Introduction
Something shifted in boardrooms this year. AI policy and regulatory concerns have overtaken DEI and immigration as the top workplace issue for U.S. executives — not by a small margin, but decisively. According to Littler's 2026 Annual Employer Survey, 84% of U.S. business leaders now expect AI-related policy or regulatory changes to affect their operations in the next 12 months. A year earlier, that figure was 42%.
That near-doubling reflects something boards are feeling acutely: AI adoption is outrunning governance. Tools are spreading across departments faster than policies can track them, and the legal exposure — discrimination claims, data privacy violations, state-law compliance failures — is becoming concrete.
This post covers where most organizations stand right now, what a defensible AI policy must address, and what boards specifically need to do to exercise meaningful oversight — the kind that holds up to scrutiny.
TL;DR
- 84% of U.S. business leaders expect AI regulatory changes to affect operations in the next 12 months — up from 42% the prior year
- 68% of employers have a written AI policy, but fewer than half have the governance controls that make it defensible
- A strong policy covers data privacy, approved tools, bias mitigation, human oversight, and employee training
- Boards cannot treat AI governance as a management-only issue — they need metrics, escalation thresholds, and visible oversight
- The gap between written policy and inspectable governance is where litigation and regulatory exposure land
The State of Corporate AI Policy in 2026
The Numbers Have Changed Fast
The 84% figure from Littler isn't just striking in isolation — it's the doubling that matters. When a concern goes from 42% to 84% in a single year, it signals that something shifted from "emerging risk" to "board-level priority" almost overnight. That's the story of AI governance in 2025–2026.
Policy adoption followed the same trajectory. 68% of employers now have a formal AI governance policy, up sharply from 38% with a specific policy the prior year. On the surface, that looks like progress. The problem is what sits underneath that number.
| Governance measure | 2026 adoption rate |
|---|---|
| Formal AI policy | 68% |
| Third-party vendor due diligence | 45% |
| Tool-specific employee training | 43% |
| Designated AI oversight committee | 45% |
Fewer than half of organizations have implemented the controls that make a policy enforceable. A policy without enforcement mechanisms is a liability, not a safeguard.
What's Driving Executive Anxiety
79% of employers report concern about AI-related litigation in the next 12 months. The specific concerns, ranked:
- Data privacy (employee and candidate data): 49%
- Discrimination and bias: 45%
- State and local AI law compliance: 43%
- Recordkeeping, documentation, and explainability: 35%
Each of these concerns has a specific legal exposure profile — and the case law is starting to fill in the details. On data privacy, California's CPPA finalized automated decision-making technology regulations taking effect in 2026–2027, extending obligations to how employers process employee and candidate data through AI tools.
On discrimination, Mobley v. Workday moved the needle: a federal court allowed disparate impact claims to proceed against an employer that delegated hiring screening to an AI tool, on an agency theory. The decision confirms that outsourcing a decision to an algorithm does not outsource liability.
The State-Federal Tension
The regulatory landscape is genuinely complicated right now. The NCSL reported that all 50 states introduced AI-related legislation in 2025, with 38 states adopting or enacting approximately 100 measures. Key employment-related laws already in effect:
- New York City Local Law 144: Requires independent bias audits before deploying automated employment decision tools
- Colorado AI Act: Effective June 30, 2026
- Illinois and Texas: Employment-related AI laws with January 2026 effective dates
At the same time, the White House issued a December 2025 executive order and March 2026 legislative recommendations aimed at limiting state-level AI regulation through a national framework. But no enacted federal preemption rule was in place as of mid-2026.
The practical implication: organizations need state-law compliance readiness and federal monitoring capability running in parallel. Waiting on federal preemption before building state-law compliance is not a defensible strategy — the exposure is real today.
AI's Workforce Dimension
AI is also reshaping the workforce in ways that create additional policy surface area. Littler's survey found:
- 37% of employers have reassessed or are reassessing job responsibilities due to AI
- 20% have reduced or are reducing hiring
- 15% have reduced or are reducing workforce size
When headcount reductions or responsibility shifts are tied to AI efficiency gains, documentation and fairness considerations become critical. Undocumented AI-influenced workforce decisions create exactly the evidentiary gaps that plaintiff's counsel will exploit — and that boards will be asked to explain.
The Governance Gap: Policy on Paper Versus Governance in Practice
Having a written AI policy and having an operational governance framework are not the same thing. A document sitting in a shared drive provides no protection if there is no mechanism to enforce it, audit compliance, or escalate exceptions.
