AI is forcing boards into unfamiliar territory, and many are unsure where to start. Theodoros Evgeniou, Professor of Technology and Business at INSEAD, has spent years advising companies on AI strategy and governance. In the latest episode of the INSEAD Explains Governance series, he sets out what boards need to understand about AI, from assessing organisational readiness to building a governance framework fit for the technology.

Setting the ambition

One of the first things a board must understand, says Evgeniou, is how disruptive AI is likely to be for their industry. In some sectors, it’s a fundamental threat to the business model; in others, it’s largely about improving efficiency. That assessment shapes everything downstream, including where resources should go – be it towards foundational capabilities like data and infrastructure or more experimental, longer-term ideas.

Moving too fast can unsettle a workforce already anxious about AI's implications, while moving too slowly risks losing ground to competitors. Evgeniou stresses that AI deployment is not value-neutral. Every choice involves trade-offs, such as between privacy and security. Which of these matter most depends on the company and its industry.

Before any of this, boards need a clear picture of their own AI readiness. Evgeniou points to three core enablers worth assessing: data, infrastructure and talent. Understanding the gap between where a company stands today and where it needs to be is the essential starting point.

Building the blueprint

AI governance is a blueprint that every company needs to build for itself, working through various layers: principles, policies, roles, processes and the tools to support them. Banks, Evgeniou notes, have effectively been doing a version of this for years through model risk management. He also points out that AI governance isn't just about managing the downside risks but helping organisations capture the upside.

For board members specifically, Evgeniou makes the case for broad AI literacy over narrow technical expertise. Understanding the technology matters, but so does comprehending its organisational impact, its relationship to data, the regulatory landscape and the geopolitical dimensions of the AI stack. A working knowledge across all of these areas, he argues, is more valuable than deep expertise in just one.