Only 5% of companies have turned AI into real financial gain. That 5% is posting 4x the shareholder return of everyone else — while Cursor (code), Sierra (customer service), Harvey (legal) and Glean (enterprise knowledge) quietly rebuilt other people’s workflows using agents into $150m–$2bn of ARR.

So the question this week isn’t “what’s our AI strategy?” It’s sharper: what would a well-funded AI-native rival do to your value chain first — and why haven’t you done it yourself?

Inside this issue:

## 🎯The Frame · the Six Ps — a board framework for AI strategy, not a CIO one — plus the cost curve nobody’s watching

## ❓ Five for the Chair · This week’s key questions. For your next board meeting, including the Founder question: With £100m and no sacred cows, where would we attack ourselves first?

## 📚The Library · The system. the one-page AI dashboard to lift straight into your next board pack — eight baskets, and the single line that should worry a chair most

Also in this week’s issue:

## 📡 The Signal · AI signal vs noise. What changed this week: The most consequential AI essay of the year. Firework AI - a company you need to know. Chinese open source powering away. The new AI interface battleground. The gap between pilot & production.

## 🛠 Monday Morning· The Director’s AI Build. Week two of a six week course for Board Directors. Free Director AI education programme….which puts the tools in your hands.

Read before your next board pack. AI intelligence for directors - strategy, risk, governance, capability

👉 Read this week’s issue on TheDirectorBrief

________________________________________________________________________

## 🎯 THE FRAME· the strategic conversation of the week

### Somewhere, a Start-Up Is Already Pricing the Gap in Your AI Strategy…….

The uncomfortable numbers:

• Only ~5% of companies show substantial financial gain from AI (BCG, 2026) — but that 5% posts roughly 4x the three-year shareholder return of everyone else. The prize is real, and concentrated

• Most companies cannot draw an auditable line from model performance to adoption to operating KPIs to financial impact (McKinsey). Activity is high. Evidence is thin

• Meanwhile the attackers are already through the door: Cursor past $2bn ARR in software development, Sierra past $150m in customer service, Harvey past $190m in legal, Glean at $200m in enterprise knowledge. None attacked a whole industry. Each took one expensive workflow, end to end

• These firms are built differently: 72% have proprietary AI capability vs 30% of start-ups generally (AWS, 2026); they run ~25% smaller with 13% more engineers (Harvard/INSEAD). Not a rival with a better chatbot — a rival with a structurally cheaper cost model

What the issue gives you — the Six Ps of an AI Strategy, a board framework, not a CIO one:

• Posture. By business line: defend, deploy, reshape, invent — or deliberately wait

• Profit pools. Where would an agentic start-up reprice your cost, service, risk or customer access first?

• Proprietary advantage. Everyone rents the same frontier model. What’s still yours once they do — data, distribution, trust, regulatory position?

• Platform. Buy, boost, build, self-host or avoid — by use case, not edict

• Process. “40 use cases” is evidence of nothing. Which five workflows are redesigned end to end, and what are the before-and-after economics?

• Proof & permission. Value measured, not asserted — and explicit appetite for where AI acts alone, assists, or is banned

Plus the cost curve nobody’s watching: commodity AI is in price freefall while the frontier layer inflates — agentic tasks consuming up to 1,000x the tokens of a simple query, with 30x variance between identical runs. Unit economics per workflow, not per licence, is the board number.

## ❓ FIVE FOR THE CHAIR

The 5 key questions to help you challenge your ‘AI strategy’

## 📡 SIGNAL· AI signal vs noise

[1] Stat of the week: $300m to $1bn ARR in seven months - Fireworks AI just closed a $1.5bn round (a company every corporate needs to know)

Fireworks AI runs, fine-tunes and serves open-source models (Llama, DeepSeek, Qwen and others) at low latency, letting companies train their own specialized model on their own proprietary data instead of just calling a frontier API. The paradigm shift: over 95% of Fireworks’ 40 trillion daily tokens now come from these customer-specialized models, not generic ones — Cursor, Notion, Uber, DoorDash and Harvey are all “owning” intelligence rather than renting it. That inverts the assumption most corporates still operate on, that AI strategy means picking a frontier vendor (OpenAI, Anthropic, Google) and paying per token.

[2] Chart of the week: For the first time, a chinese open source model Kimi-K3 (from Moonshot AI) has taken the top position on the Frontend Code Arena & scoring similar levels to frontier on other benchmarks. USA is busy with banning data centres (recently in NY), new state regulations and pre approving frontier models - whilst Chinese open source surges on unencumbered at a different token price point. For any board weighing AI vendor lock-in, the leverage is shifting to the buyer — near-frontier capability you can host, fine-tune and run privately is now a credible negotiating position.

[3] Demis Hassabis just published the most consequential essay in AI this year.

The CEO of Google Deepmind & Nobel Prize winner proposes a FINRA style standards body for frontier AI. He estimates AGI in a few years - 10x the industrial revolution at 10x the speed. “We’ve essentially found a way to make sand think.”

Coincidently, In the same week 200 economists warn AI could outpace the industrial revolution - signed by 16 Nobel Laureates plus current Anthropic, OpenAi and Google executives. A call to action as they fear policy is unable to keep pace.

[4] 97% of firms run AI in production, 5% say their data can support it.

Enterprise AI isn't failing because models aren't powerful enough. It's failing because enterprises are trying to deploy AI solutions on top of fragmented data, disconnected systems and inconsistent governance. The gap between pilot and production is about architecture, not model capability. Read more at Forbes

[5] The chatbot is already old news - the fight has moved to ear, sight & lapel? TechCrunch, 10 July 2026

OpenAI hired Apple’s hardware chief to build the next interface. Apple just tried to freeze him out of it. The chatbot is already old news as a battleground — the real fight has moved to ear (Wispr Flow’s voice-first typing, OpenAI’s rumoured wake-word-free speaker), eye (smart glasses from OpenAI, Apple’s N50, Meta, Google) and lapel (AI pins/pendants both OpenAI and Apple are separately building). Apple’s suit doesn’t name Jony Ive, but it targets the two ex-Apple hardware leads — Tang Tan and Chang Liu — who’d know precisely which of those three form factors Apple was racing toward.

## 📚 THE LIBRARY· AI academy for board directors.

Stop Counting Pilots: What Should Actually Be on Your Board’s AI Dashboard

The problem.

• Many board packs claiming to cover “AI progress” are activity reports: licences issued, workshops run, pilots launched

• None of that tells a board whether the business is safer, cheaper to run, or harder to attack

• 82% of directors are already using AI; just 6% of boards have a policy (Diligent Institute) — and the same capability gap runs one layer down, through the workforce

The fix — one page, eight baskets:

• Financial impact and strategic outcomes: revenue uplift, cost-to-serve, retention, speed to market — AI as capital allocation, not experiment

• Workflow economics and adoption & trust: a “redesigned” workflow showing no cycle-time or cost movement has been decorated, not redesigned. Licensed-but-unused AI is shelfware with a subscription fee

• Technical reliability and strategic control: the two baskets a risk committee should own outright — vendor concentration, model dependence, use cases sitting outside the regulatory taxonomy

• Capability & culture: the basket most dashboards skip. Track training, reskilling against redesigned roles, and the talent bench gap versus AI-native peers

• Portfolio discipline: pilots killed, and the line that matters more — benefits realised versus promised. 61% realised means over a third of board-approved value hasn’t shown up

The verdict: killed pilots tell you management is disciplined. Benefits realised tells you whether the portfolio works. Put the verdict first.

Plus: how to reweight the baskets by sector, why an all-green dashboard is one nobody has stress-tested, and why a blank cell is data too.

→ Read the full Library piece here

## 🛠 MONDAY MORNING

Week 2 of 6: “The Director’s AI Build”. Six weeks, one Monday Morning at a time — read, watch, listen, and one thing to actually build, 30 minutes a week.

You leave with a working setup, not a certificate: a scheduled public-information briefing, a saved skill, and a vibe-coded tool you built yourself — plus sharper questions for your own board’s AI oversight.

Every other director AI course teaches strategy from the outside. This one puts the tools in your hands. Read the full six-week programme

Week 2: Prompting & Context: the discipline behind good outputs

Why this week: The gap between a mediocre AI answer and a genuinely useful one is almost never the model — it’s what you told it. This is the highest-leverage skill in the whole series.

📖 **READ:** Anthropic — “Effective context engineering for AI agents”. The shift from “prompt engineering” to feeding the model the smallest, highest-signal context — written for practitioners, readable by anyone.

🎧 **LISTEN:** “Big Ideas 2026: The Agentic Interface”. Why the interface is moving from “typing a prompt” to “giving an outcome” — the idea that makes Weeks 3–4 make sense.

🛠**Build** Anthropic’s free Interactive Prompt Engineering Tutorial — a ~45-minute self-marking walkthrough. Skip the code chapters; the technique chapters apply directly to board work.

🛠**Build** (30 minutes)

Create a standing “board-level thinking partner” system prompt — save it as a Claude Project so it’s there every time, not retyped. This project is for questions and public research, never for real company documents.

Try this prompt (paste as your Project’s custom instructions):

“You are my board-level thinking partner. I sit on boards across [sectors]. When I ask about a strategic, risk or governance question: (1) give me the strongest counter-argument first, (2) flag what a board typically misses on this kind of question, (3) end with one question I could raise at the table. Base your answers only on general knowledge and publicly available information. I will never paste confidential company documents into this chat — if I ever do by mistake, stop and flag it rather than answering.”

[Go deeper: DeepLearning.AI — Generative AI for Everyone. Builds directly on prompting technique; still zero-code.]

That’s it for this week.

Next week: [1] ## 🎯 THE FRAME : Skynet didn’t have a board. Your company does.The scientists who built AI are scared. The regulators are catching up. The question for boards isn’t whether to govern AI — it’s whether you’re doing it for the right reasons.

[2] ## 🛠 MONDAY MORNING Week 3: Agents, loops & setting up Claude cowork.

Please feel free to send me any comments, feedback or suggestions to hello@thedirectorsbrief.com.

Disclaimer: These are my personal views, shaped in a fast-moving environment and open to revision. They should not be taken as representing the perspectives of any boards or advisory roles, past or present.

Why clarity of strategy & focused execution are the story, not adoption

BCG’s 2026 AI transformation work found that only around 5% of organisations have generated substantial financial gains from AI — though the few that have show roughly four times the three-year shareholder return of everyone else. McKinsey’s parallel measurement work makes the diagnosis sharper still: most companies cannot draw an auditable line from model performance to user adoption to operating KPIs to financial impact. Activity is high. Evidence is thin.

So the fashionable board question — “What is our AI strategy?” — turns out to be the wrong one. It invites a slide deck: pilots, copilots, a vendor logo wall, a training completion rate. None of that tells a board whether the business is safer or more valuable. The question that actually earns its place at committee is the ‘Founder Question’:

With £100 million, frontier models, no legacy systems and no sacred cows, where would we attack ourselves first?

The gap between “we adopted AI” and “we understand what AI does to our economics” is exactly where a challenger gets in.

What the smartest firms actually agree on

The leading strategy firms and business schools are finally coming to a simple truth - AI value is not captured by access to models. It is captured by redesigning the business around workflows, proprietary advantage and measurable economics. Everyone can rent the same frontier model. Nobody can rent your customer data, your distribution, or your regulatory licence. That is where the real argument sits — not in who has the best chatbot.

