for an AI-enabled future if it has a knowledge gap of its own? In the 2025 survey by the National Association of Corporate Directors (NACD), 62 percent of public company boards had set aside full-board time for AI. Only 23 percent had audited where AI is in use, and six percent had set metrics for management reporting (National Association of Corporate Directors, 2025). Directors see the problem themselves. In the PwC 2026 survey of about 600 public company directors, 71 percent identified AI as the top skill their boards need to strengthen (Gaskin, 2026).

This asymmetry of knowledge has two consequences. The board cannot effectively challenge management's AI proposals. Nor can it judge whether the succession plan is identifying leaders capable of running an organization in which people and AI systems work side by side. Since the McDonald's decision, those officers also carry their own oversight duty, so the question matters at both levels. The usual result is passive acceptance of whatever the technologists propose. Deference of that kind is an abdication of oversight.

Cultural Integrity: Bias and Explanation

The pillar of integrity and culture is perhaps the most vulnerable. An organization's values are meant to be its bedrock. If ungoverned, AI can become a vector for hidden biases that erode those values from within. An organization can preach fairness while its AI-assisted hiring tools quietly perpetuate old prejudices. That is the allegation in Mobley v. Workday, where a federal court in California in May 2025 allowed a nationwide age discrimination claim to proceed as a collective action. The plaintiff alleges that AI screening tools used by many employers disadvantaged applicants aged 40 and over; Workday disputes the claim (Lada et al., 2025). Every health system is also a large employer.

California has written the same concern into law for clinical tools. Senate Bill 503, effective January 1, 2027, requires developers and deployers of clinical decision support to identify tools that could produce biased results. Deployers must also monitor those tools and act on problems (Montano & Tran, 2026).

The integrity gap also concerns transparency. If an AI system denies someone a service, can the organization explain why? In February 2025, the Court of Justice of the European Union ruled on automated decisions about individuals. A person subject to one is entitled to an intelligible explanation of the procedure and principles actually applied (Cooper et al., 2025). If the answer is "the computer says no," the pillar of integrity crumbles.

Stakeholder Relations: Rules and Expectations That Diverge

Managing the shifting expectations of patients, employees, regulators, payers, and investors is a core board duty. Colorado's rewritten AI Act takes effect on January 1, 2027. It gives partial exemptions to entities covered by the Health Insurance Portability and Accountability Act (HIPAA), but those entities must still give patients notice (Darch et al., 2026). The European Union's Digital Omnibus on AI, Regulation (EU) 2026/1744, moved high-risk obligations to December 2, 2027, and to August 2, 2028, for AI embedded in regulated products such as medical devices (Addleshaw Goddard, 2026; Hunton Andrews Kurth, 2026). Federal preemption of state AI laws remains unresolved after the executive order of December 11, 2025 (Bridges et al., 2025). Until it is resolved, the board should expect to comply with state law as written.

A misstep in clinical AI can bring regulatory penalties and a loss of patient trust that threatens the organization's license to operate. Investors are watching as well. The share of S&P 500 companies that disclose AI as a risk rose from 12 percent in 2023 to 83 percent in 2025. Yet only nine percent of executives surveyed by The Conference Board said their companies were very prepared to comply with AI regulations (The Conference Board, 2026). Investors will find it hard to value an organization whose core decisions are made by systems no one can explain.

The Strongest Objection: Oversight Liability Is Rare

A skeptical director might answer that Caremark claims seldom succeed. The Delaware court itself called the theory "possibly the most difficult theory in corporation law" on which a plaintiff might win (Goeller & Terribile, 2024). The evidence supports the skeptic. An empirical study of Delaware oversight decisions from 1996 through 2024 found that courts held the allegations sufficient in 25.6 percent of cases. The pleading-stage success rate stayed essentially flat after Marchand, at 25.0 percent compared with 26.1 percent before, and claims based only on red flags failed in all 28 cases (Shiman, 2026). On that view, AI oversight is a modest legal exposure.

I accept the numbers, and I draw a different conclusion. The same study concludes that Caremark matters more as a source of governance norms than as a source of liability (Shiman, 2026). Those norms are what regulators, accreditors, and plaintiffs in other forums now read. Consider Estate of Lokken v. UnitedHealth Group, a coverage case about an AI tool used in post-acute care. On March 9, 2026, a federal magistrate judge in Minnesota ordered discovery that reaches the insurer's internal AI review board, including the identities of its members. The allegations remain disputed (Greenberg et al., 2026). The governance record will be read whether or not a derivative claim succeeds, and one claim in four is not a rate any director should accept when the cost of meeting the standard is a reporting system and a written record.

Retrofit Each Pillar

Closing these gaps does not require a new "AI committee" bolted onto the side of the board. It requires every existing committee, and every director, to reach a new level of technical and ethical literacy, and it requires the board to read each existing instrument again with AI in view: the risk register, the strategy review, the executive evaluation and succession plan, the code of conduct, and the stakeholder plan. The question for each is the same. Does it still describe the organization the board now governs?

Boards must learn to see the digital cracks in their analog foundations, and then retrofit them for a new kind of stress. In my experience, the boards that do this well are not the most technical ones. They are the ones that write down what they asked, what they required, and who reports back.

