Most of the biggest American companies now name AI as a risk in their filings, yet fewer than 3% of their directors have real AI expertise. Boards are trying to fix that by recruiting experts. It helps, but an expert on the board is not the same as a board that oversees AI, and the difference matters to anyone who manages people, money or customers.
Knowing how AI works is not the same as watching it
Someone can understand exactly how a language model works and never ask who in the company answers for it, or what an AI agent is allowed to spend. Knowledge sits in a person's head. Oversight is something a person does, on a schedule, whether or not anyone is looking.
There is also no single AI item on a board's agenda for an expert to own. AI has already shaped the hiring, pricing and credit decisions that every director ends up voting on. And one expert whose judgment nobody else is equipped to question is a weak check, however good the expert is.
Finance already solved this in three parts
The first part is practice. An auditor does not accept that a control exists because people believe in it; they want to see it was done. The AI version is to ask each director when they last asked to see the list of AI systems the company uses, and whether they ask every time.
The second part is the weakest link. Under US auditing standards, one material weakness means a company's controls over its financial reporting cannot be called effective, however strong the rest is. A former finance chief will question the numbers and a technologist will question the model, and each can quietly skip the questions they are less comfortable with. Judging people by their weakest area stops that.
The third part is two sets of eyes. A material payment never rests on one person, and AI oversight can work the same way: in every area, at least two people who go deep.
Companies that wrote AI rules have often not followed them, and nearly half of firms already skip their own AI safety rules. A rule nobody checks behaves like knowledge nobody uses.
What this looks like in a company of forty people
Take a small distributor whose AI assistant answers supplier emails, drafts quotes and approves small refunds. The sales manager set it up, so the owner treats her as the AI person. The owner asks the three managers the same questions. When did you last check what the assistant can send or promise? Which question about it could you least answer? Who besides the person who set it up has read what it did last month?
The likely answers are that only the sales manager has looked, and that the finance manager cannot say which tools hold customer data. The fixes are small: a written list of the tools, a limit on what the assistant can spend or promise, and a second person who reads its log. I estimate that at about an hour a month, spread across two people, which is cheap next to one wrongly approved refund pattern that nobody noticed for a quarter.
I expect boards to be asked, within a few years, to show the last time they checked their AI, the way they now show their last audit. The person who knows the most about AI in your company is the worst person to be the only one checking it, because nobody else is equipped to disagree with them.