Back to blog

Draw the Line: The AI Governance Question Every Board Should Be Asking

The wrong question about AI is "What should we use it for?" The right one: "Where is AI making decisions in our org that no human is reviewing?" Here's what I see in boardrooms every week — and the single question that separates companies getting AI right from those running an uncontrolled experiment in production.

Josh Jones
Josh Jones
April 25, 2026
Draw the Line: The AI Governance Question Every Board Should Be Asking

Every CEO I talk to asks the same question about AI: "What should we be using it for?"

Wrong question.

The right one: "Where is AI making decisions in our org that no human is reviewing?"

That's where your risk lives. Full stop.

I'm in decision-making rooms every week. Here's what I see:

Company A automated everything. Pointed AI at every process, declared victory. Six months later they're finding out AI made hundreds of small calls nobody reviewed, vendor approvals, access provisioning, risk scoring, customer comms. Some of those calls were wrong. And they're expensive to unwind.

Company B automated nothing. Formed a committee. Wrote a policy. Still "evaluating." Meanwhile their competitors are running at twice the speed with half the headcount on repetitive work.

Both are failing for the same reason: nobody drew the line between what AI should decide and what a human must decide.

That's not a technology problem. That's a leadership failure.

Where the Line Falls

After 21 years in this industry, I can tell you, AI is exceptional at the repeatable, well-defined, low-consequence work:

  • Sorting alerts
  • Categorizing data
  • Drafting first versions
  • Flagging anomalies
  • Running comparisons at scale

AI is dangerously bad at anything requiring judgment, context, and accountability:

  • Which vendor to trust
  • Whether a risk is acceptable
  • Sensitive customer communications
  • Any call where being wrong has legal or regulatory teeth

The line between those two categories isn't fixed. It shifts by industry, risk tolerance, and regulatory environment. But someone has to own it. And in most companies I walk into, nobody does.

The Only Board Question That Matters

"For every AI-driven process in our organization, can you show me where the human decision point is, and who owns it?"

If your CISO, CTO, or COO can't answer that clearly, you don't have an AI strategy. You have an uncontrolled experiment running in production with no one accountable for the outcome.

You are who has to answer that question.

The companies getting this right aren't spending the most on AI, they're the ones who drew the line first. Automated everything below it aggressively. Kept human judgment above it non-negotiable. 

That's not slower. That's how you move fast without creating risk your board can't quantify.