Three AI disruptors. Three warnings.

AI-native start-ups aren’t simply “using AI more” than incumbents — they’re built on a different premise: intelligence is infrastructure, not headcount. AWS’s 2026 research found 68% of AI-native start-ups have a comprehensive AI strategy versus 45% of start-ups generally, 72% have built proprietary AI capability versus 30%, and 98% employ dedicated AI talent versus 70% of large enterprises. A Harvard/INSEAD study reported by Business Insider found these firms run about 25% smaller, with 13% more engineers and far fewer entry-level staff and managers than their non-AI-native peers.

Three examples bring this to life:

Cursor – reinvent the product. Instead of adding AI to traditional coding software, Cursor rebuilt the developer experience around AI agents that can understand, write and modify software. The result: reported recurring revenue reached $2bn by March 2026, while 64% of the Fortune 500 now use it. Lesson: don’t bolt AI onto yesterday’s product. Ask: if we started again today, would we build our core product the same way—or could an AI-native startup make it obsolete?

Harvey – reinvent the workflow. Harvey applies AI deeply to legal work—researching, drafting, reviewing contracts and executing complex workflows that once consumed hours of expensive professional time. It now serves 142,000+ lawyers across 1,500+ organisations, including 60%+ of the AmLaw 100, and was valued at $11bn in March 2026. Lesson: don’t scatter AI across 100 productivity pilots. Find the few high-value workflows where AI can collapse hours into minutes—and build a defensible advantage around your data, expertise and customers before someone else does.

Sierra – reinvent the economics. Sierra’s AI agents don’t just answer customer questions; they can take actions and resolve problems, with pricing increasingly tied to outcomes rather than software seats or human hours. It passed $100m ARR just seven quarters after launch and was valued at over $15bn by May 2026. Lesson: AI may not merely reduce your costs—it can destroy the basis on which you charge. Ask: what happens if a competitor delivers our customer’s outcome at a fraction of our price?

Corporates can reinvent themselves too

John Deere and Caterpillar show that century-old industrial companies can become technology businesses without abandoning their core. Deere has moved from selling tractors to combining machines with GPS, computer vision, AI, autonomy and a digital Operations Center—turning farming into a data-driven system and creating software and recurring-revenue opportunities around the machine. Caterpillar has built an ecosystem of 1.6m+ connected assets, using their data, analytics and AI for predictive maintenance, productivity and autonomous equipment. Lesson: incumbents can transform—but only when technology becomes core to the product, customer value and business model, not an IT initiative bolted onto the side.

The Six Ps of an AI strategy: a board framework, not a CIO one

How do you systematically make connected proactive choices from where you are to where you want to be - with clarity regarding competitive advantage (cost or differentiation), how to get there & how to measure the outcome. Welcome to the 6 P’s framework - a simple framework akin to what the leading strategy houses and business schools are selling:

Posture. By business line: are we defending the core, deploying AI inside the current model, reshaping the operating model around it, inventing something new — or deliberately waiting? Vague answers here mean nothing downstream will be sharp either.

Profit pools. AI doesn’t hit “the company” evenly. One way to look at this is from the frame of how an agentic start up might attack your business? As per the examples of Cursor, Harvey and Sierra discussed above.

Proprietary advantage. Most companies have no AI moat — they have a rental agreement with the same model everyone else uses. Durable advantage comes from what can’t be rented: proprietary data, embedded workflow, trust, brand, distribution, regulatory position. The board question is simple — what’s still ours once everyone has the same model?

Platform. Buy, boost, build, self-host or avoid — by use case, not by enterprise-wide edict. Buying is fast and undifferentiated. Building is powerful and expensive. Most companies will end up hybrid: frontier models for hard reasoning, cheap models for routine work, tight controls where a regulator is watching.

Process. This is where strategy either becomes real or quietly dies. AI bolted onto a bad process just produces faster bureaucracy. The board shouldn’t accept “we have 40 use cases” as evidence of anything. Ask instead which five workflows have been redesigned end-to-end, who owns each one, and what the before-and-after economics actually are.

Proof & permission. Proof means value is measured, not asserted. Permission means the risk appetite is explicit — where AI can act alone, where it must stay a copilot, where it’s banned outright. As agentic systems move from answering questions to taking actions, this stops being a technology question and becomes a board risk-appetite question.

The cost curve nobody’s watching

There’s a second reason “proof & permission” earns its place as a standalone P: AI is not simply getting cheaper. Commodity-tier models are in genuine price freefall — a routine task now costs a fraction of what it did eighteen months ago. But the frontier, agentic layer is moving the opposite way. Run the current published output-token prices in order and the ceiling has roughly quintupled since the cheapest commodity model, before you even count the volume: agentic coding tasks have been measured consuming up to 1,000 times more tokens than a simple reasoning query, with up to 30x variance between two runs of the same task and no guarantee the extra spend buys extra accuracy. “AI gets cheaper” is the headline. “AI is deflating at the commodity layer and inflating at the frontier layer” is the board-relevant sentence — and it’s why unit economics per workflow, not per licence, belongs on the dashboard.

What to ask at your next board meeting (& how to measure progress)?

Ten sharp questions for your next board meeting, below — and a worked example of what an actual AI strategy dashboard looks like, in this week’s Library piece. Between them, “how many copilots have we deployed?” stops being an acceptable answer to anything, and the only question that matters takes its place: where will AI change the economics of our business before the market does it for us?

FIVE FOR THE CHAIR · EXTENDED

Every week in TheDirectorBrief.

## 🎯 The Frame — one topical AI conversation relevant to Boards. Designed to encourage debate and action. Covering 4 domaines: Strategy & innovation; risk & resilience; governance & accountability; capability & culture.

## ❓Five for the Chair — five board-ready questions anchored in this week’s Frame, screenshot-able into next Monday’s agenda. What should the board actually debate?

## 📡 The Signal — five Board relevant AI developments you need to know about this week. Plus the STAT and CHART of the week. What changed — and what should we do?

## 📚 The Library — “AI academy”: the manual: primers, tools, templates, checklists, plus the Monday-Morning build (one tool to test, one prompt that earns its place). Do we have the literacy to govern this?

One read. Thirty minutes. Before your next board deck

Subscribe free at TheDirectorBrief.com

To help me make this better please feel free to send me any comments, feedback or suggestions to hello@thedirectorsbrief.com. Thank you for reading.

Disclaimer: These are my personal views, shaped in a fast-moving environment and open to revision. They should not be taken as representing the perspectives of any boards or advisory roles, past or present.

Sources & Further Reading

Diligent Institute, Board AI use rises: Director Confidence Index June 2026 — diligent.com/resources/blog/dci-board-ai-use-2026

McKinsey, The AI reckoning: How boards can evolve — mckinsey.com/capabilities/mckinsey-technology/our-insights/the-ai-reckoning-how-boards-can-evolve

BCG, CEOs and Boards Are Aligned on AI in Theory, but Divided in Practice — bcg.com/publications/2026/ceos-and-boards-are-aligned-on-ai-in-theory-but-divided-in-practice

McKinsey, From promise to impact: how companies can measure and realize the full value of AI — mckinsey.com/capabilities/quantumblack/our-insights/from-promise-to-impact-how-companies-can-measure-and-realize-the-full-value-of-ai

McKinsey, Cost versus value: Managing agentic AI system performance — mckinsey.com/capabilities/quantumblack/our-insights/cost-versus-value-managing-agentic-ai-system-performance

Harvard Business School / HBR, The Gen AI Playbook for Organizations, HBR Prize note — hbs.edu/news/releases/hbr-2025-prize

MIT Sloan, Buy, boost, or build? Choose your path to generative AI — mitsloan.mit.edu/ideas-made-to-matter/buy-boost-or-build-choose-your-path-to-generative-ai

London Business School, How can you use AI to redefine competitive advantage? — london.edu/think/think-ahead-ai-for-competitive-advantage

INSEAD, Why Strategy Matters in the Age of AI — knowledge.insead.edu/strategy/why-strategy-matters-age-ai

AWS, Global Startup Trends Report: AI-native startups — press.aboutamazon.com/2026/6/aws-global-startup-trends-report-reveals-ai-native-startups-are-reaching-billion-dollar-valuations-in-half-the-time

Stratechery, Agents Over Bubbles — stratechery.com/2026/agents-over-bubbles

The fix isn’t a longer report. It’s a different one page.

What follows is a worked example: not a template to fill in blindly, but a guide to what a genuine AI strategy dashboard should contain, and — just as importantly — what each line is actually testing for. It’s built around eight baskets that map onto the Four-Domain Frame this publication uses to keep board AI oversight honest — Strategy & Innovation, Risk & Resilience, Governance & Accountability, Capability & Culture — plus the one basket most dashboards miss entirely: portfolio discipline and value realisation.

Companion piece to “Somewhere, a Start-Up Is Already Pricing the Gap”

The figures are illustrative, built for a fictional composite board. Swap in your own and the exercise becomes real.

Reading it basket by basket

Financial impact and strategic outcomes (1–2) are the pair a CFO and a strategy committee should already recognise: revenue uplift, cost-to-serve, retention, speed to market. They convert AI from experiment into capital allocation, and from internal productivity theatre into a genuine competitive-position test.

Workflow economics and adoption & trust (3–4) are the reality check underneath. A workflow that’s been “redesigned” but shows no cycle-time or cost-per-decision movement hasn’t been redesigned — it’s been decorated. And AI that’s licensed but not used, or used but constantly overridden, isn’t transformation; it’s shelfware with a subscription fee.

Technical reliability and strategic control (5–6) are the two baskets a risk committee should own outright: is the system safe enough to keep scaling, and is the company dangerously dependent on one vendor, one model, or a pile of “high-risk” use cases still sitting outside the regulatory taxonomy.

Capability & culture (7) is the basket most AI dashboards skip completely — and the one this publication’s Four-Domain Frame won’t let us skip. A board and a workforce that can’t use AI competently can’t govern it competently either. That’s not an abstract governance point: it’s the same gap the Diligent Institute found at board level (82% of directors already using AI; just 6% with a policy) showing up one layer down, in the workforce whose output the board is ultimately accountable for. Track training completion, reskilling against roles actually flagged for redesign, and how thin the organisation’s own AI talent bench is against AI-native peers — because that gap is exactly what an AI-native rival is resourced not to have.

Which line actually matters most

The instinctive answer is basket 8’s first metric family: pilots killed. If nothing’s been stopped, nothing’s being actively managed — that’s a fair diagnostic, and it’s the one most commonly cited as the single most important line on an AI dashboard.

Sat in front of a real board, I’d push back on that instinct. Killed pilots tell you management is being disciplined about process. They don’t tell you whether the portfolio is actually working. The number that should worry a chair more sits right next to it: benefits realised versus promised. Sixty-one per cent means more than a third of the value the board approved capital for hasn’t shown up — and that gap is precisely what the BCG and McKinsey data in this week’s Frame piece warns about: high activity, thin evidence, most of the value concentrated in a small minority of companies that can prove it lands. Killed pilots explain the mechanism. Benefits realised is the verdict. Put the verdict first.

