AI Governance Institute
← News
Corporate Policy2026-05-05

AI Incidents Surged Over 32% in 2024, NACD Guidance Urges Boards to Adapt Oversight Frameworks

Source

Tuning Corporate Governance for AI Adoption

National Association of Corporate Directors (NACD)

What happened

The National Association of Corporate Directors (NACD) has published Tuning Corporate Governance for AI Adoption as part of its 2025 Governance Outlook series, targeting US-based corporate boards. The guidance presents a structured approach for directors to refine existing oversight mechanisms rather than build entirely new governance structures from scratch, emphasizing integration of AI considerations into established risk, audit, and reporting frameworks. Two key data points anchor the document: a 26% year-over-year increase in AI incidents from 2022 to 2023, followed by an acceleration to more than 32% growth in 2024. The NACD specifically directs boards to assess how AI deployment shifts company-wide risk profiles and to define clear escalation and reporting pathways between management and the board. The guidance also aligns with emerging ISO 42001 implementation practice, which similarly encourages integration of AI management into established organizational systems rather than siloed programs.

Why it matters

  • ·Boards at US-listed companies face growing regulatory exposure as the SEC has signaled expectations around material risk disclosure, making the absence of structured board-level AI oversight a potential disclosure liability rather than merely a governance gap.
  • ·The documented acceleration in AI incident rates, exceeding 32% growth in 2024, means operational risk profiles are shifting faster than most governance frameworks have been updated, creating tangible gaps in incident escalation, model monitoring, and third-party vendor oversight.
  • ·Organizations without formally documented AI reporting lines and risk classification processes face organizational risk during shareholder engagement seasons and regulatory inquiries, particularly in sectors subject to California, Colorado, or federal financial and healthcare AI requirements.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

BRD-001Director AI Literacy and Competency AssessmentCMP-010AI Use in Regulatory Reporting and Risk ModelingHOC-001AI System Risk ClassificationHOC-006Override and Escalation ProceduresIRC-001AI Incident ClassificationIRC-002AI Incident Response PlaybookIRC-003AI Harm Notification Procedures

What to do now

  • ☐Formally embed AI risk into the existing enterprise risk management cycle and document board reporting lines before the next governance review or shareholder engagement season.
  • ☐Produce a current-state inventory of all AI systems in production and map each system against the company's existing risk tolerance thresholds to support board-level reporting with specificity.
  • ☐Audit existing incident response and escalation procedures to confirm they explicitly cover AI-specific failure modes including model drift, data integrity failures, and third-party AI vendor incidents.
  • ☐Review board reporting on AI for organizations subject to SEC disclosure obligations or state-level transparency laws in California and Colorado to assess whether frequency and specificity meet emerging regulatory and investor expectations.
  • ☐Engage legal, risk, and technology teams jointly to evaluate whether current AI governance structures reflect the NACD and ISO 42001 principle of integration into established organizational systems rather than parallel or siloed programs.

What to watch next

Compliance teams should monitor whether the SEC issues further guidance or enforcement actions clarifying materiality thresholds for AI-related risk disclosures, as board-level accountability expectations are likely to sharpen in 2025. Ongoing rulemaking and enforcement patterns in California and Colorado regarding AI transparency obligations will also be relevant for organizations operating across multiple US jurisdictions. Teams should additionally track updates to ISO 42001 implementation guidance and any NACD follow-on publications that may provide more granular board reporting templates or incident classification frameworks.

Related Coverage

Enforcement2026-11-05

DOJ Super Intelligence Task Force Puts Criminal Liability on Enterprise AI Use

The U.S. Department of Justice has established the Super Intelligence Task Force (DOJ-SITF), co-chaired by two senior DOJ officials, to coordinate criminal and civil enforcement involving AI. The task force will develop prosecution guidance for unlawful AI conduct and absorbs the prior AI Litigation Task Force. It also serves as DOJ's primary liaison to the White House-led Super Intelligence Force.

Research2026-11-02

AI-Native Breaches Expose Critical Gaps in Enterprise Incident Response

A Reuters legal analysis published October 27, 2026 identifies AI-specific breach types including model manipulation, data poisoning, prompt injection, model theft, and deepfake fraud. These breach types require investigation and notification procedures that most enterprise incident response programs do not yet have. The analysis finds that the US has no single federal framework governing AI security incidents, leaving organizations to navigate fragmented regulatory responsibilities across multiple agencies. The core recommendation is to build AI-specific logging, evidence preservation, escalation, and cross-regulator notification procedures before an incident occurs.

Research2026-10-29

Singapore Proposes International AI Incident-Reporting Pilot, Signaling Future Obligations

Singapore Prime Minister Lawrence Wong has proposed an international pilot program for sharing AI incident and near-miss data across governments and interested parties. The proposal would establish common incident categories and secure information-sharing practices. It signals a likely future shift from voluntary internal incident tracking to structured cross-border regulatory disclosure.