The Question That Changed My Agenda
Last quarter, during a routine session of the board I chair, management mentioned that an AI procurement agent had renegotiated a supplier contract overnight. The system had identified a pricing anomaly, cross-referenced it against alternative vendors, and executed a switch — all before anyone arrived at the office. The savings were real. The compliance was intact. And yet, when I asked who approved the decision, the room went quiet.
That silence is the accountability vacuum. It is not a theoretical problem. It is sitting in boardrooms right now, and most governance frameworks have no answer for it.
What Makes Agentic AI Different
Traditional AI systems recommend. Agentic AI acts. The distinction matters enormously for governance.
A recommendation engine suggests which vendor to choose. A human reviews, approves, and bears responsibility. An agentic system executes the choice, routes the payment, and updates the ledger — potentially while the responsible human is asleep. The decision loop closes without human intervention.
This is not science fiction. Organizations are deploying these systems at scale. According to Grant Thornton's report "How Boards Govern Agentic AI Risk" (2026), 74% of organizations are actively scaling agentic AI capabilities. Yet the same research reveals that only 52% of business leaders report their boards have established clear AI policies.
The gap between deployment velocity and governance readiness is widening, not narrowing.
The Accountability Problem Has No Algorithmic Solution
As a chair who built a board from scratch, I have learned that governance ultimately rests on a simple principle: someone must be accountable for every consequential decision. Not responsible in a diffuse, organizational sense — accountable in a way that can be traced, questioned, and if necessary, sanctioned.
Agentic AI breaks this chain. When an algorithm makes a procurement decision, who is accountable? The vendor who sold the system? The IT team that deployed it? The business unit that requested it? The board that approved the budget?
The honest answer, in most organizations today, is: nobody knows.
What I saw when we started examining our own AI deployments was a patchwork of assumptions. Engineering assumed procurement owned the governance. Procurement assumed IT had validated the systems. IT assumed the business units understood the operational boundaries. The board — including me — assumed someone had thought this through.
Nobody had.
Shadow AI Compounds the Problem
The accountability vacuum becomes even more dangerous when you factor in shadow AI — systems deployed without formal oversight or approval. According to Optro AI's "AI Governance Stats" report (2026), 35% of organizations describe shadow AI as widespread within their operations.
This means that in roughly one-third of organizations, AI agents may be making decisions that no governance body has ever reviewed, approved, or even knows about. The board cannot govern what it cannot see.
What Boards Actually Need to Govern
From the operator's side of the table, the governance challenge breaks into three distinct problems: boundary-setting, escalation architecture, and audit trail integrity.
Boundary-Setting: What Can the Agent Do?
Every agentic system operates within parameters. The question is whether those parameters were set deliberately by governance or accidentally by whoever configured the system.
In our case, the procurement agent that renegotiated the supplier contract had been given broad latitude — too broad, as it turned out. The system could switch vendors, adjust payment terms, and commit to volume thresholds, all within its operational envelope. Nobody had asked whether those authorities were appropriate for an autonomous system.
What surprised me was how difficult it was to even locate the boundary definitions. They were buried in technical configuration files, not documented in any governance artifact. The board had never seen them. The audit committee had never reviewed them.
Boundary-setting for agentic AI is not a technical task. It is a governance task that requires technical input. The distinction matters.
Escalation Architecture: When Does the Agent Stop?
The second governance problem is escalation. Under what conditions does an agentic system pause and request human intervention?
Most systems have some escalation logic built in. But the thresholds are often arbitrary — set by developers based on technical constraints rather than risk appetite. A system might escalate a $100,000 decision but execute a $99,000 decision autonomously. The difference is meaningless from a governance perspective.
What I still do not understand is why escalation architecture is not a standard board-level discussion. We spend hours debating delegation of authority matrices for human executives. We specify exactly which decisions require board approval, which require CEO approval, which can be made at the business unit level. Yet for AI agents, the equivalent framework often does not exist — or exists only in technical documentation that governance bodies never see.
Audit Trail Integrity: Can We Reconstruct the Decision?
The third problem is audit trail integrity. When something goes wrong — and eventually, something will — can the organization reconstruct what happened?
For human decisions, we have meeting minutes, email threads, approval workflows. For agentic AI decisions, we have logs — if the system was configured to generate them, if they were stored appropriately, if they capture the right information.
Having built an EPC business to 450 people and 200+ industrial projects, I have seen what happens when audit trails fail. In construction, a missing inspection record can halt a project. In AI governance, a missing decision log can make accountability impossible to establish after the fact.
The board's role here is not to design logging systems. It is to require that logging systems exist, that they capture decision-relevant information, and that they are subject to independent verification.
The Expertise Gap Is Real
None of this governance work is possible without AI expertise at the board level. And here, the data is sobering. According to Diligent's "What Directors Think" report (2026), only 8% of directors report having strong AI expertise within their ranks.
This creates a dependency problem. Boards without AI expertise must rely entirely on management's representations about AI risk. They cannot ask the right questions. They cannot evaluate the answers. They cannot distinguish between genuine risk mitigation and governance theater.
I do not claim to have solved this problem. What I have done is ensure that our board has access to independent technical advisors who can translate AI risk into governance terms. This is not ideal — expertise should sit at the table, not adjacent to it — but it is better than governing blind.
Regulatory Direction Is Shifting
The regulatory landscape is beginning to catch up. The April 2026 update to Model Risk Management guidance — issued jointly by the Federal Reserve, FDIC, and OCC in their Revised Interagency Guidance on Model Risk Management — rescinded the previous SR 11-7 framework in favor of risk-based tiering and lifecycle governance.
This shift matters for boards. The new framework explicitly recognizes that different AI systems pose different levels of risk and require different levels of oversight. It also emphasizes governance across the entire model lifecycle, from development through deployment through retirement.
For boards, this means that AI governance is no longer a one-time approval exercise. It is an ongoing oversight responsibility that spans the life of each system.
What I Am Doing Differently
Since that quiet moment in the boardroom, I have made several changes to how the board I chair governs AI.
First, we now require explicit documentation of decision boundaries for any agentic system before deployment. This documentation comes to the board, not just to IT.
Second, we have established escalation thresholds that align with our existing delegation of authority framework. If a human executive would need approval for a decision, the AI agent needs approval too.
Third, we have added AI audit trail integrity to our internal audit scope. The auditors now verify that decision logs exist, that they capture the right information, and that they are tamper-resistant.
Fourth, we have engaged an independent technical advisor who attends board sessions when AI matters are on the agenda. This is a stopgap until we can add genuine AI expertise to the board itself.
These are not perfect solutions. They are practical responses to a governance problem that did not exist five years ago.
The Vacuum Will Not Fill Itself
Agentic AI is not waiting for governance to catch up. Systems are being deployed, decisions are being made, and accountability is being diffused — all while boards debate whether AI is a strategic priority or a technical matter.
From the operator's side of the table, I can say this: the accountability vacuum is real, it is growing, and it will eventually produce a failure that no one can explain and no one can own. The question is whether boards will address it before that failure or after.
I know which I prefer.