5 minBusiness
S&P 500 AI Risk Disclosures Jump to 83% as Boards Lag on Oversight
The share of S&P 500 companies flagging AI as a risk rose from 12% to 83% between 2023 and 2025, but fewer than 3% of directors have AI expertise and just 23% of executives describe their boards as highly fluent in the technology, leaving a widening gap between what boards must oversee and what they understand.
The share of S&P 500 companies that disclose artificial intelligence as a risk climbed from 12% to 83% between 2023 and 2025, yet fewer than 3% of corporate directors hold AI expertise, according to company filings. The disparity has opened a gap between what boards are now required to oversee and what most of their members understand, a gap that governance specialists describe as untenable as AI spreads through nearly every function of a modern business.
Executive confidence in board fluency is thin. In the same research, only 23% of executives said their board was highly fluent in AI, and a quarter said it had low fluency or none at all. The figures suggest that even as companies formally acknowledge AI as a material risk in their public disclosures, the oversight structures meant to manage that risk have not kept pace.
The obvious remedy, recruiting directors with technical AI credentials, addresses only part of the problem. AI is not confined to a single department. It runs through hiring, pricing, customer service, credit decisions, and operations, which means there is no single AI agenda item for one designated expert to own. Every director will vote on matters shaped by AI, whether or not they recognize it, so oversight has to be distributed across the full board rather than concentrated in a handful of expert seats.
Expertise and oversight are also distinct. Expertise describes what a director knows about AI; oversight describes what a director does about it. Someone can understand precisely how a large language model works without ever asking who inside the company is accountable for it, or what an AI agent is permitted to spend. Boards therefore face two separate questions: whether the board collectively knows enough, and whether each individual director is competent at oversight. Answering the first does not answer the second, and the second is largely neglected.
Research into how directors oversee AI identifies several foundational areas where a board's attention matters most. Governance oversight requires knowing which individual is accountable for each AI matter and confirming that accountability is enforced. Data inquiry means understanding what data the company's AI uses, where it goes, and on what legal basis, backed by evidence rather than a vendor's assurance. Explanation and disclosure require that the company can explain an AI decision to the person it was made about, and that public claims about AI match actual practice.
Fairness and affected parties involve knowing which groups a system could disadvantage, when it was last tested, and whether problems were fixed rather than merely recorded. Risk and irreversibility call for understanding what the company's AI can do that cannot be undone, and how the board would learn of a failure. Human judgment and workforce oversight means ensuring a person can overrule a system in practice, not just on paper, and that workers whose jobs AI changes are part of the plan. Autonomy and agent authority require knowing what AI agents may do, spend, and commit on their own, and that each has a limit and a way to stop it.
Building competent oversight across those areas rests on three principles. The first is to measure what directors do rather than what they know. The strongest evidence of ability is regular performance to a high standard, so boards should ask whether directors have actually performed basic oversight tasks recently and how often. In PwC's 2025 survey of public company directors, two-thirds said their board should spend more time on AI, but fewer than half said their board had an approach to overseeing it. Almost every director would agree the board should know which AI systems the company uses; far fewer have asked to see the list, and fewer still request it at every AI risk review.
The second principle is to assess the floor rather than the average. A director's level is set by their weakest competency, not their average, a logic boards already accept for financial controls. Under U.S. auditing standards, a single material weakness means internal control over financial reporting cannot be considered effective, however strong everything else may be. AI oversight deserves the same standard, because directors gravitate to the questions they are comfortable asking. A former chief financial officer interrogates the data; a technologist interrogates the model. That depth is valuable, but it becomes a liability when it supplies a reason to skip other areas, leaving no one to ask the questions that fall outside any director's comfort zone.
4
