Governance turns values into decision rights
An organization’s AI principles matter less than who can act when evidence conflicts with a launch schedule. Effective governance assigns authority, information, resources, and accountability. It identifies which decisions belong to engineers, risk officers, executives, and the board; how concerns escalate; and who can restrict a system without retaliation.
NIST’s AI Risk Management Framework says executive leadership should take responsibility for AI development and deployment risks, accountability structures should be clear, and contingency processes should address third-party failures (NIST AI RMF Core). The framework is voluntary. A company’s claim that it “uses NIST” is not evidence that a particular control works.
Corporate governance is one lever among law, procurement, labor rights, professional standards, and technical practice. It can improve internal decisions, but it cannot represent everyone affected by a system or replace public enforcement.
Begin with an AI-system inventory
A board cannot govern what management has not identified. The organization should inventory internally developed and purchased models, versions, owners, purposes, data, tools, permissions, users, vendors, and affected populations. High-impact applications need documented risk owners and approval history.
The inventory should distinguish training from deployment and the model from the surrounding system. A general model used only for drafting internal text presents different exposure from the same model connected to financial transfers or medical records. Changes to tools, prompts, fine-tuning, retrieval data, or vendor versions can alter risk without a new model name.
Boards should receive a portfolio view: material incidents, unresolved high-severity findings, upcoming deployments, dependence on single vendors, audit coverage, and readiness to roll back. They do not need to micromanage prompts, but they need enough technical expertise to challenge summaries and understand uncertainty.
A committee needs authority, not just a title
A board risk or technology committee can focus attention, but creating one does not prove better outcomes. Its charter should define access to independent expertise, direct communication with technical risk staff, authority to commission tests, and escalation to the full board. Members need time and training, and conflicts should be disclosed.
Management-level safety staff need independence from product approval. Practical measures include protected reporting lines, documented dissent, a second-signature requirement for threshold decisions, and authority to impose temporary containment. The organization should publish enough about decision structure for employees, customers, and investors to know where responsibility lies.
Compensation deserves review. Rewarding only launch speed, usage, or revenue can undermine stated risk tolerance. Balanced incentives might include reliability, security, incident remediation, audit closure, and customer outcomes. Safety metrics can themselves be gamed, so the board should examine evidence rather than convert governance into one score.
Operational questions boards should ask
Good oversight reaches incident readiness:
- Can the company identify every customer and system affected by a model update?
- Who can revoke model, tool, or account privileges immediately?
- Are rollback procedures technically tested and compatible with current data?
- Can essential functions continue through a trained human fallback?
- Do logs preserve enough evidence for investigation without creating unnecessary surveillance?
- Are third-party evaluators testing the deployed configuration?
- How are serious failures reported to regulators, customers, workers, and affected people?
- Can employees raise a concern outside their management chain?
NIST explicitly includes safe decommissioning, monitoring, incident information sharing, and third-party contingencies in its governance outcomes. These operational questions are therefore not separate from board governance; they reveal whether policy exists in reality.
What shareholders can do
Eligible shareholders in U.S. public companies can submit certain proposals for inclusion in proxy materials under Securities Exchange Act Rule 14a-8. The SEC maintains the current process and guidance, which changed again in August 2026 (SEC shareholder-proposal page). Eligibility, deadlines, exclusions, and company bylaws matter; obtaining qualified legal or proxy-adviser guidance is prudent.
A useful proposal asks for material, decision-relevant disclosure rather than declaring a technical conclusion shareholders cannot verify. Topics may include board oversight, inventory and risk processes, incident reporting, use in high-impact domains, lobbying consistency, or independent assessment. Proponents should identify what existing reporting omits and why the request is proportionate.
Most shareholder proposals are advisory, and a vote does not directly rewrite operations. A low vote can still open dialogue; a high vote can still be ignored or implemented superficially. Evidence of effectiveness should therefore track policy changes, budgets, authority, and incident performance—not proposal counts alone.
Institutional investors have more access and voting power, but their incentives vary. Pension funds, asset managers, active funds, and index providers answer to different beneficiaries and legal duties. Coordination can improve analysis while raising its own governance and antitrust questions. Individual investors should not assume that owning one share produces meaningful control.
Private companies and frontier developers
Public-market proxy mechanisms do not reach most privately held frontier developers directly. Investors may have board seats, information rights, protective provisions, or contractual leverage, but those terms are often confidential. Employees, customers, cloud partners, insurers, and regulators may have more practical influence.
Special structures—public benefit corporations, nonprofit control, purpose trusts, or safety boards—can alter formal duties. Their effectiveness depends on enforceable documents, appointment and removal powers, funding, information access, and what happened during a real conflict. Structure should be evaluated, not treated as a safety label.
Customers can request contract protections: model-version notice, relevant evaluation results, audit access, incident notification, data portability, and termination assistance. Large enterprise and government buyers may obtain controls that dispersed shareholders cannot.
Workers and professional responsibility
Employees often see failures before the board. Companies need confidential channels, anti-retaliation rules, independent investigation, and a defined emergency path. California’s SB 53 protects specified frontier-AI workers who report covered public-safety dangers or legal violations to designated entities (California Attorney General guidance). Coverage is specific; it is not a universal whistleblower law.
Worker councils, unions, professional associations, and ethics officers can negotiate training, monitoring limits, staffing, safety review, and responsibility for automated decisions. Engineers, clinicians, lawyers, educators, and auditors also operate under different professional duties. An ideologically plural approach respects concerns about safety, civil rights, jobs, innovation, national security, open research, and market concentration rather than demanding one theory of AI risk.
Disclosure should be useful and safe
Investors need comparable information about material risk, but indiscriminate disclosure can reveal security weaknesses or sensitive personal data. Public reporting can describe governance, evaluation categories, aggregate incidents, and remediation. Qualified regulators or auditors may receive more detailed confidential evidence.
Avoid vanity metrics. Number of red-team hours, safety employees, or blocked prompts has little meaning without scope and outcomes. Better reporting explains residual risk, unresolved findings, changes to frameworks, near misses, and whether safeguards altered a launch.
Limits and conflicts
Boards owe duties to the corporation under applicable law, not to humanity in the abstract. Shareholders may prioritize short-term returns or political objectives. Directors can lack technical expertise. Private contracts cannot protect noncustomers. Corporate disclosure can become reputation management.
That is why governance reform should complement enforceable law, competition, independent research, and remedies for affected people. It is strongest where a company already has the capability to prevent harm and the reform gives identified people real authority to use it.
The practical conclusion
Corporate advocacy is not “pressure from the inside” in one simple form. Shareholders can request disclosure and vote; boards can assign authority; workers can surface evidence; customers can set contract terms; and institutional investors can scrutinize incentives. Each lever has different reach and legal limits.
Success should be measured operationally: risks found before harm, privileges revoked when necessary, incidents reported, systems rolled back safely, people protected from retaliation, and lessons incorporated. A new committee or public pledge is only the beginning of that evidence.