Where the Gaps Actually Are
The Littler data points to three specific control failures that are common across organizations:
- No formal approval process for new AI tools — fewer than half have one, meaning departments are adopting tools without review
- No restrictions on what information can be shared with AI tools — a direct data privacy exposure
- No tool-specific training — employees may not know what they can and cannot do with approved tools
These gaps compound as AI tool adoption spreads. Without clear decision rights, different teams make different choices about what data to share, which tools to use, and how to document AI-assisted decisions. Over time, this creates audit trails that cannot support a legal defense.
What Inspectable Governance Looks Like
There's a difference between governance that exists and governance that can be demonstrated. Inspectable governance means that when a regulator or plaintiff's attorney asks, you can produce:
- Training records showing employees received tool-specific guidance
- Vendor assessment documentation for third-party AI tools
- Approval logs for new AI tool adoption
- Incident escalation records
- Bias audit results for high-stakes AI applications
Contrast that with a policy PDF in a shared drive, no evidence of training, and vendor agreements that predate any AI-specific review. What courts and regulators examine is what you actually did — not what your policy document says you intended to do.
The Board Accountability Connection
Regulators and courts expect boards to exercise active oversight of material technology risks. Recent enforcement actions make the stakes concrete:
- SEC: Charged two investment advisers with false and misleading statements about AI use, resulting in $400,000 in combined penalties
- FTC: Banned Rite Aid from using facial recognition after finding it deployed the technology without reasonable safeguards
- EEOC: Required $365,000 in the iTutorGroup settlement after an algorithm automatically rejected older applicants
Those cases share a common thread: the organizations had policies. What they lacked was evidence of active board oversight — credible reporting, documented judgment calls, and a clear record of accountability. The NACD reports that more than 62% of directors now set aside full-board agenda time to discuss AI — but agenda time and meaningful oversight are not the same thing.
What Every Corporate AI Policy Must Address
A defensible corporate AI policy needs to be specific enough that an employee in a specific role can answer two questions: "Is this tool approved?" and "What can I do with it?"
Data Privacy and Information-Sharing Boundaries
The policy must clearly define which categories of data cannot be shared with AI tools without explicit approval:
- Employee personal information and HR data
- Customer data (especially regulated categories)
- Proprietary business information, contracts, and strategy documents
- Any data subject to HIPAA, GLBA, or state privacy laws
Exceptions need an approval path — not a blanket prohibition employees will work around. Tools that ingest sensitive data without guardrails create exposure that policies written after the fact cannot cure. Data privacy is the top AI litigation concern for exactly this reason.
Approved Tool and Vendor Governance
Ad-hoc tool adoption by individual departments is the source of most AI governance failures. Microsoft and LinkedIn reported that 78% of AI users brought their own AI tools to work — and that number has only grown as consumer AI tools have become more capable and accessible.
A defensible policy requires:
- A defined process for requesting and approving new AI tools
- Vendor assessment standards covering data handling, model training data, contractual liability, and security posture
- A periodic review cycle for approved tools (not just a one-time approval)
- Clear consequences for using unapproved tools
Bias, Fairness, and Non-Discrimination
AI models inherit and amplify bias from training data. For any AI used in hiring, performance evaluation, lending, or other high-stakes decisions, the policy must require:
- Regular bias audits with documented methodology
- Review of adverse impact on protected classes
- Human review before AI-assisted decisions are finalized
- Documentation sufficient to explain the decision if challenged
The EEOC has confirmed that Title VII adverse impact rules apply to software, algorithms, and AI used in employment selection — making this a legal obligation, not just a governance best practice.
Human Oversight and Decision Accountability
The policy must specify where human review is mandatory — not just encouraged. AI should support accountable human judgment in consequential decisions, not replace it. The EU AI Act's Article 14 makes this explicit for high-risk AI systems.
Define:
- Which decisions require mandatory human review before action
- How AI-assisted decisions are documented
- Who bears accountability when an AI-assisted decision is challenged
Employee Training and Acceptable Use
A one-time acknowledgment form is not meaningful training. Effective AI training requires three things:
- Role-specific guidance: what "acceptable use" means for someone in HR looks different than it does for finance or sales
- Concrete examples: both permitted and prohibited actions, not abstract principles
- A feedback channel: somewhere employees can go when a situation is genuinely ambiguous
Best Practices for Implementing AI Governance
Start With an Inventory, Not a Policy
Organizations routinely discover, mid-implementation, that AI tools are already in active use across departments without authorization. Before writing policy, map what tools are in use, who uses them, for what purposes, and what data they touch.
This inventory becomes the foundation for risk tiering — distinguishing low-risk productivity tools from high-risk tools that touch employee data, customer data, or consequential decisions. You can't govern what you haven't found.
Build Cross-Functional Ownership
AI governance cannot succeed as an IT project. Legal, HR, compliance, IT security, and business leadership all have roles. An AI oversight committee, even a lightweight one with a defined charter and quarterly cadence, produces more durable outcomes than a single department trying to enforce policy without authority over the others.
