Can Boards Govern AI Better Than Culture?
Recent frontier AI commentary rightly argues that adoption pace matters. Organisations that move too slowly may forfeit opportunities as AI capabilities rapidly become commonplace.
But AI will not be introduced into a governance vacuum.
It will operate through the organisation’s structures, accountabilities, incentives, risk practices, and decision processes. Its effectiveness will depend on how people exercise authority, manage competing priorities, challenge assumptions, and respond when outcomes depart from expectations.
In other words, AI will operate through the cultural norms already in place.
Before Boards ask whether their organisations are ready to govern frontier AI, they should consider how effectively they govern culture. The answer may be revealing.
Culture Is the Existing Test
Culture is how the formal organisational system is interpreted and enacted through the day-to-day choices and actions of people.
It influences how strategy is executed, risk is taken, controls are applied, concerns are escalated, and competing priorities are resolved. Under pressure, the gap between how these arrangements are intended to operate and how they operate in practice can widen.
A Chief Human Resources Officer may lead the organisation’s culture strategy and hold accountability for several important levers. But no function controls all the organisational factors that shape culture. Strategy, risk appetite, accountability, delegations, capability, capacity, technology, and the control environment are distributed across the enterprise.
Culture is shaped by how these elements interact and, in turn, shapes how each operates in practice.
The AICD’s Governing Culture in a Complex World recognises that culture requires close oversight coordination across Board committees and organisational functions.
The difficulty is not recognising these responsibilities. It is operationalising them as integrated oversight.
Different functions and committees need different lenses. People and Culture may consider employee experience, leadership, and capability. Risk may consider risk-taking, conduct, and control effectiveness. Audit may identify recurring weaknesses in how arrangements operate. Remuneration, technology, and business performance provide further perspectives.
The answer is not to collapse these responsibilities into a single owner or measure. It is to preserve the value of each lens while creating an integration point at which the Board can understand how they come together.
Without that integration, the Board may receive several valid but incomplete views of culture without being able to answer the central question: how is culture influencing organisational outcomes?
From Culture Ratings to Organisational Outcomes
Prudential regulation illustrates why this distinction matters. CPS 220 requires the Board of an APRA-regulated entity to form a view of whether the entity's culture supports consistent operation within risk appetite. A survey, maturity rating, or periodic assessment may contribute to that view. It cannot, on its own, establish it.
The relevant test is whether culture information explains how organisational conditions affect risk-taking, control effectiveness, and residual risk in reality.
More recent operational risk and resilience expectations illustrate a wider governance shift: from confirming that arrangements exist to understanding end-to-end systems, testing how they operate in practice, and assessing whether they reliably produce required outcomes.
Culture is integral to that shift because it shapes how the formal system is enacted. Accountability, capability, capacity, challenge, escalation, and tolerance of workarounds all affect whether documented expectations produce their intended outcomes.
Effective culture governance must therefore integrate evidence around outcomes, rather than simply aggregate culture-related reporting. It should help the Board understand whether culture is supporting strategy execution, compliance with obligations, operation within risk appetite, and intended stakeholder outcomes.
This is also the capability AI governance will test.
AI will cut across strategy, workforce, technology, data, risk, operations, and assurance. Each perspective will remain necessary. But without an integration point, the Board may understand the business case, technical controls, workforce implications, and individual use cases or incidents without understanding how AI is changing, or needs to change, the organisational system as a whole.
AI Will Amplify the Blind Spots
Formal AI governance will tend to focus on approved use cases, intended benefits, technical controls, and incident response. These tell Boards what the organisation plans to do with AI and what it hopes to achieve.
They say less about what is developing beyond that line of sight.
Employees encouraged to experiment may extend approved tools beyond their intended uses, turn to unsanctioned models, upload organisational information to external services, or rely on AI-generated analysis without adequate disclosure.
These practices may not reflect deliberate misconduct. They can arise from curiosity, productivity pressure, lagging policies, inadequate sanctioned tools, or an emerging norm that experimentation matters more than understanding the potential for unintended consequences.
Shadow AI is therefore not only an operational, technology, or data risk. It shows how formal rules are being interpreted and enacted, which is precisely what effective culture oversight should help Boards understand.
The same applies to human oversight.
A person nominally “in the loop” is not an effective control if they lack the capability, authority, or organisational support to question a confident model, stop its use, or escalate uncertainty.
The resilience of human oversight is a function of organisational culture.
The Readiness Question
AI will require clear risk appetite settings and tolerances, technical knowledge, controls, and assurance. Their effectiveness will also depend on governance capabilities that should already be evident in how the organisation integrates oversight of its culture.
Boards should ask:
- Where do our different culture-related perspectives come together to provide an integrated view?
- Does that view explain how culture affects decisions, control effectiveness, and organisational outcomes, or does it principally assign ratings, benchmark engagement, and describe activity?
- Can it reveal unintended AI use and determine whether people are supported to challenge, override, or stop AI-enabled decisions?
AI will accelerate change and make some organisational activity harder to see and interpret. It will amplify the consequences of fragmented oversight.
An organisation is unlikely to govern AI more effectively than it governs the culture through which AI will be used.
The most revealing test of AI readiness may therefore already be in the Board papers: what does existing culture reporting allow the Board to see, decide, and change?