How to use this

• Don’t copy the eight baskets wholesale — reweight them for your sector. A regulated financial-services board will lean harder on strategic control; a consumer business will lean harder on strategic outcomes and adoption.

• Ask management to bring the red and amber lines to committee, not the green ones. A dashboard that’s all green is a dashboard nobody has stress-tested.

• Revisit quarterly. The individual reading matters less than the trend — a portfolio-discipline number moving from 40% to 61% is a very different conversation to one stuck at 61% for a year.

• If management can’t populate a line, that’s data too. A blank cell on “AI unit economics by use case” is more informative than a confident-looking pilot count.

Every week in TheDirectorBrief.

## 🎯 The Frame — one topical AI conversation relevant to Boards. Designed to encourage debate and action. Covering 4 domaines: Strategy & innovation; risk & resilience; governance & accountability; capability & culture.

## ❓Five for the Chair — five board-ready questions anchored in this week’s Frame, screenshot-able into next Monday’s agenda. What should the board actually debate?

## 📡 The Signal — five Board relevant AI developments you need to know about this week. Plus the STAT and CHART of the week. What changed — and what should we do?

## 📚 The Library — “AI academy”: the manual: primers, tools, templates, checklists, plus the Monday-Morning build (one tool to test, one prompt that earns its place). Do we have the literacy to govern this?

One read. Thirty minutes. Before your next board deck

Subscribe free at TheDirectorBrief.com

To help me make this better please feel free to send me any comments, feedback or suggestions to hello@thedirectorsbrief.com. Thank you for reading.

Disclaimer: These are my personal views, shaped in a fast-moving environment and open to revision. They should not be taken as representing the perspectives of any boards or advisory roles, past or present.

Only 39% of Fortune 100 boards have any form of AI oversight — a committee, a named director, an ethics function. Just 6% get management reporting that goes beyond adjectives. Uber just burnt through its entire 2026 AI coding budget in four months, capping token usage only after the fact.

This week’s issue: Ten ways AI can blow up your business……and what to do about it.

## 🎯The Frame · Ten ways AI blows up a business that never failed a single test — because most detonations don’t need the model to fail, only the governance around it to stand still while the risk moves at machine speed.

## ❓ Five for the Chair · This week’s key questions. The questions that tell you, in the next sixty minutes, whether your board is match fit to govern this.

## 📚The Library · The system. Shows you the fix. One loop, simple metrics to monitor, iterate continuously. Most boards fall at the second steps & don’t have real have visibility. This is not enough.

Also in this week’s issue:

## 📡 The Signal · AI signal vs noise. What changed this week. So what for the Board?

## 🛠 Monday Morning· The Director’s AI Build. Week one of a six week course for Board Directors. Free Director AI education programme….which puts the tools in your hands.

Read before your next board pack. Ai intelligence for directors - strategy, risk, governance, capability

👉 Read this week’s issue on TheDirectorBrief → · Subscribe free.

________________________________________________________________________

## 🎯 THE FRAME· the strategic conversation of the week

### Your board was built for risks that hold still. AI doesn’t.

Forty minutes on the agenda. A theoretical Executive or Board meeting - the CIO runs the accuracy charts. The General Counsel updates on the EU AI Act. The policy document gets signed off without a question. Polished papers, all minuted. Nobody asks whether the model on the slide is still the model in production — because by the time the papers were printed, the vendor had already pushed three updates, changed the token pricing twice, and quietly wired a new API into your customer data.

That is not a hypothetical. That is probably the average risk committee, this quarter, on AI.

The governance is theatre, and the reason is structural, not personal. AI risk breaks the three assumptions every board process was built on. It is probabilistic — right most of the time, wrong with total confidence some of the time; “show me the test results” gets you a confidence interval, not a certainty, and most directors have never governed one. It doesn’t sit still — a compliant system in January can be non-compliant by June without anyone touching the code, and it doesn’t stay where you put it either: AI is now inside spreadsheets, copilots, supplier portals and browser extensions, most of it uninventoried. And it moves at machine speed — use cases deploy in weeks, board cycles run in quarters, assurance runs in years. A biased model can serve a million decisions before the risk committee next convenes.

The numbers say the same thing from a different angle. Only 39% of Fortune 100 boards have any form of AI oversight at all — a committee, a named director, an ethics function. Just 6% get management reporting that goes beyond adjectives. That is not a knowledge gap. It is a governance gap, and it is compounding while you read this.

It compounds in ways that don’t need the model to be wrong. Anthropic’s Claude rebuilt elements of Figma’s product this year; Figma’s share price is down roughly 50% year to date — the model worked exactly as designed, for someone else’s benefit. Uber burnt through its entire 2026 AI coding budget in four months and only capped token usage after the fact. One governance vendor puts “shadow AI” — the tools staff use that IT never approved — at 60–70% of what’s actually deployed inside the average regulated firm. None of that required a failure. It required a board that checks in quarterly governing a system that changes daily.

## ❓ FIVE FOR THE CHAIR

The five questions that tell you, in the next sixty minutes, whether your board is matchfit to govern this.

1. Where in this business would AI failure be unrecoverable — and where could a competitor use AI to reprice our industry before our next strategy cycle?

2. Could management show us, within 48 hours, which of our data is feeding which models — including the public tools our people are using without telling us?

3. If our most important AI vendor deprecated its model or went down for a week, what is the impact to the business — and when did we last test that answer?

4. Which decisions have we allowed AI to take autonomously, who is the named owner of each, and did this board ever explicitly make that call?

5. What is our total committed AI spend, what measurable return has it generated, and what are the stop/go criteria for the pilots we are funding?

## 📡 SIGNAL· AI signal vs noise

[1] Stat of the week: 97% of enterprises have deployed AI agents. 12% got to production scale. Only 14.4% got full security or IT approval before shipping.

Composio’s AI Agent Report is the empirical basis for Bank of England Deputy Governor Sarah Breeden’s June warning that existing oversight frameworks were not designed for autonomous agents. 97% executive deployment, 12% at-scale success, 14.4% pre-production security sign-off. The gap between ‘deployed’ and ‘governed’ has become the board question of the quarter. How many agents have passed the posture rules set by the board?

[2] Chart of the week: Representative standard AI output-token prices for selected models, $ per 1m output tokens.

Fable 5 lifts the top-end standard tier to $50/m output tokens (vs $25 for Opus 4.8 ie a 2x change). AI token pricing is deflating at the bottom - but inflating at the strategic frontier.

AI unit economics now matters as much as model capacity. The same workflow can swing sharply in cost depending on model routing & agent design. Boards should demand cost per workflow, cost per decision and cost per customer retention. Agentic AI needs guardrails, budgets & kill rules - not just pilots.

[3] Is this how AI profits get taxed? Altman floated a 5% US government stake across the top AI labs. CNBC

Framed as an Alaska-style public wealth fund distributing AI’s economic upside; discussions are early and would likely need Congressional action. Watch for this reframing of the “AI regulation vs innovation” debate into an equity/ownership question — a live wildcard for how AI profits get taxed or shared. Move over token & robot tax, is this a new component to fund ‘universal income’ as loved by the billionaire tech bros? Or is this the start of something more sinister.

[4] Is this the start of a market correction - admission of excess supply and demand becoming price sensitive? Bloomberg

Whilst enterprises are looking for ROI, becoming sensitive to token costs - in the case of Uber instituting a monthly cap across its engineering team (after it burned its full year token budget in 4 months). Bloomberg reports Meta is building "Meta Compute," a cloud arm to rent out excess AI capacity and host models — stock popped 9% on the news. Meta has no enterprise AI business today; this is a bet that it's over-built (compute) and needs a release valve. This mirrors Elon Musk selling excess compute as part of the space X IPO (ie Grok doesn’t need it because it doesn’t have the demand). Coupled with the hyperscaler committing $600-700bn in capex in 2026, locking in commitments of $1.5T over the next 2-3 years - increasingly being funded by debt (Google recently announced issuing bonds, alongside space X debt issue). Capex/revenue mismatch, utilisation collapse (5% average GPU utilisation - according to Cast AIs 2026 Kubernates report. However the power constraints and pre-committed capacity suggest an unwind may be delayed to 2027-28?

[5] Cloudflare wants to put a paywall on the agent internet, could this redirect billions in online revenue?

On 1 July, Cloudflare — which sits in front of ~20% of the internet — announced it will block AI training bots and agent crawlers by default on ad-supported pages across its network from 15 September 2026, unless a site owner explicitly opts them back in. Cloudflare simultaneously launched Pay-Per-Crawl and Pay-Per-Use marketplaces, so publishers can charge AI companies for content access or downstream use.

→ Source: Your site, your rules: new AI traffic options for all customers — Cloudflare blog — https://blog.cloudflare.com/content-independence-day-ai-options/ · 1 Jul 2026 [4m+ views to date!]

## 📚 THE LIBRARY· AI academy for board directors.

The governance fix. Not a tenth committee. One loop, clear metrics

………Most boards have stalled on step two

Ten risks. One fix, run continuously — because governance built to hold still cannot manage a risk that refuses to. Many boards clear the first two steps without much resistance: agree a posture, build the inventory. Then they stall, because the next three — naming an owner, hard-wiring the controls, closing the loop with meaningful metrics — are the ones that turn a policy document into personal accountability. That’s not an accident. It’s easier to write a posture statement than to put your name against a live AI system, and easier to build a register than to test whether anyone actually acts on it.

A board should not accept a dashboard that says: “we have 150 AI use cases.” That is usually a symptom of weak strategy. The better answer is: “we have 8 scaled AI workflows, 4 material strategic bets, 3 stopped initiatives, £X realised value, Y% provider concentration, Z unresolved risks.”

→ Read the full Library piece — “The governance fix: one loop, clear metrics”

## 🛠 MONDAY MORNING

Starting today: “The Director’s AI Build”. Six weeks, one Monday Morning at a time — read, watch, listen, and one thing to actually build, 30 minutes a week.

You leave with a working setup, not a certificate: a scheduled public-information briefing, a saved skill, and a vibe-coded tool you built yourself — plus sharper questions for your own board’s AI oversight.

Every other director AI course teaches strategy from the outside. This one puts the tools in your hands. Read the full six-week programme

Week 1 - AI in plain English: What an LLM, Agent & and a prompt actually are

Every later week assumes you know what these words mean. Twenty minutes now saves confusion for six weeks.

📖 **READ:** McKinsey — “The AI reckoning: how boards can evolve”. The posture-and-archetypes framing every board conversation eventually reaches for.

🎥 **WATCH:** Stanford GSB — “Co-Intelligence: An AI Masterclass with Ethan Mollick”. Wharton’s Mollick on how AI actually changes work — the clearest non-technical primer available.

🎧 **LISTEN:** Knowledge at Wharton — “AI in 2026: What’s Next?”. 20 minutes, board-relevant framing, no jargon.

🛠**Build** (30 minutes): Open Claude (or ChatGPT). Write your first structured prompt — role, context, task, format. No documents involved — just a topic. Most directors have never done this deliberately.

Try this prompt: “You are a sharp, sceptical non-executive director joining a board that is about to discuss [a topic — e.g. ‘entering a new international market’ or ‘a major AI vendor contract’]. Without any specific company information, give me: (1) the three toughest generic questions a NED should ask about a move like this, (2) one assumption management teams typically get wrong, (3) one blind spot boards commonly miss. Keep your answer to under 150 words.”

