Directors have fiduciary duties to implement and monitor AI governance systems, particularly when AI represents a mission-critical business risk, and under the Caremark doctrine, sustained or systematic oversight failures may expose them to personal liability. That is the warning Fenwick & West issues to corporate boards, and it reflects a broader consensus among governance experts: AI oversight is no longer optional board hygiene. The practical question for a director is not whether the duty exists, but whether the company's current governance would survive scrutiny. A structured diagnostic—covering strategy, risk assessment, accountability, transparency, and compliance—can turn that abstract legal exposure into a concrete agenda.

The Board's Evolving Fiduciary Duty in the Age of AI

Corporate law has long required board members to discharge fiduciary duties of care and loyalty, which require them to make informed decisions in the best interest of the company. As Robert Eccles wrote on the Harvard Law School Forum on Corporate Governance, current litigation trends indicate that directors are more likely to face personal liability for AI-supported mishaps as the potential impact on companies becomes clearer, much as they did in cybersecurity. Directors who fail to uphold their fiduciary duty and mitigate preventable harms from AI systems their companies deploy expose both the company and themselves to legal liability.

The National Association of Corporate Directors, working with the Data & Trust Alliance, frames the task as board readiness: with boards anticipating significant AI impact on their businesses, they must evaluate their own preparedness, understand the company's current engagement with AI, integrate AI into strategy and risk discussions, and leverage existing committees to oversee AI components where they are most appropriately governed. Boards do not need to become technical experts; they need enough information, advice, and expertise to ask the right questions and validate management's answers.

Caremark Standard: The Legal Stakes of AI Oversight

The Caremark doctrine, a Delaware law standard, holds directors to a duty of oversight that legal scholars describe as subsidiary to the duties of loyalty and care. It does not demand perfect outcomes; it demands a good-faith effort to establish and maintain an effective monitoring system. Writing on Oxford's business law blog, Pierluigi Matera argues that AI does not transform Caremark into a negligence regime or make fiduciaries insurers of technological performance—what it does is stress-test the doctrine. Senior officers responsible for compliance, technology, risk, or data governance must ensure that oversight-relevant information flows upward and that credible warning signals are escalated rather than suppressed; delegation defines the perimeter of the duty, it does not dilute it.

The boundary of liability is still being drawn. In the SolarWinds litigation, stockholders sought to hold the board liable for alleged cybersecurity weaknesses, but the Delaware Court of Chancery characterized cybersecurity as a "business risk" protected by the business judgment rule, dismissing the case. Per the court, a failure to oversee ordinary business risks becomes an actionable Caremark claim only if the failure violates positive law—and the court noted the board had defined cybersecurity oversight mechanisms. As NACD-published commentary by Sarah Eichenberger, Jonathan Rotenberg, and Caroline Sabatier observes, precisely what Caremark requires when AI-powered technology presents more than simply a business risk remains an open question. The safest reading for directors: define the oversight mechanisms before the question reaches a courtroom.

Identifying Mission-Critical AI Risks for Board Scrutiny

Non-technical directors can still map the concrete risk categories that fall within their oversight purview. Holly Gregory, writing on the Harvard Law School Forum on Corporate Governance, notes that AI systems are heavily reliant on data and often implicate privacy and data protection regulation, while generative AI in particular may affect intellectual property protections. Boards need to stay apprised of legislative and regulatory initiatives in the US and abroad and oversee compliance, relevant policies, information systems, and internal controls.

A guest analysis published by Kevin LaCroix on the D&O Diary breaks the risk surface into components a board can interrogate: understanding a system's intended use and the populations it affects; identifying potential harms if it fails, produces biased outputs, or is used outside its intended scope; evaluating external risks from the supply chain, such as the developer's governance practices, the origin and quality of training data, and reliance on third-party foundation models or APIs; and identifying relevant legal and regulatory obligations based on the system's function and operating jurisdictions. NACD's guidance adds typical mitigation practices—AI impact assessments before and during model development, and periodic algorithmic audits to certify a model remains safe. Model drift, data quality, bias, and regulatory non-compliance are the recurring failure modes these mechanisms are designed to catch.

AI Governance Maturity Diagnostic Checklist for Boards

Fenwick recommends boards adopt an AI governance framework aligned to business goals covering five pillars: strategy and investment, risk assessment and oversight, accountability for AI systems and decisions, stakeholder transparency, and legal and regulatory compliance. The checklist below organizes board-level inquiry questions drawn from governance guidance into those five pillars. Use it in a board or committee meeting: for each row, ask management the listed questions, record whether a documented answer exists, and flag any pillar where the answer is "we don't know" or "no one owns that."

Five-pillar diagnostic: board questions to assess AI governance maturity
PillarOversight AreaQuestions the Board Should Ask Management
Strategy and Investment Strategic alignment How does each AI initiative align with business strategy? Does the board or responsible committee appropriately reflect AI issues on its agenda, and does it have adequate access to information, advice, and expertise on AI matters?
Risk Assessment and Oversight Risk identification and mitigation What is management's framework for identifying, assessing, and mitigating AI risks? Are AI impact assessments run before and during development, and are periodic algorithmic audits performed? Have we discussed misuse and unintended consequences for employees, customers, other stakeholders, and the environment?
Accountability Internal controls and responsibility Who in the company is responsible for monitoring AI use and AI-specific compliance and risk management? Has the board validated that management's governance framework includes accountability and controls implemented within the organization?
Stakeholder Transparency External communication and trust How transparent are our AI systems about intended use and impact on affected populations? Do policies for generative AI address potential bias, inaccuracy, breach of privacy, consumer protection, cyber and data security, IP protection, and quality control?
Legal and Regulatory Compliance Regulatory adherence Is the board regularly updated on emerging AI legislation and regulation? Which legal and regulatory obligations attach to each system given its function and operating jurisdictions? Are controls in place for AI use in tracking employee performance and for AI-specific requirements such as "secure by design"?

The diagnostic logic is cumulative: a company can score well on strategy yet fail on accountability, which is precisely the gap Caremark claims target. A board that cannot name the person responsible for AI risk monitoring, or that has never reviewed the company's AI policies, has identified its next agenda item.

Actionable Steps for Proactive AI Oversight

Boards should proactively establish and continuously monitor a robust AI governance framework, ensuring clear accountability and regular assessments of mission-critical AI systems. Joshua Geltzer, a defense and national security partner at WilmerHale, puts the commercial case plainly: "To promote long-term growth, [b]oards need to get in the AI game to ensure adequate procedures are in place to empower responsible, effective AI deployment at scale." Responsible AI governance, he argues, is not an impediment to rapid innovation and growth, but a precondition.

The measurable indicator of progress is procedural: regular board meeting agendas include dedicated AI risk oversight discussions, and management provides periodic reports on AI governance framework implementation and key risk indicators. NACD's guidance supports the mechanism—by asking questions and validating the framework, the board directs the organization toward responsible AI engagement with appropriate management and accountability. This article is governance guidance, not legal advice; directors should consult counsel on Delaware law specifics, and the framework is strategic rather than a technical audit methodology. The next milestone to watch is judicial: how Delaware courts apply Caremark when AI presents more than an ordinary business risk, a question the SolarWinds dismissal left open.

Sources