NACD Board Governance Guide Raises the Bar on Director AI Competency and ERM Integration

What happened

Why it matters

• ·Regulatory and litigation exposure: Courts and the SEC have increasingly used recognized practitioner standards to assess board oversight adequacy in securities and derivative actions; NACD guidance now gives plaintiffs and regulators a named benchmark against which director conduct on AI risk can be measured, raising the stakes for boards that have not formally addressed AI governance.
• ·Operational impact on ERM and reporting programs: The requirement to establish AI-specific KPIs and integrate AI risk into ERM frameworks means compliance and risk functions will need to produce board-ready AI risk data on a recurring basis, which most organizations do not yet have a formal process to generate.
• ·Director competency as a governance gap: The guide's call for boards to assess and close their own AI competency creates a new accountability layer above management; organizations that cannot demonstrate director-level AI literacy may face heightened scrutiny from institutional investors and proxy advisory firms applying AI governance criteria.

Governance controls affected

What to do now

• ☐Map the NACD guide's requirements against your current board reporting cadence and identify gaps in AI-specific risk data delivered to directors.
• ☐Commission a director AI competency assessment using BRD-001 criteria and document findings before the next board cycle.
• ☐Update your ERM framework to classify AI risk as a standalone category with defined risk appetite and tolerance statements under BRD-006.
• ☐Develop at least three AI-specific KPIs for board consumption, covering risk exposure, incident trends, and governance program maturity, and establish a reporting baseline.
• ☐Brief the audit committee on the NACD publication and its implications for board oversight adequacy, and capture that briefing in board minutes to create a contemporaneous record.

What to watch next

Compliance teams should monitor whether the SEC references the NACD guide in future AI-related disclosure guidance or enforcement actions, as agency staff have previously cited NACD publications when evaluating board oversight adequacy. Institutional investors and proxy advisory firms are also refining their AI governance voting criteria for the 2027 proxy season, and the NACD guide is likely to inform those frameworks. Organizations subject to the SEC AI Governance Guidance should assess whether their current board disclosures satisfy the elevated competency and ERM integration expectations the NACD publication now codifies. Any forthcoming NACD updates to this guide, particularly if they incorporate sector-specific obligations, should be tracked and compared against existing internal governance documentation.