[ Go deeper: DeepLearning.AI — AI For Everyone (Andrew Ng). Free, ~4 weeks self-paced, zero jargon, built for non-technical leaders.]

That’s it for this week.

Next week: [1] ## 🎯 THE FRAME AI strategy best practice…..so you don’t need to pay the consultants to borrow your watch & tell you the time?

[2] ## 🛠 MONDAY MORNING Week 2: Prompting and context engineering. A saved “thinking partner” system prompt. A standing Claude Project with a built-in confidentiality guardrail

Please feel free to send me any comments, feedback or suggestions to hello@thedirectorsbrief.com.

Three quarters of boards admit they’re under-equipped on AI. Almost none have actually wired it into how they work personally. Every director-facing AI course on the market — INSEAD’s four days in Fontainebleau, Oxford’s six-month diploma, Harvard’s certificate ladder — teaches AI strategy. Almost none teach a director to use the tools themselves for 30 minutes a week.

That’s the gap this programme fills. Not another primer on what AI is. Six weeks of read, watch, listen and — the part everyone skips — build. By the end, you have a working personal AI setup: a scheduled public-information brief, a saved skill, a vibe-coded tool, and a sharper set of questions for your own board’s AI oversight.

This will run as six consecutive Monday Morning sections in The Director Brief. It’s republished here as a single programme because readers kept asking to run it with their board colleagues, or send it to a NED just starting out.

A note on data safety — read this before Week 1

Every build in this programme is designed to run safely on a personal AI account. None of them ever require pasting, uploading or connecting a real board pack, financial statement, contract or personnel file. Where a build touches your own information, it’s your calendar’s free/busy time at most — never content, never attachments.

Directors carry personal liability for confidential information. Treat a consumer AI account — Claude, ChatGPT, whichever you use — the same way you’d treat a personal email account: nothing non-public goes in. If you want to point AI at actual company documents, that’s a different, separate decision entirely — one for your organisation’s IT and legal function, using a company-sanctioned enterprise tool under a proper data-processing agreement. This programme deliberately doesn’t go near that line, so you can run every exercise below without needing anyone’s permission first.

Who it’s for, and how it works

Chairs, NEDs, committee chairs, company secretaries, and anyone stepping onto a board who is fluent in governance but has never deliberately used AI as a working tool. No coding background required. No prior AI knowledge assumed.

• Six weeks, one theme each. Roughly 15 minutes of reading, watching or listening, plus one hands-on build of 30–90 minutes.

• Cumulative. Each week’s build uses what you set up the week before. By Week 6 you have a working personal AI operating system, not six disconnected exercises.

• Self-paced or shared. Works solo, or as a six-week track for a board or leadership team — see Running this with your board at the end.

• Safe by design. Every exercise runs on public information or your own personal reflections. See the note above.

The six-week arc

Week1 AI in plain English — LLMs, agents, prompting. Your first structured prompt, topic-based, no documents. A working prompting habit

Week 2 Prompting and context engineering. A saved “thinking partner” system prompt, public-information only. A standing Claude Project with a built-in confidentiality guardrail

Week 3 Agents, loops, and Claude CoworkCowork set up, running a public-web research task. A working agent loop, with no personal or company data touched

Week 4 Skills and scheduled automation. Your Daily Director’s Brief, built entirely from public sources. An automated 6:30am briefing, no manual step, no private data

Week 5 Vibe coding. A one-screen personal reflection app, built from a plain-English prompt. Proof you can build software without writing code

Week 6 Governance, risk, and putting it together. A personal AI risk checklist + board questions. A complete, safe personal AI setup, and sharper oversight instincts

WEEK 1 — AI in plain English: what an LLM, an agent and a prompt actually are

Why this week: Every later week assumes you know what these words mean. Twenty minutes now saves confusion for six weeks.

Read: McKinsey — “The AI reckoning: how boards can evolve”. The posture-and-archetypes framing every board conversation eventually reaches for.

Watch: Stanford GSB — “Co-Intelligence: An AI Masterclass with Ethan Mollick”. Wharton’s Mollick on how AI actually changes work — the clearest non-technical primer available.

Listen: Knowledge at Wharton — “AI in 2026: What’s Next?”. 20 minutes, board-relevant framing, no jargon.

Build (30 minutes)

Open Claude (or ChatGPT). Write your first structured prompt — role, context, task, format. No documents involved — just a topic. Most directors have never done this deliberately.

Try this prompt:

“You are a sharp, sceptical non-executive director joining a board that is about to discuss [a topic — e.g. ‘entering a new international market’ or ‘a major AI vendor contract’]. Without any specific company information, give me: (1) the three toughest generic questions a NED should ask about a move like this, (2) one assumption management teams typically get wrong, (3) one blind spot boards commonly miss. Keep your answer to under 150 words.”

Go deeper: DeepLearning.AI — AI For Everyone (Andrew Ng). Free to audit, ~4 weeks self-paced, zero jargon, built for non-technical leaders.

WEEK 2 — Prompting and context: the discipline behind good outputs

Why this week: The gap between a mediocre AI answer and a genuinely useful one is almost never the model — it’s what you told it. This is the highest-leverage skill in the whole series.

Read: Anthropic — “Effective context engineering for AI agents”. The shift from “prompt engineering” to feeding the model the smallest, highest-signal context — written for practitioners, readable by anyone.

Listen: a16z — “Big Ideas 2026: The Agentic Interface”. Why the interface is moving from “typing a prompt” to “giving an outcome” — the idea that makes Weeks 3–4 make sense.

Try: Anthropic’s free Interactive Prompt Engineering Tutorial — a ~45-minute self-marking walkthrough. Skip the code chapters; the technique chapters apply directly to board work.

Build (30 minutes)

Create a standing “board-level thinking partner” system prompt — save it as a Claude Project so it’s there every time, not retyped. This project is for questions and public research, never for real company documents.

Try this prompt (paste as your Project’s custom instructions):

“You are my board-level thinking partner. I sit on boards across [sectors]. When I ask about a strategic, risk or governance question: (1) give me the strongest counter-argument first, (2) flag what a board typically misses on this kind of question, (3) end with one question I could raise at the table. Base your answers only on general knowledge and publicly available information. I will never paste confidential company documents into this chat — if I ever do by mistake, stop and flag it rather than answering.”

Go deeper: DeepLearning.AI — Generative AI for Everyone. Builds directly on prompting technique; still zero-code.

WEEK 3 — Agents, loops and setting up Claude Cowork

Why this week: An “agent” isn’t a smarter chatbot — it’s a loop that acts, checks its own result, and decides what to do next. Once that clicks, connectors and skills (Weeks 3–4) stop feeling like magic.

Read: Oracle Developers — “What Is the AI Agent Loop? The Core Architecture Behind Autonomous AI Systems”. Vendor-neutral, plain-English explanation of the act–observe–decide–repeat cycle.

Watch: Claude — “Customize Claude Cowork”. Shows connectors, skills and scheduled tasks in one walkthrough — the three building blocks this series uses.

Course: Anthropic Academy — Introduction to Claude Cowork. Free, self-paced, ~30 minutes.

Build (45 minutes)

Set up Cowork. No inboxes or documents this week — prove the agent loop on public information only, using Cowork’s web search.

Try this prompt:

“Search the web for the three most significant AI-governance, regulatory or sector developments published in the last 7 days that would matter to a board director in [your sector]. For each: one-line summary, why a board should care, and the primary source link. Use only publicly available sources.”

Notice what happened: the agent decided how to search, checked its own results, and only then answered. That loop — act, observe, decide, repeat — is what makes it an agent rather than a chatbot. It’s also the exact loop next week’s automated brief runs on, minus the human prompting it each time.

A note on connectors: Cowork can also connect to your inbox or calendar. Skip that for now. Email and calendar entries routinely contain confidential board material — that’s a decision for your organisation’s IT/legal function, not a personal experiment. This series only ever points AI at public information.

Go deeper: HBS Online — AI Essentials for Business. Harvard’s non-technical foundation course, self-paced.

WEEK 4 — Skills and scheduled automation: your Daily Director’s Brief

Why this week: This is the week the series pays for itself. A skill is a saved, repeatable instruction set. A scheduled task runs it without you. Put them together and you get a briefing that arrives before you wake up — built entirely from public information.

Read: Claude — “Scaling workflows with Claude Cowork at your organization”. How a one-off prompt becomes a repeatable, shareable skill.

Watch: Claude — Get started with Claude Cowork. The setup walkthrough for scheduled tasks specifically.

Build (60 minutes) — the flagship build

Turn last week’s public-research prompt into a saved skill, then schedule it to run every weekday morning.

Step 1 — build the skill. After running a good version of the prompt below, tell Claude: “Package what we just did into a skill called ‘Daily Director’s Brief.’”

Step 2 — the skill prompt:

“Every weekday at 6:30am, produce my Daily Director’s Brief using only publicly available sources: (1) the top 3 AI-governance, regulatory or sector developments from the last 24 hours, each with a one-line summary and source link, (2) one boardroom-relevant question raised by today’s developments, (3) a one-line reminder of the day ahead. Do not access, read or summarise any email, attachment or private document — this brief must only ever draw on public information. Keep the whole brief under 300 words and send it to me.”

Step 3 — schedule it. Type /schedule in Cowork, set it to run weekdays at 6:30am, and point it at the skill you just saved.

Optional, advanced, and only with your company’s approval: some directors later add their calendar’s free/busy times (start times only, never titles, descriptions or attachments) so the brief also flags how much runway they have that morning. Treat that as a separate decision from this series — check with your organisation first.

Go deeper: Harvard DCE — AI Strategy for Business Leaders. A framework for governing AI initiatives at the enterprise level — useful once your own build is running.

WEEK 5 — Vibe coding: build something from nothing

Why this week: You don’t need to write code to build a working tool any more. This week is about proving that to yourself in one sitting.

Read: Lovable — “Vibe Coding Apps: 10 Tools for Beginners in 2026”. Honest, vendor-comparison guide — start with Lovable or Replit if you’ve never coded.

Watch: Sequoia Capital’s Training Data — “Andrej Karpathy: From Vibe Coding to Agentic Engineering” (29 min). The person who coined “vibe coding” on what it’s actually good for — and its limits.

Build (90 minutes)

Vibe-code a one-screen tool you’d actually use. Suggestion: a personal board-question tracker — log the questions you asked at each meeting and whether you got a straight answer. This is your own reflection log, not a record of what was discussed.

Try this prompt (in Lovable, Replit, or similar):

“Build me a simple one-page app called ‘Board Question Tracker’. Fields: board name, meeting date, question asked, answer received (yes/partial/no), follow-up needed (yes/no), notes. Show entries in a sortable table. No login required — this is for my personal use only.”

Keep the “notes” field to your own reflections — how sharp the answer was, whether you’d ask it differently next time — not board minutes, figures, or anything commercially sensitive. This tool lives on a personal app-builder account; treat it like a personal notebook, not a company record.

Go deeper: London Business School — The Business of AI: Strategies for Leaders. Online, strategy-first, useful once you’ve felt the tools work.

