Establish board-level AI governance ensuring compliance, risk management, and responsible AI deployment.
By Errin O'Connor, Founder & Chief AI Architect, EPC Group
Last updated: 2026 · Read time: ~9 minutes
Last updated: 2026 · Read time: ~9 minutes
This guide outlines the essential approvals, monitoring, and reporting that boards must address for enterprise AI in 2026.
It includes:
Additionally, it maps Microsoft tooling to each requirement.
Boards can no longer treat AI as a purely operational matter. Regulators, auditors, and insurers now expect formal board approval of specific AI governance documents.
Boards should review and formally approve:
Board AI oversight covers four areas. Each requires different information and different reporting cadence.
Every enterprise needs a board-approved AI incident response plan before a crisis occurs. The plan must cover nine elements.
Board oversight of AI vendor contracts requires formal approval of contracts that include material AI provisions. Key terms to review and approve:
Three frameworks govern enterprise AI in 2026. Each has different scope and enforcement mechanisms.
| Framework | Scope | Key board obligations | |---|---|---| | NIST AI RMF 1.0 | US federal baseline; increasingly required by state and regulated buyers | Risk management integration, documentation | | EU AI Act | All organizations using AI in EU or processing EU resident data | High-risk AI classification, conformity assessment, board oversight documentation | | ISO 42001 | International AI management system standard | AI management system certification, internal audit program |EPC Group maps governance requirements to Microsoft's native toolset wherever possible. This reduces cost and simplifies audit evidence collection.
Boards must formally approve several key components related to AI governance. These include:
Additionally, annual AI audit results should be reviewed at the board level.
The NIST AI Risk Management Framework (AI RMF 1.0) serves as the US federal standard for AI governance. It includes four key functions:
This framework is now mandatory for many federal agencies and is increasingly required by state and regulated commercial buyers.
The EU AI Act impacts all organizations that utilize AI systems within the EU. It also applies to those that handle data of EU residents. This regulation is enforced regardless of the organization's location.
US companies with EU customers or operations must follow the relevant obligations.
High-risk AI systems include those used in:
These systems require conformity assessments, technical documentation, human oversight mechanisms, and registration in the EU database before deployment.
At a minimum, reviews should occur at the following intervals:
EPC Group provides AI governance frameworks that are ready for board review. We align requirements with Microsoft tools, including:
Additionally, we prepare audit documentation and offer vCAIO retainers for continuous board reporting and oversight of AI programs.
Talk to an EPC Group AI governance architect about your board requirements. Call (888) 381-9725 or request a 30-minute discovery call.
Board accountability for identifying, assessing, and mitigating AI-related risks including bias, security, operational failures, and regulatory violations.
Ensuring AI systems comply with HIPAA, GDPR, SOC 2, FedRAMP, and emerging AI-specific regulations including the EU AI Act and potential U.S. federal AI legislation.
Establishing ethical AI principles, preventing algorithmic bias, ensuring transparency, and maintaining human oversight of high-impact AI decisions.
Protecting sensitive data used in AI training, preventing data leakage, ensuring proper data governance, and maintaining audit trails for all AI data access.
Approving AI budgets, evaluating ROI, prioritizing AI initiatives, and ensuring alignment with business strategy and competitive positioning.
Establishing KPIs for AI systems, reviewing performance dashboards, tracking incidents, and ensuring continuous improvement of AI governance.
Various regulations set specific board-level requirements for AI governance. It is essential to understand these differences, especially in multi-regulatory environments.
Health Insurance Portability and Accountability Act
Potential Penalties:
Up to $50,000 per violation, $1.5M annual cap
General Data Protection Regulation
Potential Penalties:
Up to €20M or 4% of global revenue (whichever is higher)
Service Organization Control 2
Potential Penalties:
Customer contract breaches, loss of business
Federal Risk and Authorization Management Program
Potential Penalties:
Loss of federal contracts, debarment
Effective AI governance requires structured reporting to the board. The following reporting cadence ensures boards maintain appropriate oversight without micromanaging AI initiatives:
Establish enterprise-grade AI governance in 120 days with this proven methodology.
