Boards struggle to govern AI risks

As cyber incidents increase and AI technology expands, the ability of boards to manage associated risks is under scrutiny. The National Cyber Security Centre has highlighted the urgent need for effective governance in light of an unprecedented uptick in cyber threats. Diligent has just released its Q4 2026 GC Risk Index, which sheds light on how inadequately many boards are prepared to handle the complexities that arise from both AI and cyber risks.

The findings from the report raise alarming concerns: nearly six in ten legal leaders rate organisational risk at 7 out of 10 or higher, with regulatory change, AI, and cyber threats at the forefront of their worries. Dottie Schindlinger, Executive Director of Diligent Institute, stated that “nearly six in 10 legal leaders say AI adoption is outpacing governance. That gap is a risk in itself: as AI spreads across an organization, it becomes harder to maintain clear visibility into how it is used, what data it touches and who is accountable.”

The report reveals that 59% of legal leaders feel that AI adoption is currently outstripping their organisations' ability to manage it properly. Alarmingly, 41% have no formal governance framework for AI or are in the process of developing one, leaving substantial gaps in oversight. Just 26% of these leaders believe their boards are adequately prepared to monitor AI risks. Additionally, 23% of legal teams report that they regularly update senior leadership on AI-related threats, indicating a lack of communication surrounding these critical issues.

Concerns over cybersecurity are equally pressing, with nearly three in ten organisations experiencing third-party incidents. A mere 34% of participants expressed confidence that their cyber disclosure protocols have been sufficiently tested. This lack of preparedness could have significant implications as legal leaders grapple with both regulatory changes and the growing influence of AI technology in their operations.

Schindlinger remarked on the necessity for boards: "Boards do not need every director to be an AI expert, but they do need enough fluency to challenge assumptions and ensure oversight keeps pace with adoption.” The report underscores the importance of involving legal teams in the decision-making process around AI and cyber governance, allowing them to play a key role in shaping risk appetite and enhancing board oversight.

Sachin Kohli, Partner at Wilson Sonsini, added that “as risks like AI and cybersecurity evolve at breakneck speed, boards need a clear understanding of their potential legal, regulatory and disclosure implications.” This shift towards integrating legal expertise in overarching risk management functions can help to convert complex challenges into actionable strategies that enhance board readiness.

For those interested in a deeper understanding of these critical findings, the Q4 2026 GC Risk Index is now available for download.