What is the AI Board Governance Compass?

The AI Board Governance Compass is a proprietary assessment framework developed by Vela Board Advisors. It maps board readiness across 16 governance indicators and four dimensions: Individual (director AI literacy and personal accountability), Board (collective oversight capability), Organization (alignment between executive leadership and board-level AI signals), and Stakeholder (regulatory, insurer, and investor expectations). It produces a scored diagnostic that surfaces governance gaps and a priority queue for action.

What are board directors personally liable for in AI governance?

Board directors can face personal liability for AI governance failures including failure to exercise adequate oversight, approving misleading AI-related disclosures (AI washing), and failing to establish defensible governance processes. D&O insurance often does not cover AI-specific incidents, creating a gap between assumed and actual coverage that boards need to actively map.

How should boards oversee AI deployments?

Boards should establish a baseline of AI literacy among directors, create clear escalation pathways for AI risk, review fairness and bias testing practices, understand the insurance coverage architecture across D&O, cyber, and E&O policies, and maintain a documented governance record demonstrating active oversight. The AI Board Governance Compass provides a structured way to assess and improve across all of these areas.

What is AI washing and why does it matter for boards?

AI washing occurs when a company overstates the capabilities or use of AI in its products or communications. Directors who approve such communications without adequate scrutiny can face personal liability. Boards need the skills to identify AI washing risks in materials brought for approval.

Does D&O insurance cover AI governance failures?

Standard D&O insurance frequently does not cover AI-related governance failures in the way boards assume. Coverage gaps often exist at the intersection of D&O, cyber liability, and E&O policies. When an AI system causes harm, each insurance tower may claim the loss belongs to another, leaving boards exposed. Mapping this coverage architecture is a board governance responsibility.

What is the four-step Vela engagement model?

Vela engagements follow four stages: (1) Assessment, the AI Board Governance Compass maps readiness across 16 indicators and establishes a defensible baseline; (2) Workshop, a facilitated session built around the board's real risks and opportunities; (3) Simulation, a live AI governance scenario where directors make real-time decisions to build instincts; (4) Record, a structured governance record demonstrating active oversight to regulators, insurers, and shareholders.

The Privilege on the Wire | Board Case Study

The situation

DataFlow Solutions is a PE-backed SaaS platform, 850 employees, $95M ARR growing 25%, selling workflow automation to law, consulting, and accounting firms. Seventy-eight percent of customers are demanding AI features, and a competitor has just leaked client data to a third-party model, putting the risk on everyone's radar.

Forty percent of DataFlow's customers are law firms handling privileged data, and two major firm clients cannot use any feature that sends data to an external provider. The board faces three paths: a fast third-party API where data leaves the premises; a private small language model on its own infrastructure at $400–600K; or a full on-premises build at $2M with a six-month delay. The EU AI Act now classifies legal AI tools as high-risk.

The PE investment committee meets in six weeks expecting a clear AI strategy, and a delayed rollout could cut the 2026 exit valuation by 15–20%. But even once data residency is solved, a newer gap opens: DataFlow has no framework for governing agentic AI that takes autonomous actions inside privileged client workflows.

“Should we use third-party AI, deploy a private model on our own infrastructure, or build full on-premises capability? And whichever path we choose, do we have the guardrails for AI that acts autonomously inside client workflows?”
Marie Rodriguez · CEO

The decision on the table

Choose among three deployment paths under privilege, data-residency, and EU AI Act constraints.
Reconcile a six-week PE timeline and the exit valuation against a six-month build.
Govern agentic AI acting autonomously inside privileged legal workflows, a framework that does not yet exist.

The Privilege on the Wire

Run this case with your board.