Generative AI Can Talk. But AI Agents Can Act.

Over the last two years, artificial intelligence has entered the boardroom with more speed than any prior technology wave. The conversations have shifted from whether to adopt AI to how to govern it. Yet most governance frameworks being proposed share a fundamental weakness: they are designed to regulate the AI systems that exist today rather than the AI systems that will exist in two or three years.

The Capability Trajectory Problem

AI capabilities are advancing faster than governance frameworks can be designed, approved, and implemented. A regulation written to address the risks of GPT-4 class systems is already partially obsolete by the time it takes effect, because the frontier has moved. This is not a hypothetical problem. The EU AI Act was designed around risk categories that reflected the state of AI development during its drafting period. The emergence of agentic AI systems, multimodal models, and reasoning-capable systems has created capability categories that the risk taxonomy does not cleanly address.

The Three Governance Failures

Three categories of governance failure are visible in early AI deployments. The first is the attribution problem: when an AI system makes a consequential error, existing legal and regulatory frameworks provide inadequate clarity on liability. Is the developer of the model responsible? The organization that deployed it? The individual who approved the output? The answer currently depends on jurisdiction, contract structure, and the specific facts of the failure in ways that create uncertainty that inhibits both adoption and accountability.

The second is the audit problem: organizations cannot currently audit AI system behavior in the same way they can audit financial processes or software code. AI systems are probabilistic rather than deterministic, which means that the output of the same system to the same input can vary. Traditional audit methodology assumes that a correct process consistently produces correct outputs. That assumption does not hold for probabilistic AI systems.

The third is the incentive problem: the entities with the most capability to govern AI effectively, the frontier model developers, have the least incentive to do so in ways that constrain their commercial advantage. Voluntary commitments from technology companies to safety and governance standards have limited credibility precisely because the companies making them benefit from the technology's deployment.

The Board Responsibility

For corporate boards, the implication is that AI governance cannot be delegated entirely to the technology function. The risks created by AI deployment, including liability, reputational, and regulatory risk, are board-level risks. Directors who are not asking structured questions about how their organizations are managing these risks are not fulfilling their fiduciary obligations in the current environment.