AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2026-06-30

U.S. AI Action Plan Shifts AI Risk Ownership to Corporate Boards, Harvard Ethics Center Warns

What happened

The Harvard University Ethics Center published AI Governance at a Crossroads: America's AI Action Plan and its Impact on Businesses on November 10, 2025, offering practitioner-oriented analysis of how the federal government's deregulatory posture on AI reshapes corporate governance obligations. The commentary contends that by pulling back from prescriptive federal rules, the AI Action Plan places explicit responsibility on corporate boards and senior management to identify, assess, and mitigate AI-related risks within their organizations. Rather than waiting for regulatory mandates to define the standard of care, boards are now positioned as the primary accountability layer for AI governance decisions. The commentary specifically highlights that enterprise risk mitigation for individual AI use cases is now a board-level function, with direct implications for executive liability when governance gaps produce adverse outcomes. The analysis applies primarily to U.S.-domiciled organizations but carries implications for multinationals whose U.S. operations operate under the federal deregulatory framework.

Why it matters

  • ·Regulatory exposure shifts inward: without binding federal AI rules to define a compliance floor, organizations face greater litigation and enforcement risk if board-level AI oversight is later judged inadequate by courts, the SEC, or state regulators acting in the vacuum left by federal inaction.
  • ·Operational impact on governance structures: compliance programs built around anticipated federal mandates may be underprepared for the immediate expectation that boards and C-suites actively govern AI risk, requiring new committee charters, reporting cadences, and director competency standards now rather than at a future regulatory deadline.
  • ·Organizational risk of liability concentration: directing accountability to senior management without a corresponding formal framework creates personal liability exposure for executives and directors, particularly in sectors already subject to fiduciary, financial, or consumer protection oversight.

Governance controls affected

HOC-007Board AI Risk Reporting and Escalation ThresholdsBRD-001Director AI Literacy and Competency AssessmentBRD-002AI Governance Committee Charter and Decision RightsBRD-006AI Risk Tolerance and Appetite DocumentationBRD-005AI Governance Maturity Assessment

What to do now

  • ☐Assess whether your board's current AI risk reporting cadence and escalation thresholds (HOC-007) reflect the heightened accountability standard implied by the deregulatory environment, and update committee charters if they do not.
  • ☐Conduct a director AI literacy assessment (BRD-001) to determine whether board members have sufficient competency to discharge the oversight role the AI Action Plan now explicitly assigns to them.
  • ☐Document the organization's AI risk tolerance and appetite (BRD-006) in a board-approved policy so that executive decisions on AI use cases can be evaluated against a defined governance standard rather than ad hoc judgment.
  • ☐Map existing AI governance program milestones (MGV-003) against a self-regulatory adequacy standard (BRD-008) to identify gaps that a regulator, plaintiff, or institutional investor could characterize as governance failures.
  • ☐Brief the audit committee on the Harvard commentary and commission an AI governance maturity assessment (BRD-005) to establish a defensible baseline before any enforcement action or litigation creates pressure to do so reactively.

What to watch next

Compliance teams should monitor whether the SEC, FTC, or state attorneys general move to fill the governance vacuum created by federal deregulation through enforcement actions that implicitly set board accountability standards for AI. The Commerce Department's ongoing evaluation of state AI laws is a parallel signal worth tracking, as state-level regimes may impose the prescriptive board oversight requirements the federal government has chosen not to mandate. Investor relations teams should also watch for proxy advisory firms and institutional shareholders incorporating AI governance adequacy into voting criteria, which could translate board-level accountability expectations into shareholder pressure ahead of any formal regulatory action.

AI Governance Weekly

Weekly intelligence on AI regulation, enforcement, and governance. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-07-03

NACD Board AI Governance Guide Puts Director Competency and ERM Integration at the Center of Oversight Accountability

The National Association of Corporate Directors (NACD) has published 'Director Essentials: Implementing AI Governance,' a practical guide establishing what boards must do to govern AI responsibly at the enterprise level. The guide calls on directors to integrate AI risk into enterprise risk management frameworks, assess their own AI competency, update committee charters, and establish AI-specific KPIs. Compliance teams can use the guidance to benchmark board-level accountability structures and identify gaps in governance program design.

Corporate Policy2026-06-27

NACD Tells Boards to Recalibrate AI Risk Appetite and Assign Clear Governance Ownership in 2025 Outlook

The National Association of Corporate Directors has published board-level guidance urging directors to refine existing oversight mechanisms for AI adoption, designate accountable leaders, and integrate data governance as a strategic priority. The guidance addresses how AI reshapes corporate risk profiles, including exposure to hallucinations and algorithmic bias. It applies broadly to US-listed companies and any organization where the board has formal oversight responsibilities for technology risk.

Research2026-07-09

Multi-Tiered AI Governance Committees Tested at Scale: Banco Bradesco and TELUS Case Studies Reveal What Works

The AI Company Data Initiative published a case study report in March 2026 documenting how Banco Bradesco and TELUS implemented structured AI governance models featuring strategic steering committees, quarterly review cycles, and mandatory human-rights-based safeguards. The report provides implementation-level detail on separating strategic and operational governance layers and embedding human rights considerations into AI lifecycle management. Compliance teams can use the findings as a benchmark for their own governance architecture.