For the Board

• Does our risk register list every AI system in use or in pilot, including AI inside vendor products, with an owner for each?
• Which of our AI uses would a court regard as mission critical, and what do our minutes show about how we monitor them?
• Does each AI proposal state the change it will make, the measure, and when we will see results, including for investments that are hard to measure?
• Does our succession plan test whether candidates can lead an organization in which people and AI systems work together, and oversee those systems?
• If a patient, an applicant, or a regulator asked why an AI-assisted decision was made, who would answer, and how?
• Which state and international rules apply to each deployment, and from what dates?

Subscribe to Oversight Rounds, from Avancer, for a monthly briefing on what the board should know, and ask, about AI.

References

Addleshaw Goddard. (2026, July 1). EU AI Act: AI Omnibus formally adopted. https://www.addleshawgoddard.com/en/insights/insights-briefings/2026/technology/eu-ai-act-ai-omnibus-formally-adopted/

Bonadurer, J. (2026, February). Delaware court denies dismissal of Caremark oversight claims in Teligent case, highlighting board and officer compliance obligations. Jenner and Block. https://www.jenner.com/en/news-insights/publications/delaware-court-denies-dismissal-of-caremark-oversight-claims-in-teligent-case-highlighting-board-and-officer-compliance-obligations

Bridges, V. K., Christensen, G. S., Doyle, M. F., Fulton, F., Gelbman, S. J., Jain, V. M., Lawless, T. L., & Marotta, M. (2025, December 15). President Trump signs executive order limiting state power to regulate artificial intelligence. K&L Gates. https://www.klgates.com/President-Trump-Signs-Executive-Order-Limiting-State-Power-to-Regulate-Artificial-Intelligence-12-15-2025

The Conference Board. (2026, April 22). Report: In the S&P 500, disclosure of AI risks surges from 12% to 83% [Press release]. PR Newswire. https://digital-release.wowktv.com/business/press-releases/cision/20260422NY41234/report-in-the-sp-500-disclosure-of-ai-risks-surges-from-12-to-83

Cooper, D., Van Quathem, K., Oberschelp de Meneses, A. S., & Brazil, D. (2025, March 6). CJEU clarifies GDPR rights on automated decision-making and trade secrets. Inside Privacy. https://www.insideprivacy.com/gdpr/cjeu-clarifies-gdpr-rights-on-automated-decision-making-and-trade-secrets/

Darch, J. E., Brooks, P., Daudi, S., Hinckley, D., & Kaye, A. (2026, May 19). Colorado scales back AI law, with targeted implications for health care. Ropes and Gray. https://www.ropesgray.com/en/insights/alerts/2026/05/colorado-scales-back-ai-law-with-targeted-implications-for-health-care

Gaskin, J. L. (2026, September 23). Boards say they need more from management on AI. Corporate Compliance Insights. https://www.corporatecomplianceinsights.com/boards-say-they-need-more-from-management-ai/

Goeller, M. B., & Terribile, K. A. (2024, October 23). The continued evolution of Caremark oversight liability. K&L Gates. https://www.klgates.com/The-Continued-Evolution-of-Caremark-Oversight-Liability-10-23-2024

Greenberg, D. S., Heilman, K., & Shlaferman, H. Z. (2026, April 23). Federal court orders broad discovery against UHC in AI coverage denial lawsuit. ArentFox Schiff. https://www.afslaw.com/perspectives/alerts/federal-court-orders-broad-discovery-against-uhc-ai-coverage-denial-lawsuit

Guerra, S., & Kraus, S. (2026, September 30). The 2026 healthcare AI ROI scorecard. Bessemer Venture Partners. https://www.bvp.com/atlas/the-2026-healthcare-ai-roi-scorecard

Healthcare Financial Management Association. (2025, August 12). Health system adoption of AI outpaces internal governance and strategy [Press release]. https://www.hfma.org/health-system-adoption-of-ai-outpaces-internal-governance-and-strategy/

Hunton Andrews Kurth. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy and Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

Lada, J., Neal, B., & Chapman, D. (2025, May 27). Federal court allows collective action lawsuit over alleged AI hiring bias. Holland and Knight. https://www.hklaw.com/en/insights/publications/2025/05/federal-court-allows-collective-action-lawsuit-over-alleged

Montano, M., & Tran, S. (2026, October 8). Newsom approves 3 health care AI bills, vetoes 2. California Health Care Foundation. https://chcf.org/blog/2026/10/08/newsom-approves-3-health-care-ai-bills-vetoes-2

National Association of Corporate Directors. (2025). AI oversight activities conducted by the board [Data table]. 2025 Public Company Board Practices and Oversight Survey. Retrieved October 21, 2026, from https://www.nacdonline.org/all-governance/governance-resources/governance-surveys/surveys-benchmarking/bpo-tables/ai-oversight-activities-conducted-by-the-board

Raymond, F. D., Lidondici, C. M., & Schiltz, T. C. (2023, February 23). Delaware Court of Chancery expands duty of oversight to corporate officers. Faegre Drinker. https://www.faegredrinker.com/en/insights/publications/2023/2/delaware-court-of-chancery-expands-duty-of-oversight-to-corporate-officers

Shiman, Y. (2026, September 2). How Caremark has become oversized. CLS Blue Sky Blog. Columbia Law School. http://clsbluesky.law.columbia.edu/2026/09/02/how-caremark-has-become-oversized/

Zauderer, F. M., Monteleone, J. P., & Fenichel, A. H. (2023, August). Guest post: Board oversight duties, recent adventures in the Delaware Chancery. The D&O Diary. https://www.dandodiary.com/2023/08/articles/director-and-officer-liability/guest-post-board-oversight-duties-recent-adventures-in-the-delaware-chancery/