WEEK 6 — Governance, risk, and putting it together

Why this week: Everything you’ve built in Weeks 1–5 is personal productivity. This week turns it into board-level judgement — what good AI governance looks like, and what you personally shouldn’t do with these tools.

Read: Deloitte Center for Board Effectiveness — AI Board Governance Roadmap; INSEAD Knowledge — “A Revolution in Governance: How AI Will Make Boards More Effective”.

Watch: IoD Finance & FinTech Group — Artificial Intelligence masterclass. On-demand, covers the EU AI Act mechanics every board is now asked about.

Listen: Diligent Institute — “What Directors Think 2026: AI, M&A and the next era of board oversight”. This year’s director survey, in podcast form.

Build (60 minutes) — the capstone

Assemble your personal AI operating system and a one-page risk checklist.

Step 1.

“Confirm you now have: one Claude Project for public research and thinking-partner questions (Week 2); one agent that can search the public web on your behalf (Week 3); one scheduled Daily Director’s Brief, built entirely from public sources (Week 4); one vibe-coded personal reflection tool (Week 5). Notice what’s absent from that list: no real board papers, no inbox, no company documents. That’s by design, not an oversight.”

Step 2 — try this prompt:

“Write me a one-page personal-use AI risk checklist for a board director. Lead with: what should never be pasted, uploaded or connected to a personal AI account — board papers, financials, contracts, personnel data, anything non-public. Then cover: hallucination risk, how to sanity-check an AI-generated summary before relying on it in a meeting, and the difference between a personal AI account and a company-sanctioned enterprise tool with a proper data-processing agreement.”

Step 3.

“Write down three questions this series has changed for you — to raise with your own board’s AI oversight this quarter. One should be: what AI tools, if any, has this board approved for use with real company information — and under what terms?”

Go deeper: INSEAD — AI for Boards (4-day, in-person, Fontainebleau, €11,600); Stanford Law — Directors’ College 2026. The two most credible in-person options if this series has earned the next step.

Further study — the credible next step

This programme is deliberately practical, not academic. For readers who want to go deeper into AI strategy and governance at board level, these are the programmes and primers worth the time and, in some cases, the fee.

Business schools — in-depth board and strategy courses

• INSEAD — AI for Boards — four days, in-person, Fontainebleau. €11,600. The most board-specific programme on the market; run through the INSEAD Corporate Governance Centre.

• Stanford Law School — Directors’ College 2026 — the longest-running US director-education conference, AI now a standing agenda item.

• Harvard DCE — AI Strategy for Business Leaders — enterprise AI governance framework, several 2026 cohort dates.

• HBS Online — AI Essentials for Business — self-paced, non-technical, Harvard Business School faculty.

• London Business School — The Business of AI: Strategies for Leaders — online, strategy-first; LBS also runs an AI Masterclass with the Financial Times.

Consulting and governance-body primers — free, board-facing

• KPMG and INSEAD — Global AI Board Governance Principles (2026) — the closest thing to a joint academic/Big Four standard for board AI oversight.

• Deloitte Center for Board Effectiveness — AI Board Governance Roadmap and AI Governance: Board Oversight of Emerging Tech.

• McKinsey — “The AI reckoning: how boards can evolve” — the posture-and-archetypes framework referenced in Week 1.

• Diligent Institute — What Directors Think 2026 — the annual director survey, in podcast form.

• IoD — Artificial Intelligence masterclass — free, on-demand, EU AI Act mechanics.

Practical / commentator courses — where this programme’s method comes from

• DeepLearning.AI (Andrew Ng) — AI For Everyone and Generative AI for Everyone — the standard non-technical on-ramp, free to audit.

• Ethan Mollick (Wharton) — Co-Intelligence: An AI Masterclass — the clearest single explanation of what these tools change about how you work.

• Anthropic Academy — Introduction to Claude Cowork and the free Interactive Prompt Engineering Tutorial — the two courses this programme’s builds are drawn from directly.

Running this with your board

Several readers running the weekly instalments asked whether this could be done as a group rather than solo. It can. Suggested version for a board or leadership team:

• Circulate one week’s read/watch/listen ahead of a scheduled 30-minute call.

• Each person does the week’s build independently beforehand — this only works if people actually try it, not discuss it in the abstract.

• Use the call to compare builds, not re-teach the material: what worked, what broke, what you’d change.

• Week 6 becomes a live discussion of your own board’s AI governance posture, using the risk checklist as the agenda.

• Keep it that way in a group setting too: no one should bring a real board paper to compare notes. The exercises are designed to work entirely on hypothetical topics and public information — that’s what makes them safe to run with colleagues who don’t share your NDA obligations.

If you’d like a facilitated version of this for your board — a structured session with the six builds compressed into a single half-day workshop — reply to this email.

Governance sounds like a compliance checklist. In practice it’s the set of rules that determine what an agent can do, what it can’t and who owns the output. Without it agents can make decisions no one asked it to do and no one will know until something bad has happened. Mckinsey’s research suggests that governance frameworks integrated with business processes are what separates successful agent deployments vs failed ones. Do this before a single deployment or API call.

Most boards do the easy half: set a posture, build a partial inventory, then quietly stop before naming an owner, hard-wiring the controls, or running the loop that would expose whether any of it is real — because this iterative feedback loop is what creates personal accountability, not just paperwork. Here’s the whole loop, a set of metrics to measure and the move your board is most likely avoiding.

1. Set your AI posture. Before ‘how much risk?’, answer ‘how much agency?’. Decide where AI may act autonomously, where it may only recommend, and where it is prohibited — by decision type, not department (e.g. screening CVs, responding to customer support queries, managing refunds or payments, credit checking, procurement etc). What is prohibited vs with clear limits? To what standards and ethical guardrails? This is an Executive team call validated with the board, made explicitly and minuted, not something inherited from whatever the tools default to. Everything else hangs off it.

2. See everything. Build the inventory before the policy. A live register of every material AI system and agent: what it does, what data it touches, which vendor sits underneath. Don’t forget the AI staff use without IT’s knowledge, sometimes called ‘shadow AI’: one governance vendor, governr.ai, puts it at 60–70% of what’s actually deployed inside the average regulated firm. At minimum start with your high risk known cases. Ideally classify each use case by strategic value and risk. If you can’t produce the inventory inside 48 hours, the policy is theatre.

3. Name the owner. Every material AI system carries a named human owner (management and board committee) — for the decision, the data and the vendor relationship. Accountability can never transfer to the machine. Diffuse accountability is what produces the regulator’s letter.

4. Embed the controls. Move from detective to preventive. Hard limits, approval thresholds and a tested kill switch built into the system itself (hard coded upfront with outputs validated) — not a quarterly review that catches the failure after a million decisions. Human sign-off stays mandatory for money movement, code deployment and customer commitments.

5. Monitor, and close the loop. Fund a small number of strategic bets and stop weak pilots. In addition to model releases, vendor moves, incidents - track ROI, token cost, workforce effects & provider concentration. Realtime metrics, not adjectives (see below). As things change test the feedback loop. Refresh board education & scenario testing.

Run it well and this isn’t just defence — it’s how you move faster with more confidence than a rival who’s flying blind. Five moves. Most boards have done one or two and are resisting the rest.

Posture, inventory, owner, controls, monitor & loop. Simple to describe, revealing to run — because each move exposes whether the previous one was real.

The board dashboard: what directors should see quarterly, with a weekly pulse

As an example, I would split Board metrics into five groups:

What does good look like? Example of an AI dashboard click here

A board should not accept a dashboard that says: “we have 150 AI use cases.” That is usually a symptom of weak strategy. The better answer is: “we have 8 scaled AI workflows, 4 material strategic bets, 3 stopped initiatives, £X realised value, Y% provider concentration, Z unresolved risks.”

Your board was built for risks that hold still. AI doesn’t.

How many Boards or committees spend forty minutes on AI - where the CIO runs accuracy charts. The General Counsel updates on the EU AI Act & the AI policy document gets signed off without a question? Polished papers, all minuted.

No realtime metrics or discussion on model agency or risk classification? How many decisions in that room reflected that the system under discussion had shipped several vendor updates since the last cycle with updated token pricing & multiple APIs accessing your data — or that the model on the slide wasn’t the model in production.

The governance is theatre. The AI risk is live & different for 3 reasons:

It is probabilistic. Traditional software works or it doesn’t. AI is right most of the time — and wrong with total confidence some of the time. ‘Show me the test results’ gets you a confidence interval, not a certainty. Most directors have never governed one.

It doesn’t sit still. Models drift, vendors push updates, data shifts. A compliant system in January can be non-compliant in June without anyone touching the code. And it doesn’t stay where you put it: AI now sits inside spreadsheets, copilots, supplier portals and browser extensions, mostly uninventoried.

It moves at machine speed. Use cases deploy in weeks; board cycles run in quarters; assurance runs in years. A biased model can serve a million decisions before the next risk committee meets. A deepfake can move a share price in an afternoon.

So what: the annual audit cycle, the quarterly board pack and the policy attestation were designed for a different clock speed. Here are the ten ways that mismatch blows up — and the risk is rarely the technology. It is the governance around it.

1. Strategy — someone reprices your industry while you run pilots. The most dangerous slide is the one describing AI as ‘efficiency’. The real question is whether anyone — incumbent or new entrant — is using AI to reprice the industry around you. If management cannot say where your proprietary advantage now sits and what AI does to it, that is your first red flag.

2. Decisions — the model is wrong with confidence. Hallucination, bias, drift, opacity — and increasingly, decisions taken autonomously at machine speed before a human can intervene. The board does not need to validate models. It needs to know that someone does, and that the highest-stakes decisions carry a human check by design. Would you know if your AI got something wrong an hour ago — or only when a regulator, a customer, prospective hire or a tribunal told you?

3. Data — your crown jewels leak one prompt at a time. Staff are pasting confidential material into public tools today. Models are being trained on content the company may not own. Data governance is not hygiene; it is the foundation of defensible AI — and the first thing a regulator or claimant will pull on. Do you know which of your data is feeding which models? Are you sure you want foundation models accessing your data (ie not training your competitors), are ‘enterprise’ promises & guardrails valid when the underlying model retains data (ie Claude Fable). Is model control a competitive advantage or a moat in your category? The most recent high profile example is of Anthropic rebuilding elements of Figma, where a partner entered the category (Figma share price down circa 50%YTD). The recent debate is around in-house open source models running your own compute stack - given current frontier model token costs this is now becoming a viable (safer) alternative for many?

4. Cyber and fraud — the attacker now has AI too. Deepfake CEO impersonation is no longer hypothetical; finance teams have wired money to cloned voices. The launch and fanfare around Anthropic’s launch of Mythos has changed the Board conversation. However, one of the biggest risks lies within - ‘prompt injection’ can turn an AI assistant into a hijacked insider with real credentials. If cyber reporting to your board does not name AI-enabled threats & the new ‘surface’ they are attacking explicitly, the reporting is incomplete.

5. Regulation — ‘we didn’t know the tool used AI’ is not a defence. The EU AI Act is real, phased and binding for anyone touching the EU market - with the high risk regime landing this August. The UK floor is hardening; the SEC has already enforced against misleading AI claims. Regulators have stopped accepting an annual sign-off as evidence, they want model level records, continuously.

