Why AI changes the boardroom calculus
Lesson 2 of 4 in Board-Level AI Governance: ISO/IEC 38507 and Organizational Accountability.
Boards have governed technology for decades. Why does AI need its own standard? Because AI shifts five properties of organisational decision-making at once — and each one quietly breaks an instrument the board already relies on. 38507’s central chapters are, in essence, a tour of these five disruptions and the adjustments each demands.
Speed and scale — decisions happen faster than oversight
A biased human loan officer harms the applicants they meet; a biased model harms every applicant, identically, at machine speed. Australia’s Robodebt scheme issued hundreds of thousands of automated debt notices from a flawed income-averaging calculation before governance caught up — the Royal Commission (2023) traced the disaster to leaders who scaled an automated decision process without ever validating its legality or logic. Instrument that breaks: annual review cycles. Adjustment: escalation thresholds and monitoring calibrated to the decision volume, not the calendar.
Opacity — the board cannot inspect what it directs
Directors are accustomed to asking "why did we do X?" and receiving an answer. For learned systems, the honest answer may be statistical, partial, or unavailable. That does not suspend the duty of care — it changes the evidence a board must demand: behavioural testing, disaggregated outcomes, assurance over the process, since inspection of the logic is off the table. A board that accepts "the algorithm is proprietary/complex" as a reporting answer has delegated its judgment to the thing it is supposed to oversee.
Adaptability — the approved system is not the running system
Boards approve things at points in time; learning systems change after approval. Drift, retraining, and feedback loops mean the system operating in month eighteen may behave materially unlike the one evaluated in month zero. Adjustment: direction must attach to continuing conditions (performance floors, re-assessment triggers, kill criteria) rather than one-time green lights — and monitoring must verify those conditions still hold.
New stakeholder harms — the risk register gains victims
Classic IT governance protected the organisation: its money, data, uptime, reputation. AI governance must also weigh harm to people outside the organisation — the scored, screened, and surveilled. The Dutch childcare-benefits scandal is the permanent exhibit: an algorithmic fraud-flagging system wrongly ruined thousands of families, and the consequences reached the top — the entire Rutte cabinet resigned in January 2021. Stakeholder harm became a head-of-government-level accountability event, which is precisely the altitude 38507 addresses.
Data dependence — AI governance inherits data governance
Every AI behaviour is downstream of data decisions: what was collected, from whom, with what consent, at what quality. 38507 leans here on its sibling ISO/IEC 38505 (governance of data): a board cannot govern AI use while remaining agnostic about the data estate feeding it. In practice the two portfolios converge — the same committee, the same appetite statement, the same escalation paths.
One more board duty follows directly: regulatory awareness. The governing body does not need to recite the EU AI Act, but it is accountable for the organisation knowing which obligations bind it, in which jurisdictions, on what timelines — and for compliance being resourced, not assumed. "Our vendor handles compliance" fails twice: deployer obligations attach to the deployer, and accountability, as just established, does not travel with the contract.
Key terms: accountability, model drift, data governance, deployer, duty of care
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.