Form board-level or board-supervised AI governance committee with defined charter, membership, and decision authority.
Inventory all AI systems, classify by risk level, identify compliance gaps, and document mitigation strategies.
Create comprehensive AI policies covering ethics, security, compliance, data governance, and incident response.
Deploy technical controls, establish monitoring dashboards, create reporting templates, and schedule regular reviews.
Healthcare boards face unique challenges in AI governance. These challenges stem from the need to ensure patient safety and comply with HIPAA regulations.
All AI systems that access Protected Health Information (PHI) must receive board approval. Key considerations include:
Additionally, clinical AI systems, such as:
must follow FDA regulatory pathways. This includes obtaining either 510(k) clearance or De Novo classification. They also require clinical validation studies to prove safety and effectiveness.
Before engaging with AI vendors, it is essential to establish HIPAA Business Associate Agreements (BAAs). Boards should conduct quarterly reviews of HIPAA compliance audits that focus on AI systems. These audits must cover:
Healthcare AI systems must keep detailed audit trails. These trails should indicate which patient data was accessed, by which AI system, for what purpose, and with what outcome.
Financial services boards must ensure that AI systems follow fair lending laws. This includes the Equal Credit Opportunity Act and the Fair Housing Act. They also need to comply with anti-discrimination regulations and meet SOC 2 security requirements.
Credit decisioning AI must offer explainability to comply with the adverse action notice requirements under the ECOA. Furthermore, model risk management frameworks, particularly SR 11-7 for banks, necessitate board oversight of the following:
SOC 2 Type II audits must test AI security controls. This includes:
Financial AI systems require annual validation by independent third parties. The results must be reported to the board.
Furthermore, boards must approve all AI systems that impact fair lending. They should also review quarterly testing results for disparate impact.
Government boards that manage AI systems using federal data must ensure they have FedRAMP-aligned consulting expertise before deployment. This is essential for compliance with federal standards.
AI systems need to be deployed in FedRAMP-aligned cloud environments, such as Azure Government and AWS GovCloud. Boards should:
Government AI systems must meet strict transparency requirements and face public scrutiny. This demands strong explainability and bias testing.
Based on enterprise consulting experience since 1997, these are the most common AI governance failures I observe:
Many boards lack in-house AI governance expertise and benefit from external consultants who bring:
EPC Group has established AI governance frameworks for Fortune 500 companies in healthcare, financial services, and government sectors. Our method integrates:
Effective AI governance goes beyond compliance; it fosters responsible AI innovation. Organizations with strong AI governance frameworks can:
Boards that create clear AI governance frameworks in 2026 will help their organizations gain a lasting competitive edge through AI. Delaying AI governance can lead to:
The framework above offers a clear roadmap for board-level AI oversight. It balances innovation with risk management, compliance with agility, and stakeholder trust with competitive positioning.
Implementing this framework requires:
Without these, organizations face unacceptable risks in an AI-defined future.
Boards have fiduciary duty to oversee AI-related risks, ensure regulatory compliance, and establish governance frameworks. This includes approving AI strategies, reviewing risk assessments, ensuring HIPAA/GDPR/SOC 2/FedRAMP compliance, and establishing ethical AI principles. Directors can face personal liability for failure to exercise reasonable oversight (Caremark duty). The EU AI Act and emerging U.S. regulations are increasing board accountability for high-risk AI systems. Boards must document AI oversight activities, maintain expertise (through board members or advisors), and ensure management implements approved governance frameworks.
Boards should review comprehensive AI governance reports quarterly at minimum. High-risk AI systems or significant incidents require immediate board notification. Recommended frequency: Quarterly AI risk dashboards and compliance status reports, semi-annual ethics reviews and third-party audit summaries, annual AI investment and ROI reviews, and immediate escalation for critical incidents, regulatory violations, or high-risk AI deployments. Between formal meetings, boards should receive monthly executive summaries. Organizations in heavily regulated industries (healthcare, finance, government) may require more frequent reporting.
