What is the AI Board Governance Compass?

The AI Board Governance Compass is a proprietary assessment framework developed by Vela Board Advisors. It maps board readiness across 16 governance indicators and four dimensions: Individual (director AI literacy and personal accountability), Board (collective oversight capability), Organization (alignment between executive leadership and board-level AI signals), and Stakeholder (regulatory, insurer, and investor expectations). It produces a scored diagnostic that surfaces governance gaps and a priority queue for action.

What are board directors personally liable for in AI governance?

Board directors can face personal liability for AI governance failures including failure to exercise adequate oversight, approving misleading AI-related disclosures (AI washing), and failing to establish defensible governance processes. D&O insurance often does not cover AI-specific incidents, creating a gap between assumed and actual coverage that boards need to actively map.

How should boards oversee AI deployments?

Boards should establish a baseline of AI literacy among directors, create clear escalation pathways for AI risk, review fairness and bias testing practices, understand the insurance coverage architecture across D&O, cyber, and E&O policies, and maintain a documented governance record demonstrating active oversight. The AI Board Governance Compass provides a structured way to assess and improve across all of these areas.

What is AI washing and why does it matter for boards?

AI washing occurs when a company overstates the capabilities or use of AI in its products or communications. Directors who approve such communications without adequate scrutiny can face personal liability. Boards need the skills to identify AI washing risks in materials brought for approval.

Does D&O insurance cover AI governance failures?

Standard D&O insurance frequently does not cover AI-related governance failures in the way boards assume. Coverage gaps often exist at the intersection of D&O, cyber liability, and E&O policies. When an AI system causes harm, each insurance tower may claim the loss belongs to another, leaving boards exposed. Mapping this coverage architecture is a board governance responsibility.

What is the four-step Vela engagement model?

Vela engagements follow four stages: (1) Assessment, the AI Board Governance Compass maps readiness across 16 indicators and establishes a defensible baseline; (2) Workshop, a facilitated session built around the board's real risks and opportunities; (3) Simulation, a live AI governance scenario where directors make real-time decisions to build instincts; (4) Record, a structured governance record demonstrating active oversight to regulators, insurers, and shareholders.

Regulations & Standards

Know what your board is accountable for.

AI oversight has become a board-level duty. This is the landscape of obligations, standards, and exposure, in board language, not legalese.

AI didn't change your duties. It raised the stakes.

The fiduciary duties boards already hold extend directly to AI. The novelty is the speed, opacity, and reach of the decisions now being made below the boardroom.

Duty of Care

Decide on an informed basis.

Directors must understand the AI systems the company deploys well enough to oversee them, not to code, but to ask the right questions and weigh the risks before approving.

Duty of Loyalty

Act in good faith.

Oversight in good faith means ensuring information and reporting systems exist for the risks that matter. For many companies, AI is now one of them.

Duty of Oversight

Mind the mission-critical.

Under the Caremark line of cases and Marchand, courts expect a good-faith effort to oversee mission-critical risks, and to document that the board did.

A widening, uneven map.

There is no single AI rulebook. Obligations arrive by jurisdiction, by sector, and by use case, and they are moving.

European Union

EU AI Act

A risk-tiered regime. High-risk systems face conformity assessment, documentation, human-oversight, and transparency duties, with extraterritorial reach and significant penalties.

United States · Federal

SEC & FTC

No omnibus law yet. The SEC scrutinizes overstated AI claims ("AI washing") and material-incident disclosure; the FTC pursues deceptive or unfair AI practices.

United States · State

A patchwork, accelerating

Colorado's AI Act (algorithmic-discrimination duties), NYC Local Law 144 (bias audits for hiring tools), Illinois BIPA (biometrics), and Utah's AI disclosure law, among others.

Sector-specific

Where AI is already regulated

Model-risk management in banking (SR 11-7), fair lending (ECOA / FHA), medical AI as a device (FDA), and the NAIC model bulletin for insurers.

Standards worth knowing by name.

Voluntary frameworks increasingly set the baseline regulators, insurers, and courts measure against.

NIST

AI Risk Management Framework

The de facto US reference. Organizes AI risk into four functions, Govern, Map, Measure, Manage, and is widely cited in policy and contracts.

ISO / IEC

42001 & 23894

ISO/IEC 42001 is the first certifiable AI management-system standard; 23894 provides AI risk-management guidance. Certification is becoming a procurement signal.

OECD · DOJ

Principles & enforcement

The OECD AI Principles set widely adopted values; the DOJ's evaluation of corporate compliance programs now probes how firms manage AI and emerging-tech risk.

Where boards are exposed.

The same capability that creates value concentrates liability. These are the fault lines.

Securities & disclosure

Overstating AI capability to investors, or failing to disclose a material AI incident, draws SEC scrutiny and shareholder litigation.

Discrimination

Biased hiring, lending, and pricing models create exposure under Title VII, the ADEA, ECOA, and the Fair Housing Act, vendor opacity is no defense.

IP & copyright

Training data of uncertain provenance, and unclear ownership of AI-generated output, can impair assets and trigger injunctions.

Privacy & data

Biometric, personal-data, and cross-border data flows through AI systems carry their own fast-moving statutory regimes.

Vendor & agentic

Dependency on a third-party model, and autonomous agents acting without human review, shift risk the board may not have priced.

Safety & product

AI-enabled products that cause harm raise recall, disclosure, and liability questions that reach the board.

What "good" looks like on the record.

Defensible oversight is evidenced, not assumed. These are the artifacts that show a board did its job.

AI on the agenda with a named committee or director who owns oversight.
A current inventory of where AI is deployed and what each system depends on.
An acceptable-use policy with clear human-in-the-loop thresholds.
Escalation and disclosure pathways for AI incidents, tested before they're needed.
Regular, documented education so the board can ask informed questions.
A written record that the board asked the hard questions, and what it decided.

This page is a general orientation for directors, not legal advice. Regulations and standards referenced here evolve quickly and vary by jurisdiction and industry. Consult qualified counsel about your board's specific obligations.

Turn obligation into a defensible record.

The Compass translates these obligations into a governance baseline your board can act on, and evidence. Request a briefing to see how.

Request a Briefing Explore the Compass