6. Operations — what happens if your AI vendor pushed a silent update tonight, would you find out from your own monitoring — or from your customers? One retailer only discovered its personalisation engine had quietly changed pricing logic after a routine vendor patch when margin fell two points, unexplained, in a single quarter. A yearly continuity test doesn’t catch a system that changes behaviour on a Tuesday night without telling you.

7. Reputation — one failure erases ten wins. AI failures are reputationally asymmetric. One unfair decision, one leaked dataset, one deepfake incident, and the value created by ten well-governed use cases evaporates. Trust is a board asset. Ethics has to be a control, not a communications line.

8. Talent — job enrichment vs displacement? Adoption without redesigning how the work gets done, lacking AI Literacy beyond the tech team. No incentives tied to value capture. Questions many boards are now asking - What is our AI workforce strategy? How are we measuring impact on jobs? What is our AI literacy baseline - for Colleagues, Executives & Directors? How can we deploy talent, rebundle ‘tasks’, build a new organisation model with different spans of control - with humans managing agents?

9. Concentration — it’s no longer just about ‘which model do we use”. It’s about whether a single government decision, vendor pivot or API or token price change could disable critical workflows overnight or make them uneconomic? Most third-party due diligence never asks about model provenance, change notification or sub-processor chains. Does the Board know where concentration risks lie, how quickly can we substitute and what’s the impact?

10. Economics — the money blows up quietly. Also new, and increasingly the one investors ask about. AI cost is now tied to physical infrastructure — compute, chips, power — and token pricing that can move under your business case. Meanwhile most enterprises are funding pilot portfolios with no stop/go criteria and no measured return. Capital committed to AI should face the same discipline as any strategic capex/opex: stage gates, downside cases, explicit return thresholds. Uber recently announced it burnt through its entire 2026 AI coding budget in four months and moved to cap token usage after the horse had bolted.

A board that checks in once a quarter cannot govern a system that changes every day. Today only 39% of Fortune 100 boards have any form of AI oversight — a committee, a director with the expertise, an ethics board. Only 6% have management reporting that goes beyond adjectives. That’s not a knowledge gap.

The uncomfortable close: none of the ten requires the AI to fail. Half of them detonate when the AI works exactly as designed — on the wrong data, at the wrong speed, under the wrong ownership, or at a price that no longer makes sense. How to fix it

Every board operating model in use today rests on a hidden assumption: the actor making a consequential decision is a human — instructable, supervisable, accountable. That assumption broke this year. The first-order board question is no longer “how much risk?” It is “how much agency?” — and if you cannot name who owns each material agent in your business & how you govern in realtime, the regulator’s letter is already drafted.

This week’s issue carries both halves of the case.

## 🎯The Frame · the manifesto. “Your board isn’t slow on AI. Maybe it’s flying blind at speed.” The structural break. The ten questions every Chair should be asking.

## 📚The Library · the system. “Your AI governance isn’t an IT policy. That’s why it’s failing.” The working manual: the board’s four jobs reframed around agency, the six tests that separate governance from theatre, and the named-human-owner discipline for every agent in production.

Also in this week’s issue:

## 🛡The Watch · the governance pulse. Regulator moves, AI failure. Where could AI go wrong & are we covered?

## ❓ Five for the Chair · this week’s key questions. Topics for the board table?

## 📡 The Signal · AI signal vs noise. What changed this week. So what for the Board?

## 🛠 Monday Morning · What to try, read, listen to & watch this week

Read before your next board pack. Ai intelligence for directors - strategy, risk, governance, capability

👉 Read this week’s issue on TheDirectorBrief → · Subscribe free.

________________________________________________________________________

## 🎯 THE FRAME· the strategic conversation of the week

### Your board isn’t slow on AI. Maybe it’s flying blind at speed. The governance gap in 2026 isn’t caution. It’s confidence without comprehension. Here’s a new framework to avoid the trap & 10 questions every board should be asking?

The finding that should stop every Chair in their tracks……

A BCG survey of 625 CEOs and board members published last month (May 2026) found that 61% of CEOs believe their boards are rushing AI transformation. Not dragging their feet. Rushing it.

The explanation buried in the data is worse than the headline: the directors with the lowest confidence in their own AI knowledge are the most likely to believe their organisation is moving too slowly.¹

The directors who understand AI least are the ones pushing hardest for speed.

This inverts the conventional narrative — that boards are too cautious, too analogue, too late for the AI moment. The 2026 evidence says something more uncomfortable: boards are not behind AI. They are ahead of what they understand. And that combination — urgency without literacy, momentum without oversight — is precisely how consequential decisions get made badly, and at scale.

The silence in the room

The history of disruption rhymes. The pattern is consistent: creative destruction gets treated as business-as-usual until it isn’t. Have you sat in meetings approving AI spend with no clear value logic, approving the tech stack without challenging the design choices, treating AI governance as a rear view checklist, measuring success by pilots or tokens, accepting ‘human oversight’ without testing if it’s for real? No need to put your hand up.

Are we asking the right strategic and governance questions of a technology now reshaping how organisations fundamentally compete and operate — respond to customers, price, recruit, source, pay, credit-check, market — where agents, not humans, are increasingly making the decisions?

The question that every challenger is building their business on:

That silence is the governance gap. Not speed. Not caution. The absence of the question that wasn’t on the agenda.

The numbers no longer allow a comfortable interpretation

Two findings now sit alongside each other in a way the boardroom cannot ignore.

Deployment is happening regardless of readiness. Grant Thornton’s 2026 AI Impact Survey finds nearly three in four organisations are giving agentic AI access to their systems and processes — piloting, scaling or running it in production. Just 20% have a tested AI incident response plan for when it fails.

Capital is moving at the same speed. BCG’s AI Radar finds corporations expect to lift AI spending from 0.8% to 1.7% of revenues in 2026, with more than half directed at agentic systems. These are not experimental budgets. They are material capital commitments made into a technology most boards do not yet have the fluency to interrogate.

What changes when the actor isn’t a person

Every board operating model in use today rests on a hidden assumption: the actor executing a decision is a human who can be instructed, supervised, slowed down and held to account. Once decisions and actions are delegated to autonomous agents — pricing engines, customer-routing models, recruitment screens, refund bots, credit-check agents — that assumption breaks. And once it breaks, the substance of nearly every board responsibility changes with it.

Governance moves from directing human actors making occasional, reviewable decisions to deciding how much agency to delegate to a non-human actor in the first place. Risk moves from slow, visible and auditable-after-the-fact to fast, opaque and emergent — errors propagating at machine speed before controls catch them. Controls move from detective to preventive, embedded (in the code) and real-time — hard caps, whitelists, kill switches built inside the agent. Compliance moves from periodic and sample-based to continuous and designed-in. Assurance moves from tracing the decision to validating the guardrails under stress, because the reasoning isn’t transparent. Accountability stays exactly where it has always sat — with a named human — because it can never transfer to the agent.

The new first-order board question is no longer “how much risk are we willing to take?” It is “how much agency are we willing to delegate?” — where agents may act autonomously, recommend-only, or are banned outright; each with a named human owner; each with a tested kill switch.

## 🛡 THE WATCH· the governance pulse.

[1] How does the new Anthropic-US protocol (Executive Order 14409) change your group’s foundation-model vendor risk profile? What were your continuity plans during the 18 day suspension?

Anthropic’s Fable 5 and Mythos 5 restored after 18-day US export-control suspension.The US government lifted its 12 June export-control directive on 30 June. Fable 5 returns globally on 1 July; Mythos 5 is being reintroduced only to approved US organisations following government review. News that OpenAI’s new GPT-5.6 model launched with initial access limited to the US government, before broader rollout, shows the new ‘voluntary’ protocol is the now the defacto standard.

[2] FCA rewrites its own rulebook: “steward that intervenes on judgement, before the law arrives”. How prepared is your board?

At techUK’s Agents of Change summit on 24 June, FCA Chief Executive Nikhil Rathi delivered “Rethinking regulation for the age of AI” — the clearest statement yet of how UK financial services regulation of AI will actually work. The FCA has concluded that the old contract, in which Parliament writes detailed rules and the regulator enforces them, no longer fits a market where the technology reshapes itself faster than any statute can be drafted. In its place, the FCA is positioning itself as “a steward that intervenes on judgement, before the law arrives”.

Rethinking regulation for the age of AI — FCA speech, Nikhil Rathi — · 24 Jun 2026

[3] Ford quietly rehires 350 “gray beard” engineers after AI quality inspection failed.

Ford didn’t anticipate “preserving institutional knowledge and training junior engineers” as they replaced humans with agents. Ford has quietly rehired 350 senior engineers — many former employees — over the past three years to fix the problem. In the same week, British American Tobacco announced 9,000 role reductions (5,500 direct, 3,500 outsourced) targeting £600m annual savings by 2028, with interim CFO Javed Iqbal citing AI and data analytics as the reshaping force.

What’s the hidden cost of job displacement (eg warranty, recall, litigation, brand etc) & how is this being tracked?

## ❓ FIVE FOR THE CHAIR

Most directors governing AI have never used AI to do something consequential. Most AI risk frameworks were written by people who have not failed with AI in production. This is not an irony — it is a specific kind of fragility. These five questions will not tell you whether your AI strategy is right. They will tell you whether your board is capable of knowing.

## 📡 SIGNAL· AI signal vs noise

[1] Stat of the week: 90% of firms are raising AI budgets even though the savings haven’t landed

Bain’s recent survey of 951 $100m+-revenue executives found 40% targeting 11–20% AI cost savings achieved only 0–10%. Just 4% cleared 30%. Yet 90% are increasing next-year budgets, and 44% are funding Phase 2 from Phase 1 savings that never materialised. Bain calls the funding mechanism out: this ‘should be making executives uncomfortable.’

What do your ‘delivered savings’ vs ‘projected savings’ look like on your board - do you understand the variance (& ROI implications)?

[2} Chart of the week….in contrast, the AI natives might be pulling away?

Half of Claude users say AI already handles more than half their job: Anthropic’s third Economic Index (’Cadences’, 26 June)

[3] Visa wires its payment rails into ChatGPT

Visa embedded its network into ChatGPT at its Payments Forum; Mastercard launched Agent Pay for Machines the same day. Any merchant accepting Visa is now reachable by an AI agent without bespoke integration. AI-referred retail traffic was already up 393% year-on-year in Q1.

If checkout moves (even in part) to agents, customer relationship moves to whichever model the customer trusts. Brand loyalty and customer-acquisition-cost economics may need re-underwriting?

[4] Does any P&L that depends on organic search - retail, media, travel, b2b lead-gen - need a new business model? AI Overviews cut publisher clicks by ~40% in a randomised field experiment

Pew’s 68,000-query tracker plus a randomised field experiment (revised 17 June) converge: users click a result 8% of the time when an AI Overview appears versus 15% without. Only 1% of Overviews send a click to a cited source. Digital Content Next members lost ~10% of search traffic in May–June. First robust causal estimate — not just correlation.

[5] Apple rents the AI it could not build — if the most cash rich company on earth can’t build it’s own frontier model - why can you (or the EU or UK)?

At WWDC on 8 June (Tim Cook’s last), Apple rebuilt Siri on a custom 1.2-trillion-parameter Gemini model from Google, paying roughly £750m a year and routing the heaviest queries to NVIDIA B200s on Google Cloud. Two years after promising context-aware Siri in-house, Apple has conceded the model layer. Ternus succeeds Cook on 1 September.