The committee's job isn't to review every tool decision. It's to set decision rights, define escalation thresholds, and ensure the board receives consistent reporting.
Treat the Policy as a Living Document
Given the pace of regulatory change — new state laws, evolving federal guidance, emerging case law — the policy needs a defined review cycle and a clear owner responsible for tracking changes and triggering updates.
Minimum triggers for an out-of-cycle review:
- A significant new state law or federal guidance takes effect
- The organization adopts a new high-risk AI use case
- A material AI incident or near-miss occurs
For organizations without internal capacity to maintain this cadence, engaging an outside board advisor or fractional governance resource can build this rhythm into a standing cycle.
Tyson Martin's AI Governance Starter Pack is a 30-day fixed-fee sprint designed to move organizations from no formal governance to a defensible posture quickly — without requiring in-house expertise to run the process.
Establish Measurable Governance Metrics
A living policy only holds if someone is measuring whether it's working. A stable AI governance dashboard should track:
- Approved tools in active use vs. total tools detected (including shadow AI)
- Training completion rates by department
- Open vendor assessments and their status
- Policy exception requests and outcomes
- Bias audit completion status for high-stakes AI applications
- Incident escalations and resolution timelines
The board should receive trend data against these metrics, not a narrative summary. Trend data shows direction — whether risk exposure is growing, shrinking, or stalling — which is what makes oversight actionable rather than ceremonial.
The Board's Role in AI Oversight
AI governance is a board-level issue because AI now qualifies as a material risk. The litigation exposure, regulatory scrutiny, and workforce implications documented in 2026 data make that clear. The real challenge is making oversight effective without turning every board meeting into a technology briefing.
What Credible Board Oversight Looks Like
Effective board AI oversight relies on three things:
- Risk reporting that uses stable metrics to show trends over time — not one-time snapshots or technical jargon
- Escalation thresholds with a documented line between what goes to the board versus what management handles
- Decision rights that prevent both board overreach into operations and governance blind spots
Boards working with an outside board advisor can establish this reporting structure relatively quickly, particularly in organizations that lack mature internal AI governance capacity. Beyond the framework itself, a consistent reporting rhythm gives the board something concrete to hold management accountable to over time.
Questions Boards Should Be Asking Management Now
These are reasonable asks. Any board should be able to get clear answers within 30 days:
- What AI tools are currently in active use across the organization? (If management can't answer this, that's the finding.)
- What categories of data can employees share with AI tools, and is that documented?
- What is our liability exposure if an AI-assisted hiring or termination decision is challenged in court?
- How would we detect a policy violation — for example, an employee using an unapproved AI tool with customer data?
- When did we last assess the AI-related contractual terms with our top 10 vendors?
Good answers to these questions require operational governance — not just a written policy. When the answers are incomplete or inconsistent, that's where the board's follow-up should focus.
Frequently Asked Questions
What should a corporate AI policy include?
A defensible AI policy covers approved tool and data-sharing boundaries, bias and fairness requirements for high-stakes AI decisions, mandatory human oversight expectations, employee training obligations, and a defined review and escalation process. It should be specific enough that employees can apply it to real situations, not just acknowledge it exists.
Who is responsible for AI governance in a company?
AI governance is shared accountability — legal, HR, IT security, compliance, and business leadership each have roles. The board is responsible for overseeing the overall framework, while a designated internal owner or outside advisor handles day-to-day execution and ensures the board receives consistent reporting.
What are the biggest legal risks companies face from AI use?
The top concerns from recent employer surveys: data privacy violations involving employee and customer data, discrimination and bias claims (particularly in hiring and employment decisions), and compliance failures under the growing patchwork of state AI laws. Mobley v. Workday, the EEOC's iTutorGroup settlement, and the FTC's Rite Aid action illustrate all three categories.
What is the difference between an AI policy and an AI governance framework?
An AI policy sets the rules. A governance framework is the operational infrastructure — review processes, training programs, vendor vetting procedures, audit mechanisms, and reporting structures — that makes those rules enforceable. Without both, the policy becomes a document employees acknowledge once and ignore.
How often should a corporate AI policy be reviewed and updated?
At minimum, annually. Triggered reviews should also occur when a significant regulatory change takes effect, when the organization adopts a new high-risk AI use case, or when a material AI incident occurs.
How should a board oversee corporate AI use without getting lost in technical detail?
Effective board oversight relies on three things:
- Plain-language risk reporting with stable metrics that show trends over time
- Clear escalation thresholds defining what requires board input versus management delegation
- An outside advisor or internal owner who can translate technical risk into governance decisions
The board's job is judgment, not technical expertise.