Boards need at least one member with AI/technology expertise, either through direct board membership or advisory board structure. Required expertise includes: Understanding of AI capabilities, limitations, and risks; familiarity with relevant regulations (HIPAA, GDPR, SOC 2, FedRAMP); knowledge of AI ethics and bias issues; experience with technology governance and risk management; ability to evaluate AI vendor contracts and build vs. buy decisions. Organizations can supplement board expertise through: Technology advisory boards, external AI consultants for board education, management presentations with Q&A sessions, and board training programs on AI governance. Directors should undergo annual AI governance training to maintain oversight competency.
HIPAA compliance for AI requires: Comprehensive Business Associate Agreements (BAAs) with all AI vendors accessing PHI; encryption of PHI used in AI training, testing, and production; access controls and audit trails for all PHI access by AI systems; minimum necessary standard applied to AI data access; risk assessments specifically addressing AI-related PHI risks; and incident response plans covering AI-related breaches. AI systems must not use PHI for training unless properly de-identified per HIPAA Safe Harbor or Expert Determination standards. Boards should approve all AI systems accessing PHI, review quarterly HIPAA compliance audits, and ensure appropriate BAAs are executed before AI deployment. Third-party penetration testing and annual HIPAA audits focused on AI systems are recommended.
SOC 2 and FedRAMP both require strong security controls but differ significantly: SOC 2 focuses on five Trust Service Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) with flexible implementation based on customer requirements. It's required for commercial SaaS vendors and private sector enterprises. FedRAMP requires NIST 800-53 control implementation (325+ controls for Moderate impact level), continuous monitoring (ConMon), and formal Authorization to Operate (ATO) from government agencies. It's mandatory for AI systems processing federal government data. For AI governance, SOC 2 Type II audits occur annually, while FedRAMP requires continuous monitoring and monthly ConMon deliverables. FedRAMP-aligned consulting expertise work takes 12-18 months and costs $2-5M+, while SOC 2 certification takes 6-9 months at $100-300K. Organizations serving both commercial and government customers often pursue SOC 2 first, then FedRAMP.
Board evaluation criteria for build vs. buy AI decisions include: Strategic alignment (core competency vs. commodity capability), total cost of ownership (development, maintenance, scaling costs), time to value (custom development timelines vs. vendor implementation), compliance requirements (HIPAA, GDPR, SOC 2, FedRAMP certification complexity), risk profile (data security, vendor dependence, IP ownership), scalability and flexibility, and vendor viability and lock-in risk. Generally, boards should approve "buy" decisions (e.g., Microsoft Copilot, Azure OpenAI Service) for general-purpose AI capabilities with strong compliance certifications. "Build" decisions are justified for: highly specialized AI requiring proprietary algorithms, competitive differentiation through AI, strict data residency/sovereignty requirements, or unacceptable vendor lock-in risk. Hybrid approaches (Azure OpenAI Service with custom models) often provide optimal balance. Boards should require ROI analysis, risk assessment, and compliance review for all AI investments exceeding defined thresholds (typically $500K+).
Board-approved AI incident response plans must address: Incident classification (severity levels and escalation criteria); immediate board notification for critical incidents (data breaches, regulatory violations, significant bias events, safety-critical AI failures); incident response team composition and authority; containment procedures (AI system shutdown protocols, data isolation); investigation requirements (root cause analysis, third-party forensics); remediation timelines and accountability; regulatory notification obligations (HIPAA breach notification, GDPR supervisory authority reporting); stakeholder communication (customers, employees, public); and post-incident review and governance improvement. Boards should define specific scenarios requiring immediate notification (e.g., unauthorized PHI access by AI, material GDPR violation, FedRAMP compliance deviation, safety-critical AI failure). Annual tabletop exercises testing AI incident response are recommended. All incidents should be tracked in board reports with lessons learned and corrective actions.
