Why AI governance is a board job, not a management delegation

Boards are being asked to oversee AI systems that touch strategy, financial reporting, risk and ethics all at once, often without the training to know what a good answer even looks like. That capability gap is the real risk, more than any single model failing in production. A board that can't ask the right questions ends up abdicating oversight by default.

Board-level AI oversight isn't the same job as operational AI management. Management builds and runs the systems; the board's job is to test four things: the strategic case management is making for AI investment, the material risks (operational failure, regulatory exposure, reputational harm, over-dependence), whether AI use actually matches the company's stated values, and whether there's a clear line of accountability plus independent verification that the governance is real, not just documented.

ISO 42001 is the management-system standard built for exactly this, and it's the most useful lever a board has, not because certification is the goal, but because the surveillance and recertification cycle forces the governance discipline to stay live rather than becoming a one-off project. Boards don't need to become AI experts. They need the standing questions, the governance structure, and the discipline to keep asking them.