A Checklist for Discussing AI Governance at the Board of Directors
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
Designing AI governance is no longer limited to rules for using tools on the ground; it has become a management issue that should be addressed at the board of directors level. This is because uses of AI that handle customer data or trade secrets, and applications in fields directly tied to individuals' rights and interests, such as recruitment screening and healthcare, can become legal risks or credibility problems for the company as a whole in the future if left to the judgment of the department in charge alone. What this article describes is a practical proposal for the board of directors to understand material risks and oversee management; it is not intended to require a board resolution for the introduction of every AI tool.
The company decides which business operations it will use AI for and which risks it will manage. Since the matter is being taken up by the board of directors, consider business impact, legal risk and the company's credibility together, without leaning toward technical discussion.
Identifying the Purpose of Use and Its Place in the Business
The first thing to confirm is the purpose for which the company is introducing AI. The nature of the anticipated risks differs fundamentally depending on whether the aim is streamlining routine internal tasks, a core feature of a new product, automating customer service, cross-searching internal knowledge or supporting software development.
At the board of directors, it is important not to end the discussion with abstract slogans such as "promoting DX" or "improving productivity." Only when the discussion is broken down into concrete business units, such as extracting contract provisions, first-line responses in customer support or customer-facing features, do the legal issues to watch and the management resources to deploy become clear. If formal approval is given while the purpose remains vague, staff on the ground may be unsure how far they are allowed to use AI.
How far to position AI as a competitive advantage for the company is also a point to discuss at this stage. Is it limited to assisting with daily work, or is it at the heart of the service's value? The personnel and costs devoted to management are determined according to that level of importance.
Managing Input Data and Preventing Information Leaks
An area of AI governance that requires focused discussion is the standard for handling input data. Feeding personal information, customers' confidential information, undisclosed financial information or M&A-related data into AI systems raises concerns about information leaks and use for other purposes.
What the board of directors should confirm is what types of data input are permitted, how the AI services that may be used are designated, whether personal accounts are allowed or corporate contracts are used, and how logs of submitted prompts are stored and audited. If employees' use of personal accounts is left unchecked, it can hinder identifying information that has leaked outside and deciding whether to report to authorities or the individuals concerned. Consider the establishment of input rules and the log audit system together.
When using external generative AI APIs, the vendor's terms of use, whether input data is repurposed for machine learning, and the response and responsibility in the event of incidents such as information leaks are also subject to review. Discussions that include not only the legal department but also the information systems department and the person responsible for security are essential.
Scope of Use of Outputs and Human Involvement
The scope of business in which AI-generated answers and deliverables will be used is also an issue on which management should set a clear policy. The impact of errors varies depending on whether the outputs are limited to internal reference materials, published externally, adopted as draft contract language or used as reference indicators in personnel evaluations.
The board of directors requests reports, according to materiality, on how management distinguishes between limited, low-risk automated processing and tasks that require human review. Particularly for legal judgments, medical acts and presenting the company's official views to customers, I think it is desirable to always build human verification procedures into operations.
AI-generated text is well formatted, so errors in its content are easily overlooked. Precisely because there is a particular danger in plausible errors passing through as they are, there is value in deciding the acceptable level of use for each business operation.
Operating and Reviewing Internal Rules
For AI governance to function, three elements must mesh: reviewing usage contracts, developing internal rules and training employees.
What tends to stall in practice is getting the rules to take hold on the ground. Merely establishing abstract guidelines does not enable employees to make everyday business judgments. Turning concrete examples into FAQs, such as whether it is acceptable to have AI summarize confidential documents entrusted by customers, whether it may process surveys containing personal data, or whether generated text may be reused as-is in press releases, gives staff clues for making judgments on the ground. It is appropriate to go beyond whether rules formally exist and to keep track of training attendance and the reporting route for violations.
In addition, AI governance is not completed by a single decision. If specific events such as changes in model specifications, legal amendments or revisions to guidelines, near misses within the company and the introduction of new AI features are set in advance as triggers for review, the risk of the rules becoming a dead letter can be reduced.
Ten Issues for the Board of Directors to Review
The practical items to consider in overseeing management are summarized below:
- The specific purpose of AI use and the scope of business covered
- The types of AI services adopted and a review of their contract terms
- A clear boundary between data permitted for input and prohibited information
- The management policy for personal information, customer confidential information and important internal information
- The scope of external use of generated outputs and human verification procedures
- The status of internal guidelines and employee training
- The system for storing operation logs, audit procedures and the incident reporting flow
- Terms of use and policies associated with providing AI services to customers
- Consideration of reputational risk and preparation of external explanations
- Periodic checks and reviews in response to specification changes, legal amendments and the like
The goal is not simply to achieve a perfect score on every item. By identifying the items that cannot be answered, the board can consider what to confirm with management and what management should put in order.
Where to Consult on AI Governance
At LegalAgent, we position AI governance not as mere formal rule compliance but as an important management topic for growing a business soundly while using generative AI. We assist with organizing issues for the board of directors and formulating internal rules through the following:
Services connected to this topic