Boards Flag AI Ownership Gap as Grant Thornton Survey Finds Controls Undocumented
What happened
Grant Thornton published AI risk is rising. Is your board keeping pace?, a practitioner survey and guidance piece drawing on input from executives and board members across US organizations. Surveyed executives identified AI governance and AI use as leading sources of future regulatory scrutiny. Board participants went further, flagging unclear ownership and undefined decision rights as the core structural problem. The firm's guidance called on organizations to document governance processes, build and maintain AI audit trails, and retain evidence of control activities for examination readiness. The findings align with a broader pattern documented in 1,000+ AI Rules, One Audit Gap: Runtime Evidence Is What Regulators Want. That piece identifies the gap between written policies and demonstrable operating evidence as the primary compliance exposure.
Why it matters
- ·Regulators and examiners are moving from asking whether AI policies exist to demanding proof that controls actually ran. Organizations that cannot produce audit trail evidence risk examination findings even if their written policies are solid.
- ·Unclear AI ownership at the board level is not just a governance design problem. It creates personal liability exposure for directors who cannot show they actively oversaw material AI risk. The Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2) expects documented accountability at senior levels, and board-level gaps will appear in examiner findings.
- ·Internal audit functions that have not formally scoped AI into their coverage plans are exposed. If the board cannot articulate who owns AI risk and no audit trail exists, internal audit has no evidence base to rely on. That leaves the third line of defense hollow.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Map every material AI system to a named executive owner and document that mapping in a format the board can review and approve at its next scheduled meeting.
- ☐Ask your internal audit team whether AI systems are explicitly included in this year's audit plan, and request the specific control activities they plan to test.
- ☐Pull the last three board or audit committee reports that touched AI risk and assess whether they contain evidence of controls operating, or only narrative summaries of risk awareness.
- ☐Confirm that your AI audit trail policy specifies retention periods, the format in which evidence must be stored, and who is responsible for producing it during an examination.
- ☐Request a written summary from each business unit operating an AI system describing who made the deployment decision, what approval process was followed, and where the documentation is kept.
What to watch next
Regulatory examiners across banking, insurance, and other supervised sectors are increasingly requesting AI-specific documentation during routine examinations. Organizations should monitor the Interagency Revised Guidance on Model Risk Management (OCC Bulletin 2026-13, SR 26-2). Watch for formal supervisory letters or matters requiring attention tied to AI governance gaps. Proxy advisors have also begun scrutinizing board AI oversight disclosures, as covered in Board AI Oversight Disclosures Are Now Under Proxy-Season Scrutiny. This means the audience for this documentation is expanding beyond regulators to investors.