[6] How does ‘vibe coding’ & ‘loop prompting’ change your engineering headcount plan…..how does it blur traditional job descriptions?

The most sceptical AI analyst in tech (Ben Thompson - Stratechery) spent June building his own app with a coding agent. I followed his lead to build a top 10 restaurant app by city and cuisine - view here. His argument: LLM-driven development works for narrow, verifier-rich tasks; fails on integration and edge cases. Comes the same week Andrew Ng argued ‘loop engineering’ replaces ‘prompt engineering’. Game changer when you see what the teams at Big 4 firms are charging you for?

## 📚 THE LIBRARY· AI academy for board directors.

Your board is asking the wrong AI question.

Your AI governance isn’t an IT policy. That’s why it’s failing

Many boards are facing the same structural shift — and many of them haven’t named it yet. The first-order AI question is no longer ‘how much risk?’. It is ‘how much agency?’

That’s the gap. And if your board cannot answer who owns each material agent in this business, you do not have AI governance. You have AI activity.

This week’s article in The Library is the manual for closing the gap. You get: the Four-Domain Frame applied as a working system, not a checklist; the board’s four jobs reframed around agency; six load-bearing questions that expose governance theatre faster than any audit-committee paper; a refresh on why the personal-exposure clock has already started. In future weeks I’ll share a full AI goverenance primer & some of the realtime tech tools to rewire how boards might work.

→ Read ‘Your AI governance isn’t an IT policy. That’s why it’s failing.’

## 🛠 MONDAY MORNING

🛠 ** TRY:** Learn to use claude cowork in 30 mins - read this and set up your own personalised daily briefing.

📖 **READ:** Chip War - Chris Miller - if you haven’t already. Explains the AI stack, bottlenecks, the geopolitics & stock market movements of today. The best business book of recent times IMHV.

🎥 **WATCH:** How I vibe coded a full app using claud code (30 mins) - Jason Lee. My daughter and I watched this - she built a portfolio management app with X-ray analysis, I built a top 10 restaurant recommendation app by cuisine and city in 2 hours.

🎧 **LISTEN:** The AI daily brief - Nathaniel Whitmore - 5 min weekly digest of what’s happening in AI world

That’s it for this week.

Next week: [1] ## 🎯 THE FRAME Eight ways AI can blow up your business….and how to fix it.

Standing topic, or system?

Who’s asked who owned the AI agenda at executive level, how much agency had been delegated to which agents, what guiderails we had hard coded or who was responsible for each? What the board would see on the dashboard next quarter? How are we tracking this realtime givemn agents are making decsions on our behalf and each model updates creates different outcomes? If like many, you haven’t, then this gap is what this manual page is built to close.

Most boards now treat AI as a standing topic. Far fewer treat it as a system. And the system you need now must govern a non-human actor at machine speed — not a person at quarterly cadence.

Standing topic produces an update. System produces evidence (real time).

The Stat This Week
65% of organisations now use generative AI in at least one business function. Three in four are running agentic AI in their systems. Fewer than one in five has a defined AI governance operating model that names who is accountable for each agent. Adoption up, agency unowned, evidence flat.

The shorthand

Strip the leading frameworks back. OECD’s updated 2024 principles set the values — human-centred, transparent, accountable. NIST’s AI Risk Management Framework reframes them as an operating loop — Govern, Map, Measure, Manage. The EU AI Act bolts on legal obligation, phased: prohibited practices live since February 2025, general-purpose AI obligations since August 2025, high-risk system obligations from August 2026. The UK’s principles-led approach leaves more discretion but demands the same outcomes. McKinsey, KPMG/INSEAD, the WEF AI Governance Alliance and the Harvard Law School Forum on Corporate Governance translate the same idea into board-level decisions: align posture, allocate capital, classify risk, govern the lifecycle, evidence the controls.

AI governance is value + risk + trust, governed as one system. The first-order board question is no longer “how much risk?” It is “how much agency?”

What changes when the actor isn’t a person

Every board operating model in use today rests on a hidden assumption: the actor executing a decision is a human who can be instructed, supervised, slowed down and held to account. Once decisions and actions are delegated to autonomous agents — pricing engines, customer-routing models, refund bots, credit-check agents — that assumption breaks. This is not a new agenda item. It changes the substance of nearly every board responsibility.

AI doesn’t replace the board’s duties. It raises the metabolic rate at which they must be discharged.

The Frame this week works through the structural break; this Library page operationalises the response.

The Four-Domain Frame, working as a system

The Manifesto introduces the Four-Domain Frame as the navigation grammar of this publication. The Library makes it operational — the same four domains, the same map, applied as a connected system rather than a list.

The Four-Domain Frame · the navigation grammar of TheDirectorBrief. Cross-cutting: 6-dimension scorecard (Value · Adoption · Risk · Compliance · Capability · Trust), 10 building blocks, 6-month implementation arc.

The board’s job is not to approve every tool or model. It is to ensure four things, one for each domain:

• Strategic intent — AI is linked to value, not pilot proliferation. (Strategy & Innovation.)

• Risk discipline — use cases classified, agency assigned explicitly, controls embedded before deployed. (Risk & Resilience.)

• Agency and accountability — every material agent has a named human owner; agency appetite (autonomous / recommend-only / prohibited) decided in advance; accountability never transfers to the agent. (Governance & Accountability.)

• Capability and trust — AI is explainable, fair, secure, lawful and defensible — and the board itself has the literacy to test that. (Capability & Culture, with Governance.)

A board doing only the first will be blindsided. A board doing only the third will miss the upside. The board that does all four turns AI from a risk to be contained into a capability to be governed.

Caremark exposure is not theoretical. Since Marchand v. Barnhill (2019) confirmed that boards owe an oversight duty for mission-critical risks, AI has steadily moved into the centre of that line. ISS and Glass Lewis both updated 2024 stewardship guidance to reference AI oversight and disclosure. If your minutes do not show evidence-based AI oversight — including who owns each material agent — the question is not whether you should worry. It is when.

The six questions that test whether your governance is real

The full Primer carries twenty questions, five per domain. Six are load-bearing. Use these in your next committee. If any of them produces a fluent description rather than a piece of evidence, you have governance theatre.

1. Where does AI create the most value in our business — and where could it destroy the most value?

Tests whether AI is integrated into strategy or banished to the cost line. (Strategy & Innovation.)

2. Do we have a complete live inventory of AI use cases — including GenAI, agents, copilots, shadow agents and vendor-embedded AI?

Tests whether the board has visibility — or only the slice management chooses to show. (Risk & Resilience.)

3. Are there AI uses we should prohibit because they are unethical, unlawful or inconsistent with our values?

Tests whether the board has set a floor. (Governance & Accountability.)

4. How much agency have we delegated to each material AI use case — autonomous, recommend-only or prohibited — and is a named human accountable for each?

Tests whether the operating model is defined or improvised. The new first-order question. (Governance & Accountability.)

5. Can we explain and defend AI-driven decisions to customers, regulators, courts or the media — and would the logs survive disclosure?

Tests whether you are defensible. (Risk & Resilience + Governance.)

6. What is the one AI failure scenario that could cause the most reputational harm — and have we imagined it concretely enough to plan for it?

Tests whether the board has imagined its worst day in enough detail to act. (Risk & Resilience + Capability & Culture.)

Watch, ask, decide

• Watch. The gap between the board’s confidence and management’s evidence. If the dashboard contains adjectives, not metrics, the gap is wide. If you cannot name who owns each material agent, the gap is wider.

• Ask. The chair and the SID — separately — who owns AI at executive level, which committee owns which risks, and when the board last received an end-to-end view rather than a topic-by-topic update. Inconsistent answers are the signal.

• Decide. Before the next cycle, that the board will receive a single integrated AI dashboard, that the AI inventory will be presented live (not quarterly), and that every material agent will carry a named owner, a documented agency appetite and a tested kill switch.

Next week

Ten ways AI can blow up your business — and the control architecture that catches them. The eight risk families tagged to the Four-Domain Frame, the agentic overlay (what changes when the actor is a machine), the ownership map updated for agency, three lines of defence, and the six-dimension scorecard.

TheDirectorBrief - What you get. Free, each week. Thirty minutes:

• A practical discussion of an AI related topic, centered on strategy, risk, governance & capability. A decision useful take - with examples, facts, useful frameworks and key questions to ask. Exposes common misconceptions and cuts through the hype (The Frame)

• Five board-ready questions for your next meeting (Five for the Chair)

• Curated decision ready AI news. What you need to know, why it matters and how you might factor into decision making (The Signal)

• Practical tools, how to guides, primers and prompts ready to (customise &) use in your business. (The Library)

• AI education for board directors What to play with, build, read, watch or listen to. Not one off. Building AI fluency on going. (Monday morning)

  Signal, not noise. Judgement, not updates.

Subscribe free at TheDirectorBrief.com — or reply to this email. I read every response.

Sources

1. McKinsey, State of AI 2024 — generative AI adoption by function. [Primary.]

2. Grant Thornton, 2026 AI Impact Survey — agentic AI deployment and incident response. [Primary.]

3. NACD, 2024 Public Company Governance Survey — AI in the top three director risks. [Primary.]

4. Stanford HAI, AI Index Report 2024 — regulatory mentions across major jurisdictions. [Primary.]

5. Marchand v. Barnhill (Del. 2019) — board oversight duty for mission-critical risks. [Primary.]

6. ISS and Glass Lewis, 2024 stewardship guidance updates. [Primary.]

7. Working paper: Governing AI Agents in the Enterprise (May 2026) — the 6-dimension shift and 8-phase continuous loop drawn from internal research; full table sits in The Watch (this week) and the Primer Section B.

Frameworks referenced: OECD AI Principles (updated 2024); NIST AI RMF 1.0 (2023); EU AI Act 2024/1689; UK DSIT principles; KPMG/INSEAD Global AI Governance Principles 2026; WEF AI Governance Alliance 2024–25; Harvard Law School Forum on Corporate Governance. [Primary, all.]

A BCG survey of 625 CEOs and board members published last month (May 2026) found that 61% of CEOs believe their boards are rushing AI transformation. Not dragging their feet. Rushing it.

The explanation buried in the data is worse than the headline: the directors with the lowest confidence in their own AI knowledge are the most likely to believe their organisation is moving too slowly.¹

The directors who understand AI least are the ones pushing hardest for speed.

This inverts the conventional narrative — that boards are too cautious, too analogue, too late for the AI moment. The 2026 evidence says something more uncomfortable: boards are not behind AI. Some are ahead of what they understand. And that combination — urgency without literacy, momentum without oversight — is precisely how consequential decisions can get made badly, and at scale.

The Stat This Week
61% of CEOs say their boards are rushing AI transformation — and directors with the lowest AI literacy are the most likely to believe they are moving too slowly. Urgency is being generated by uncertainty, not by analysis. (BCG, May 2026, n=625.)

The silence in the room

The history of disruption rhymes. The pattern is common: creative destruction gets treated as business-as-usual until it isn’t. Have you sat in meetings approving AI spend with no clear value logic, approving the tech stack without challenging the design choices, treating AI governance as a checklist, measuring success by pilots or tokens, accepting ‘human oversight’ without testing if it’s for real? No need to put your hand up.