Board oversight of AI bias requires: Documented AI ethics principles and anti-discrimination policies; bias testing requirements for all AI systems (pre-deployment and ongoing); diverse AI development teams to identify potential bias sources; regular fairness audits analyzing AI outcomes by protected characteristics; explainability requirements allowing bias detection; human oversight for high-impact AI decisions; and remediation protocols when bias is detected. Boards should review bias audit results semi-annually, require diverse dataset representation, approve AI systems with disparate impact potential, and establish accountability for bias-related violations. Healthcare AI systems must undergo clinical validation for bias across demographic groups. Financial services AI (credit, lending, insurance) requires fair lending compliance. Government AI faces strict equal protection and due process requirements. Third-party bias audits by independent experts are recommended for high-risk AI systems. Boards should receive training on algorithmic bias and discrimination risks.
Boards should review and formally approve: AI governance framework and policy documents; AI ethics principles and responsible AI standards; AI risk assessment methodology and risk appetite statements; high-risk AI system approvals (case-by-case review); AI vendor contracts exceeding defined thresholds; AI investment and budget allocation; compliance frameworks (HIPAA, GDPR, SOC 2, FedRAMP); incident response and disaster recovery plans; data governance policies for AI systems; and annual AI governance effectiveness assessments. Documentation should include: executive summaries for board consumption, detailed appendices for deeper review, version control and approval history, and responsibility matrices (RACI charts). Boards should establish clear approval thresholds (e.g., all AI systems accessing PHI, AI investments over $1M, customer-facing AI systems, AI vendors with data access). All approved documents should be centrally maintained and accessible for audit purposes.
Board oversight of AI vendor contracts requires approval of: Data protection and privacy terms (DPA/BAA for HIPAA/GDPR); data ownership and usage rights (training data, model outputs); security and compliance certifications (SOC 2, FedRAMP, ISO 27001); liability and indemnification (AI errors, data breaches, IP infringement); SLA terms (uptime, performance, support); termination and data portability rights; audit rights and compliance reporting; pricing and cost escalation protections; and IP ownership (custom models, fine-tuning). For Microsoft contracts specifically, boards should review: Azure OpenAI Service terms (data isolation, model deployment), Microsoft 365 Copilot licensing and data governance, Microsoft AI services BAA for HIPAA compliance, and Azure Government/FedRAMP options for regulated data. Critical vendor contract terms requiring board approval include: data residency commitments, sub-processor disclosure and approval rights, unlimited liability for data breaches, and source code escrow for mission-critical AI systems. Legal counsel with AI contracting expertise should review all major AI vendor agreements before board approval.
EPC Group provides board-level AI governance consulting for Fortune 500 organizations. Our frameworks ensure HIPAA, GDPR, SOC 2, and FedRAMP compliance while enabling responsible AI innovation.
Founder & Chief AI Architect, EPC Group | Microsoft Press Author (4 books) | Enterprise Consulting Since 1997
Errin O'Connor is the Founder & Chief AI Architect. He specializes in enterprise AI governance for Fortune 500 companies. With experience in the Microsoft ecosystem since 1997, Errin has a deep understanding of the industry.
He is also the author of four bestsellers published by Microsoft Press.
He has implemented AI governance frameworks in various sectors, including:
His work ensures compliance with important regulations such as HIPAA, GDPR, SOC 2, and FedRAMP.
Learn more about ErrinvCAIO (Virtual Chief AI Officer) services have become the leading choice for organizations launching AI programs in 2026. The typical three-tier pricing in the market is as follows:
The cost-effectiveness compared to a full-time CAIO, which ranges from $400K to $800K fully loaded, is significant for the first 6-18 months.
The EU AI Act will take effect in August 2026. This law applies to both high-risk and general-purpose AI systems. Enterprises must comply if they:
These organizations will need to make significant efforts to meet compliance requirements.
See related EPC Group services at /services or schedule a discovery call at /contact.
AI assistant — not human