Everyone Says “AI-Powered”, Until The Board Asks For Evidence

Why Most Boards Are Governing AI That Does Not Exist

This article presents the core argument of a longer work currently in preparation for publication. The full analysis includes detailed treatment of organizational design frameworks, Canadian and international corporate governance law, the EU AI Act’s transparency requirements, stakeholder recourse mechanisms for algorithmic decisions and a practical reference table for board members evaluating AI claims. For advance access or to discuss these ideas, connect with me directly.

Walk into any boardroom discussion about AI and you will encounter a familiar scene: frameworks and matrices of roles and responsibilities sit alongside ethical charters and newly created AI governance roles, all contributing to the sense that the organization is taking AI seriously because it has built structures around it. The board reviews these structures, asks reasonable questions about accountability and risk and leaves with the impression that governance is functioning.

Beneath this surface of organizational propriety, something is fundamentally misaligned. The structures being created often sit at a distance from how AI systems actually behave, where they fail and how risks emerge in practice and in many cases they sit at a distance from AI systems altogether, because the systems described as AI are not, by any rigorous definition, artificial intelligence.

This is a governance failure of a particular kind, rooted not in intention or diligence but in resolution. Boards are governing at an altitude where everything looks like AI, because the organizational vocabulary makes no distinction between a neural network trained on millions of data points and a spreadsheet macro that reformats cells. Both appear in reports under the same label, and once a word encompasses everything, its utility as a governance category approaches zero.

Once a word encompasses everything, its utility as a governance category approaches zero

The analysis that follows grew out of a specific experience. A CEO I know well asked me, as a professional courtesy, to review his organization’s AI capabilities. What I found was a systematic gap between how those capabilities were represented to the board and what the technical systems actually did. Systems described as AI agents in board materials turned out to be predetermined workflow automations, presented in the vocabulary of artificial intelligence because substantiation was never demanded inside the approval chain and because the organization rewarded the "superficial signal" more readily than it rewarded the evidence. That single finding prompted a broader investigation, informed by subsequent conversations with board members and CEOs across sectors, into how widespread the pattern is and what governance must do differently in response.

When ‘AI’ Becomes a Misclassification Risk

The academic community has been considerably more precise than the marketplace about what constitutes artificial intelligence. MIT, Carnegie Mellon and legislative bodies including the U.S. Congress have each defined AI in terms of specific technical properties that a system must possess to qualify. These definitions converge on a set of capabilities that separates genuine AI from conventional software automation, and the gap between these institutional definitions and how the marketplace uses the word is where governance risk concentrates.

Forty percent of European startups classified as AI companies had no material AI in their products. That was 2019. The number has not improved.

A 2019 study by MMC Ventures reviewed 2,830 European startups classified as AI companies and found that approximately forty percent had no material AI in their core products. These were not fringe operations. They had attracted investment, built market positioning and hired personnel on the strength of a capability they did not possess. The pattern is recognizable to anyone who has examined the question closely: systems that follow predetermined rules described as intelligent decision-making, and ordinary automation reported as autonomous processes. In each case, the governance implications of what the system actually is differ fundamentally from the governance implications of what the label implies.

Disclosure Risk Has Become Board Risk

What transforms this from an industry observation into a boardroom priority is that regulators have moved from watching to enforcing. Since March 2024, the U.S. Securities and Exchange Commission has brought enforcement actions against companies making false AI claims. The Department of Justice has filed criminal charges against a CEO whose supposedly automated platform turned out to depend almost entirely on manual human labor. The Federal Trade Commission’s Operation AI Comply has targeted organizations across multiple sectors. In at least one case, the SEC also conducted a detailed technical audit comparing public representations against actual system performance data. The posture is changing in a concrete direction: regulators are developing the capacity to verify whether AI claims are real, and they are using it.

For directors operating under the Canada Business Corporations Act, or under comparable frameworks internationally, these developments connect directly to fiduciary obligations. Directors must exercise the care, diligence and skill of a reasonably prudent person. A board that approves public-facing materials describing AI capabilities the organization does not possess faces a governance exposure that no compliance framework or role appointment can resolve after the fact.

What Boards Typically Find When They Ask for Evidence

Over the past year, I applied a structured diagnostic to this question, drawing on definitions from leading academic institutions, on Canadian and international corporate governance law, on organizational design theory and on the regulatory enforcement record. It was built to be usable by board members and executives without requiring technical expertise, while still producing conclusions that can withstand scrutiny.

The findings were remarkably consistent across organizations and sectors. Companies that had built governance structures around AI frequently could not demonstrate that their underlying systems met even the most basic definitional threshold established by academic and legislative communities. Executive roles had been created for capabilities that had no technical team beneath them. Board-approved AI strategies turned out to rest on vendor demonstrations rather than internal capability assessments. In one case, an organization’s entire AI portfolio consisted of calls to a single third-party commercial service, which meant the company controlled little of what mattered about the system over time, including how it changed, how it failed and what it would become as dependencies evolved.

Perhaps most striking was a structural pattern that emerged across nearly every organization examined. The people occupying AI governance roles, including ethics leads and accountability officers, often could not interpret the systems they were meant to supervise. The roles had been designed from governance frameworks that specified responsibilities without confirming whether the organization had the technical capacity to fulfil them, which is the functional equivalent of appointing a financial auditor who cannot read a balance sheet.

Why Governance Must Move from Principle to Terrain

A useful analogy comes from geographic information systems. A zoning map tells you what is legally permitted on a piece of land, while a topographic map tells you what the land actually looks like. Both matter, but zoning alone cannot tell you whether a particular route can be walked.

Current AI governance frameworks provide the zoning layer with admirable clarity, specifying principles, boundaries and roles. What they often lack is the topographic layer: verified knowledge of what the systems actually do, where risks concentrate and whether the terrain beneath the governance structure can support the weight being placed on it. The deeper work develops this in detail by linking governance language to operational reality in a way that allows directors to govern what exists, rather than what is implied.

There is an additional dimension that most organizations have not yet confronted. Every organization that employs human beings has mechanisms for challenging human misconduct, such as complaint channels, escalation paths and independent reporting structures. When decisions are delegated to AI systems, those same governance principles require equivalent mechanisms of transparency and recourse, and the EU AI Act has now made this a legal obligation. How organizations should build those mechanisms, and how boards should oversee them, remains among the most underdeveloped areas in current governance thinking, and it is also among the areas where regulatory expectations are becoming less forgiving.

Moving from Governance Structures to Verifiable Reality

The argument outlined here calls not for a rejection of governance thinking but for its evolution. The governance principles that have served boards well in other domains remain valid, yet those principles must now operate with the recognition that in domains where the terrain is complex and unfamiliar, governance cannot remain only at altitude.

The first task of governance in the age of AI is not to build new structures but to verify that the systems those structures are meant to govern exist in the form that has been represented. Without that verification, everything that follows rests on assumption rather than evidence and the organization begins to accumulate a risk that will eventually be priced in by regulators, investors, customers or all three.

If this line of thinking resonates, the longer e-book takes the argument beyond diagnosis and into board use. It is written as a director-facing companion that helps you apply the terrain lens to your own organization, so “AI-powered” becomes a claim that can be substantiated in the boardroom, not just repeated in a deck. If you want access to the e-book, you can request it here or message me directly.