Board Oversight of AI: Why Process Controls May Not Be Enough

In this post for the Oxford Business Blog, author Eva M Erpenbach discusses the limitations of relying solely on procedural controls for AI governance. While companies have established usage policies, approval workflows, risk assessments, audit trails, and human oversight, these mechanisms may not account for changes in how an AI system is actually used. Model updates, new data sources, vendor changes, integrations, or growing reliance on outputs can cause a system’s practical role to change without triggering a formal governance review.

Erpenbach highlights several ways this disconnect can create risks. A decision-support tool may effectively become the decision when employees routinely defer to its recommendations, while a system designed to summarize documents may later be used to rank or screen them. Similarly, a provider’s routine model update can materially change system behavior without prompting a new assessment. In these situations, governance documentation may remain accurate on paper even though the activity being governed has fundamentally changed.

The post argues that boards should supplement traditional approval processes with functional continuity reviews. Rather than asking only whether a system was properly authorized, boards should periodically assess whether it continues to perform the same function, operate within the same risk profile, and influence the same decisions as when it was approved. This also requires a broader approach to transparency, focused not only on technical information such as the model, provider, and safeguards, but also on which decisions the system currently influences and how that role has evolved.

Erpenbach concludes that procedural controls remain essential but cannot substitute for ongoing oversight. Boards should treat significant model updates, provider changes, and workflow integrations as potential triggers for renewed review, ask what the system is actually doing and who relies on it, and require reporting on its current decision-making influence. The central lesson is that effective AI governance must ensure that established processes continue to govern the right activity, rather than merely confirming that the original procedures are still being followed…

CONTINUE READING…