AI Governance The End of the Honeymoon Period

Nov 04, 2026
Proxy Reporting
Cécile Linares

The proxy trends series is prepared by Labrador’s Lead Advisors and explores emerging trends in proxy statements in 2026, and offers insights and actionable elements for your teams to consider as you prepare your 2027 Proxy Statement.

The Driving Forces for AI Governance

As an increasing number of companies invest heavily in AI, it has become a key focus of this Proxy season and has emerged in the last years as both one of the main risks and one of the main opportunities for a vast number of companies.

AI is no longer confined to IT or innovation committees; it is increasingly a company-wide strategic matter intersecting with capital allocation, data governance, cybersecurity, human capital, and enterprise risk. Consequently, board-level oversight and disclosure of AI governance is top-of-mind for issuers and investors in 2026, as companies balance innovation with responsible integration amid the continued absence of a single, comprehensive U.S. regulatory framework.

Having committed substantial capital to AI, investors now expect evidence of both returns and active risk management. Activist investors are pushing for AI integration to improve margins and growth, while asset managers are asking pointed governance questions on data privacy, model risk, bias, and board escalation. Glass Lewis, for example, updated its benchmark policy guidelines in 2025, asking companies to provide sufficient disclosure to allow shareholders to broadly understand how they are using AI in their operations and whether there have been any ethical considerations incorporated in their use of this technology.

Rather than treating AI as a standalone technology risk, shareholders increasingly examine how boards govern AI capital expenditure, training-data sourcing, data-center environmental impact, and shareholder-rights frameworks — a conversation that has moved beyond abstract “responsible AI” principles toward concrete questions of capital allocation, data governance, and board accountability.

There is little consensus on precisely how AI oversight should be structured. AI-related shareholder proposals on governance, transparency, and risk management have increased steadily since 2022¹, but have attracted only limited support — reflecting investor preference for board-level oversight and engagement over prescriptive, one-size-fits-all resolutions.

Nonetheless, boards are expected to show, not simply assert, that AI is being managed responsibly. Generic commitments to “responsible AI” are no longer sufficient. Boards are expected to point to specific structures — defined ownership, escalation protocols, incident response, periodic review — treating AI oversight the way they treat cyber and climate oversight.

¹The Conference Board, 2026 Proxy Season Preview, with ESG data analytics firm ESGAUGE, Russell Reynolds Associates, and Rutgers Center for Corporate Law and Governance, February 2026

How Companies are Currently Addressing AI Governance

AI is increasingly treated similarly to other specific areas of risks such as sustainability, cybersecurity, etc., and integrated in the companies’ existing risk management structure, assigning the risk oversight to a specific committee and describing how AI oversight is embedded in ERM processes. Boards are also building competence on the matter as “new technology”, or “AI” skills, are becoming a common occurrence in director skills matrices.

This reflects a shift toward more precise, expert-driven oversight: boards are moving away from narrow technical AI credentials toward directors with strong operating judgment who can ask informed, cross-cutting questions, supported by management briefings and outside experts.

Yet formalized oversight is far from universal, and disclosure remains imprecise. Companies rarely define what “AI expertise” or “New technology expertise” means for director skills, and when they do, it can range from completion of a basic AI certification to having developed and rolled out AI in an organization. Board education is also a clear gap, with only 11% of Fortune 100 companies describing education and training efforts on the topic.

Insight from EY’s “Cyber and AI oversight disclosures: what companies shared in 2025”

Among Fortune 100 companies:

48% cited AI risk as part of the board’s oversight of risk — triple the 16% that did in 2024
11% describe Board-level education and training efforts, vs 8% in 2024
40% disclosed that at least one board-level committee was charged with oversight of AI matters, a big jump from the 11% that did so in 2024
15% include AI as an area of expertise sought on the board

Best Practices and Examples

When thinking about what to disclose regarding AI, we recommend that companies consider two questions:

How to demonstrate the board is equipped to oversee AI?
How does that oversight happen in practice?

Under investor pressure, generic statements are being replaced by expectations of demonstrated competence and mapped accountability. Where AI is critical to strategy, the board may hold management accountable for AI outcomes through compensation incentive programs as evidenced in recent CD&A disclosure.

Demonstrating the Board is Equipped to Oversee AI

A board that simply claims AI expertise, without specifying what that means, gives investors no basis to judge whether directors can meaningfully challenge management on AI strategy and risk. Companies should identify which director is positioned to lead AI oversight, describe the depth of that expertise – in the skills matrix and director’s biography – and show how the board is trained on the topic.

ServiceNow p. 13 and Lockheed Martin p. 18 – Both companies explicitly include AI in broader “tech” skills and define what those entail. Additionally, they disclose other skills that relate to AI without being explicitly linking it to the topic, such as “emerging technologies” for ServiceNow or “Future Focused.”