Are we asking the right strategic and governance questions of a technology now reshaping how organisations fundamentally compete and operate — price, recruit, source, credit-check, market — where agents, not humans, are increasingly making the decisions?

The question that matters most:

If a well-capitalised competitor rebuilt our core product around AI in the next eighteen months, what would remain of our competitive position?

That absence of that question that wasn’t on the agenda is the governance gap. Not speed. Not caution.

The numbers no longer allow a comfortable interpretation

Two findings now sit alongside each other in a way the boardroom cannot ignore.

Deployment is happening regardless of readiness. Grant Thornton’s 2026 AI Impact Survey finds nearly three in four organisations are giving agentic AI access to their systems and processes — piloting, scaling or running it in production. Just 20% have a tested AI incident response plan for when it fails.²

Capital is moving at the same speed. BCG’s AI Radar finds corporations expect to lift AI spending from 0.8% to 1.7% of revenues in 2026, with more than half directed at agentic systems.³ These are not experimental budgets. They are material capital commitments made into a technology most boards do not yet have the fluency to interrogate.

What changes when the actor isn’t a person

Today’s operating model rests on a hidden assumption: the actor executing a decision is a human who can be instructed, supervised, slowed down and held to account. Once decisions and actions are delegated to autonomous agents — pricing engines, customer-routing models, recruitment screens, refund bots, credit-check agents — that assumption breaks. And once it breaks, the substance of executive & board responsibility changes with it.

Governance moves from directing human actors making occasional, reviewable decisions to deciding how much agency to delegate to a non-human actor in the first place. Risk moves from slow, visible and auditable-after-the-fact to fast, opaque and emergent — errors propagating at machine speed before controls catch them. Controls move from detective to preventive, embedded (in the code) and real-time — hard caps, whitelists, kill switches built inside the agent. Compliance moves from periodic and sample-based to continuous and designed-in. Assurance moves from tracing the decision to validating the guardrails under stress, because the reasoning isn’t transparent. Accountability stays exactly where it has always sat — with a named human — because it can never transfer to the agent.

The new first-order board question is no longer “how much risk are we willing to take?” It is “how much agency are we willing to delegate?” — where agents may act autonomously, recommend-only, or are banned outright; each with a named human owner; each with a tested kill switch.

AI doesn’t replace the board’s duties. It raises the metabolic rate at which they must be discharged.

We have been here before — and we didn’t learn the right lesson

When the internet arrived, large incumbent organisations appointed Chief Digital Officers. The CDO became the governance pressure valve — the person who ran the digital programme, attended the right conferences, brought in an army of vendors, seeded experiments and then asked to launch a venture fund. Boards called it digital strategy. Meanwhile insurgent entrepreneurs backed by smart VC money went directly after their core profit pools — reinventing the economic model, new distribution, ‘product’ as marketing, disciplined quarterly sprints, real-time customer metrics, not waterfall two-year IT projects out of date at the point of committing funds. Reinvention using technology, not technology applied to what they already did.

The companies that navigated that transition had something different: a willingness to self-disrupt — challenging their own legacy economics before someone else did — and boards and management teams who took a long view of what technology might do to their market, treated governance as part of product quality, and were clear about the problem they were solving and why their solution was 50%+ better. The best live example today is Google, managing an AI transition where Search still accounts for over $225 billion — more than 55% of total revenues.

Stripe and Square went after incumbents’ payment economics; Spotify rebuilt music distribution around access, not ownership; Airbnb did the same to hotels’ fixed-cost economics. On the other side of those bets sat the boards that watched it happen — Kodak, Blockbuster, Nokia, BlackBerry, Sears — others will follow. The governance failure was not a failure to understand technology. It was a failure to understand what technology did — to competitive dynamics, to cost structures, to who controlled the customer relationship. Crucially, digital was the CEO’s job, treated as a cross-business imperative with a board-level strategy. Not delegated to one function. Not run as an IT project.

The same structural deficit is repeating itself. We are, in 2026, roughly where we were in 2000 — the difference is that the cycle is compressed, the capital commitments are larger, and the competitive and regulatory environment is hardening.

The Four-Domain Frame — the navigation grammar

Stripped back to first principles, the WEF Oversight Toolkit, KPMG/INSEAD’s Global Principles, McKinsey’s AI Trust framework and BCG’s board guidance converge on ‘four domains’ a board must now own at the same time:

The Four-Domain Frame - Most boards govern one of these well. A few govern two. Not many govern all four simultaneously — this is not a surprise in a fast moving world of ambiguity, hype and uncertain outcomes. Nevertheless, the discipline is important.

The ten questions every board should be asking sit across the four domains. Each carries a consequence: the cost of it going unasked. That cost is the point.

Strategy & Innovation

1. If a well-capitalised competitor rebuilt our core product around AI in the next eighteen months, what would remain of our competitive position?

Most boards govern AI risk inside the existing business. Not many ask the disruption question — not whether AI creates risk in our operations, but whether it lets a rival make our operations irrelevant. Management is paid to defend the model that exists. The board owns the question of whether that model survives.

2. Is our AI investment buying competitive advantage — or operational parity that every rival will also reach?

Boards are approving AI spending that doubles in a single year. The right governance question is not how much. It is what for. Efficiency gains from AI are real and accessible to every competitor. The organisations building durable advantage are redefining the product, the customer relationship or the cost architecture in ways that are hard to replicate. Does the board know which category its spend falls into?

3. Is AI changing how this organisation makes decisions — or simply automating the decisions it already makes?

This is the line that separates real transformation from expensive process improvement. Most organisations use AI to do existing things faster. Fewer use it to do things differently — to make decisions with information they could not previously access, at speeds the operating model precluded, at a level of personalisation the old margin structure could not support. The board should know which category describes its programme.

Risk & Resilience

4. What is our AI risk framework built to catch — and what is it structurally incapable of seeing?

Risk frameworks identify the risks they were designed to identify. AI introduces categories no pre-AI framework was built to surface: emergent model behaviour, training-data bias at scale, adversarial manipulation, hallucination in high-stakes outputs, and — new in 2026 — agentic systems taking sequences of autonomous decisions across connected processes. An audit committee receiving a RAG status update on AI risk is not governing AI risk. It is receiving a summary of classified risks — which is a different thing entirely.

5. How much agency have we delegated to non-human actors — and did we decide that, or has it happened to us?

Three in four organisations now give agentic AI access to their systems; only one in five has tested what happens when it fails.² The board’s instinct is to ask how much risk. The question that survives the next two years is how much agency. For every material AI use case — pricing, credit, recruitment, customer routing, supply chain, refund handling — there are three possible answers: autonomous, recommend-only, prohibited. Each with a named human owner. Each with a tested kill switch.

Governance & Accountability

6. Where does accountability sit when an AI-driven decision causes harm — and has the board formally assigned it to a named human?

This is not hypothetical. The EU AI Act’s requirements are now effective across European markets. The FCA’s AI governance expectations are hardening. D&O exposure on AI-related harm is live and being tested. Most boards have not formally assigned AI accountability — not in committee terms of reference, not in management responsibilities, not in the schedule of matters reserved. Accountability never transfers to the agent. The answer, when it matters, will be found in what was documented. Not in what was assumed.

7. Is AI a standing item on the board agenda — or does it appear only when something goes wrong or management asks for a budget?

Reactive governance is incident response with a board letterhead. The boards building real oversight treat AI as a live strategic conversation — at the frequency and seriousness of financial performance — not as a technology update in the CTO’s slot once a quarter.

Capability & Culture

8. Are we asking management the questions that matter — or the questions management has prepared us to ask?

This is the meta-question, and the one I find most difficult to answer honestly about my own contribution. When I have been on the presenting side of the table, I knew which questions were coming. I had prepared answers. The questions I had not prepared for were the ones that changed the dynamic — and they were almost never on the agenda. The BCG finding cuts both ways: if boards are pushing faster than management, the question is whether that pressure is informed or anxious. Governance is not about speed. It is about the quality of the decision.

9. Who in this boardroom has used an AI tool to do something consequential in the last thirty days?

I include myself in this question. If your understanding of AI is entirely briefing-derived, your pressure for speed cannot be informed. The board cannot meaningfully challenge management’s AI strategy if its understanding of AI is entirely second-hand. This is not about becoming data scientists. It is the same standard of practical engagement expected of any director overseeing a material business transformation. The board that governed digital without digital experience was the first wave’s structural error. Repeating it knowingly is harder to excuse.

10. Do we have the board composition to govern the company we are building — not just the one we have?

The NomCo’s job has always been to ensure the board has the skills the strategy requires. If the strategy now includes material AI transformation, agentic systems deployment and regulatory navigation under the EU AI Act, the skills required have changed. Not more technologists — more directors with the economic intuition to read what AI does to competitive dynamics, cost structures and the value of human judgment. A board effectiveness review that does not address this is answering the wrong question.

Effective AI governance is not a framework. It is a quality of attention — and the willingness to ask the question that was not prepared for.

Before your next board meeting

Of the ten questions above, which three would most change your board’s current AI conversation?

This week in The Library

Your AI governance isn’t an IT policy. That’s why it’s failing. The companion to this Manifesto — the framework, the board’s four jobs and the six diagnostic questions that test whether your governance is real. Read after this.

Next week in The Frame

Next week we discuss 10 ways AI can blow up your business. In a world where AI is probabilistic, it doesn’t sit still & it moves at machine speed - what are the risks and what is the emerging augmentation to the traditional governance model.

Disclaimer: These are my personal views, shaped in a fast-moving environment and open to revision. They should not be taken as representing the perspectives of any boards or advisory roles, past or present.

TheDirectorBrief What you get. Free, each week. Thirty minutes:

• A practical discussion of an AI related topic, centered on strategy, risk, governance & capability. A decision useful take - with examples, facts, useful frameworks and key questions to ask. Exposes common misconceptions and cuts through the hype (The Frame)

• Five board-ready questions for your next meeting (Five for the Chair)

• Curated decision ready AI news. What you need to know, why it matters and how you might factor into decision making (The Signal)

• Practical tools, how to guides, primers and prompts ready to (customise &) use in your business. (The Library)

• AI education for board directors What to play with, build, read, watch or listen to. Not one off. Building AI fluency on going. (Monday morning)

  Signal, not noise. Judgement, not updates.

Subscribe free at TheDirectorBrief.com — or reply to this email. I read every response.

Sources

1. BCG, AI in the Boardroom, May 2026 — survey of 625 CEOs and board members.

2. Grant Thornton, 2026 AI Impact Survey — agentic AI deployment and incident response readiness.

3. BCG, AI Radar 2026 — corporate AI spend as percentage of revenue.

Performance reference: MIT CISR, Board Digital Fluency and Performance, March 2025 — AI-fluent boards outperform peers by 10.9 percentage points in ROE; non-fluent boards trail by 3.8%. Carried in The Library’s board-effectiveness primer.

Frameworks referenced: WEF AI Governance Toolkit (2024–25); KPMG/INSEAD Global AI Governance Principles (April 2026); McKinsey, State of AI Trust 2026 — Shifting to the Agentic Era; BCG AI Radar 2026. Agentic governance logic drawn from working paper Governing AI Agents in the Enterprise (Library, May 2026).