By Eric Mahler Founder and Managing Partner, Aretos Advisory
There’s a specific kind of conversation happening in boardrooms right now, and it’s worth naming honestly because most of the advice circulating about it misses the point. Directors are being told they need “AI literacy.” Consultants are offering briefings. Board education committees are scheduling sessions. All of it operates on the assumption that the gap is technical, that directors don’t yet understand enough about how large language models work, and once they do, oversight will follow naturally.
That’s not the gap. Most directors don’t need to understand transformer architecture any more than they need to understand the mechanics of a jet engine to oversee an airline. What they need is something narrower and, frankly, more within their existing skill set: the ability to ask the right questions about a system whose internal workings they’ll never fully see.
The real oversight problem
A few numbers are worth sitting with. Only about a quarter of large public companies currently disclose any board-level AI oversight framework. That’s not because boards don’t care, AI now regularly ranks among the top few board-level priorities in director surveys. It’s because most boards don’t yet have a clear model for what oversight of something like this is supposed to look like.
Compare that to how boards oversee financial risk, or cybersecurity, or regulatory compliance. In each case, directors aren’t expected to be forensic accountants, penetration testers, or compliance attorneys. They’re expected to know what questions separate a well-managed risk from a poorly managed one, and to have enough structural understanding to tell whether management’s answers actually hold up.
AI oversight needs the same kind of translation, a small number of durable, non-technical questions that work regardless of which specific tools or vendors a company is using, because those will keep changing faster than any board education program can track.
Five questions that matter more than the technical briefing
Where is AI actually making decisions, versus assisting a person who makes the decision? This sounds simple and most companies can’t answer it precisely. The honest answer is often “we’re not entirely sure,” which is itself the finding.
What happens when the system is confidently wrong? Every AI system produces incorrect outputs with the same tone of confidence as correct ones. The question isn’t whether the system will be wrong, it will be. The question is whether anyone downstream is positioned to catch it, and how that gets discovered before it becomes a public problem instead of an internal one.
Who is accountable, by name, when something goes wrong? Not a committee. Not “the AI governance framework.” A specific person who would have to explain, plainly, what happened and why. If a board can’t answer this quickly, the accountability structure doesn’t really exist yet, it’s aspirational.
What’s the gap between what we’ve documented and what’s actually happening operationally? Written policies are easy to produce and easy to overstate. The more useful question is how the board would find out if practice had drifted from policy, not whether a policy exists, but whether anyone would notice if it stopped being followed.
What would we say publicly, on short notice, if this went wrong tomorrow? This is less a technical question than a preparedness one, and it tends to surface gaps faster than any of the others. A board that can’t sketch even a rough answer hasn’t actually thought through the scenario, it’s been thinking about AI as a strategic opportunity, not yet as a risk requiring the same seriousness as any other material exposure.
Why this framing matters
None of these five questions require a director to understand how a model is trained. They require the same judgment directors already apply to every other domain they oversee without being domain experts themselves: knowing what a good answer sounds like, noticing when management is answering a different, easier question than the one that was asked, and being willing to keep asking until the real answer surfaces.
The organizations that get this right aren’t the ones with the most technically sophisticated board members. They’re the ones where the board has decided that AI oversight is a governance responsibility like any other material risk — not a special technical category that gets deferred to management because it feels unfamiliar. That deference is understandable. It’s also exactly the gap that turns manageable problems into disclosure issues, and disclosure issues into the kind of headline that boards spend the rest of a fiscal year explaining.
The technology will keep changing faster than any board can fully track. The questions above don’t depend on it changing slower. That’s the point.
About the Author
Eric Mahler is the founder and Managing Partner of Aretos Advisory. He has spent thirty years advising boards and executive teams across industries. He is the author of The Center of the Compass, forthcoming from Amplify Publishing in December 2026, and a keynote speaker on leadership, AI governance, and organizational resilience.
ericmahler.com | Connect on LinkedIn
Aretos Advisory works with boards and executive teams navigating AI transformation, governance, and leadership coherence. If this piece reflects challenges your organization is working through, we’d welcome the conversation.
© 2026 Aretos Advisory. All rights reserved.