Salesforce p. 23 and 30 – The company includes several technology-related skills, including one explicitly named “AI, cloud or emerging technology”, integrating AI in a larger frame which can later be used for similar technologies. Additionally, the company explicitly describes AI-related expertise and qualifications in several of its directors’ biographies.

MetLife p. 32 – The company includes AI among the themes directors received training on, disclosing they received “presentations from management and outside experts” and “other educational reference materials” on the topic.

Adobe p. 19 and 23 – The company includes an explicit “AI” skill alongside a broader “technologist” skill in the skills matrix and describes precisely what each entails. AI is mentioned in 8 of the directors’ biographies (out of 11), consistent with the 8 that possess the “AI Experience” skill disclosed in the skills matrix, providing more details on the specific experience relevant directors had and how those are helpful to Adobe.

Equifax p. 36 and 50 – The company includes broader technology-related skills in its matrix but details AI-specific expertise in several of its directors’ biographies. The company describes both the related experiences of the relevant directors and how those experiences relate to the skills they are attributed. Additionally, AI is mentioned in the “periodic updates” directors receive from management or third parties “as appropriate”. It should be noted that more extensive details on directors’ education on the topic are available in their AI oversight section (see p. 56).

Showing effective oversight of AI

Stating that “the board oversees AI” is no longer sufficient, because it does not tell investors whether risk is actually being managed or who is accountable if it is. Disclosure should specify where accountability sits — full board, committee, and management — and how responsibility is divided among committees. It should describe how and how often oversight occurs and connect the board’s role to management-level governance and the ERM framework, so investors can see AI is managed with the same rigor as other material risks.

Salesforce p. 18 – The company clearly describes the breakdown of responsibilities among committees and how management oversees AI, including a management-level committee, and related principles and policy, with a link to the website for more information.

ServiceNow p. 34 – The company has a full page dedicated to AI oversight in the Board Oversight section. The section describes board-level oversight with committees involved, what is the focus of AI governance and oversight is carried out, and how the board is trained on the topic. A “Highlights” sub-section describes the company’s policies and standards on the matter, and the infographic shows the overall oversight structure, from full board to management and employees.

Workday p. 41 and 52/53 – The company provides a fulsome disclosure with AI included in the general “Risk Oversight” infographic p. 41, alongside a small paragraph p. 42, as part of the specific risk focus, describing the key elements (education, committees’ specific responsibilities). Additionally, a full 2 pages section is included on Responsible AI. This section provides more details on AI governance, including policies and framework and an infographic showing the oversight chain from full board to employee-level.

Equifax p. 55/56 – The company includes an extensive disclosure on AI at the beginning of their proxy statement, covering their AI strategy. Additionally, a standalone 3 pages section on Responsible AI and governance follows the risk oversight section. This section describes board oversight in a callout box, focused on board education on the topic, and provides details on AI integration in the risks management processes of the company.

Allstate p. 40/41 – The company includes a dedicated subsection under the Oversight section. The section includes highlights of 2025 focus, and a clear infographic describing governance across the board, its committees and management. It also includes an interesting short graphic depiction regarding AI risk management processes.

Cognizant p. 33 and p. 36/37 – The company includes an extensive highlight on AI oversight with precise information on the breakdown of responsibilities among the board and its committees, board education on the matter, and precisions on management’s framework and processes to govern AI. Interestingly, the company goes beyond its own processes and briefly addresses third-party AI risk management (including client). Additionally, AI is mentioned as the focus of 2025 key changes in committees charters and responsibilities.

Lockheed Martin p. 13 – AI is mentioned in the general board oversight infographic on p. 11, and the company provides more details in an AI focus alongside the other risks in focus. This section is clear, addressing in a concise manner the responsibilities of the board and the committees, the ties with the ERM process, and the policies governing AI in the company.

Intuit p. 13 – The company includes AI governance in the Key areas of oversight, first presenting the Responsible AI principles of the company and presenting the board and management’s role and responsibilities, down to employees level.

Focus on AI in Executive Compensation

For companies where AI is particularly material or integrated in the strategy, some are beginning to link AI outcomes to executive compensation. Doing so signals genuine board conviction and reassures investors that management is accountable for delivering the returns expected from significant AI investment.

Salesforce p. 37 – The company highlight changes brought to Executive compensation in 2025, including a new metric in the long-term incentive (Performance-Based Stock Options) to tie it to the company’s AI strategy. AI-related performance is also extensively addressed throughout the CD&A.

Equifax p. 63 and 79 – The company mentions AI as part of the Individual Non-Financial Strategic Goals, and each NEO scorecard mentions AI-related achievements during the year.