AI governance and directors’ duties: balancing opportunities and risks

Artificial intelligence (AI) is already changing how companies operate and how directors and business owners make decisions. Directors should not  wait for AI-specific laws to act. 

The Federal Government has confirmed that it will rely on existing legal and regulatory frameworks to govern the use of AI, rather than implementing standalone legislation.^[1]  Existing duties under the Corporations Act 2001 (Cth) already require directors to understand how AI is being used, what risks it creates, and how those risks are governed, including the risks of directors using AI in the discharge of directors’ duties in the boardroom. 

The challenge is to capture the benefits of AI without losing control of legal, governance and reputational risk. As ASIC Chair Joe Longo observed in March 2026, ‘every director should embrace AI, to understand its risks and benefits with both eyes open, and to harness its potential for community and customer benefit’. 

The key question is whether directors have enough discipline, knowledge and oversight to discharge their director duties in relation to AI. 

A sensible governance baseline will vary by sector and the scale of AI adoption. But a number of practical steps are prudent for most businesses:

• consider whether AI literacy or competency should form part of the board’s skill matrix;
• consider and approve an AI governance framework that covers approved tools, uses, accountability and distinctions between low- and high-risk applications;
• ensure there is a process for management to disclose when AI has been used to prepare board papers, recommendations or analysis, including what verification occurred and whether the output was independently reviewed for accuracy and reliability;
• establish internal controls to manage the risk of unsanctioned AI use, including transparency mechanisms and guardrails for employees;
• ensure directors receive practical training to improve AI literacy and the ability to challenge, prioritise and govern the use of AI;
• test and monitor AI systems before deployment and continuously monitor performance to detect and address issues as they arise; and
• distinguish between governance of AI governance with AI. The former concerns how the company deploys AI in its operations. The latter concerns how the board itself uses AI when preparing for and making decisions. Both require policy, discipline and documented accountability.

To satisfy existing duties through AI governance, directors must:

• understand where AI is used across the business, for what purpose, and with what guardrails;
• develop enough AI literacy to challenge management and oversee risk effectively; and
• maintain independent judgment, especially when relying on AI-assisted information or analysis. 

For most directors, s180 of the Corporations Act will do most of the work in an AI governance context. The duty under s180(1) requires directors to exercise their powers and discharge their duties with the degree of care and diligence that a reasonable person would exercise if they were a director or officer of a corporation in the company’s circumstances. In the context of AI, this means directors need a working understanding of where AI is being used, what it is used for, and what risks and controls exist in relation to that use. 

This ‘irreducible requirement’ means that boards should deliberately govern any AI use through the formal adoption of policies, rather than permitting informal ‘shadow’ use to go unchecked. 

In ASIC v Bekier (Liability Judgment) [2026] FCA 196, the first Australian judgment to reflect on AI use by directors, Justice Lee endorsed this approach, observing that ‘boards should discuss and deliberately govern any AI use by formal adoption of policies, rather than just wink at informal “shadow” use’. 

Where AI alters the way in which directors receive and understand relevant information (whether through management’s use of AI in the preparation of board reports, or director use of AI tools to analyse board packs), it remains the director’s individual responsibility to ensure this is done in a manner consistent with their duty of care and diligence.

In addition to understanding where AI is interacting with core business functions (including both approved and unapproved use by staff), directors must turn their mind to material risks such as hallucinations, inaccuracy, bias, confidentiality and privacy, cyber-security, apparent confidence, and lack of transparency. Failure to demonstrate sufficient understanding and proactive management of these risks may lead to a situation where it is difficult for a director to prove they have exercised the level of care and diligence expected in the company’s circumstances.

Directors do not need to be AI experts but they need to:

• have a viable understanding of AI to ask the right questions and make informed decisions;
• assign clear accountability for AI systems;
• establish processes to assess and manage AI-risks on an ongoing basis; and
• ensure meaningful human oversight.

Directors are expected to take an active role in decision-making. AI does not reduce that responsibility. Directors must take a ‘diligent and intelligent interest’ in the information available to them and apply an ‘inquiring mind’.^[2] That principle applies with particular force where AI systems are generating or analysing the information on which decisions are based. The use of AI arguably increases the need for directors to understand the basis of the information they are receiving and to test whether AI-assisted output is reliable, accurate and complete.

This duty requires more than passive acceptance of information. Where directors use AI platforms, they must ensure the information they rely on is reliable and not affected by hidden bias that could impair judgment or influence decisions. In practice, this is likely to require a degree of algorithmic literacy to meet the standard of care and comprehension expected under s180(1). A failure to adequately apply autonomous and independent decision-making where AI has been utilised in any aspect may expose directors to greater liability risk.

The existing duties under s181 for directors to act in good faith, in the best interests of the company and for a proper purpose remain important. AI re-shapes the scope of decisions to be considered by the director including strategic and ethical judgments.

AI initiatives promise gains to critical corporate objectives in cost reduction, market competitiveness and speed. Despite the proposed improvements to efficiency, appropriate corporate governance requires directors to consider whether any proposed AI use aligns with company strategy, risk appetite and values. 

The implementation of AI is likely to be inevitable for many companies. However, directors must not approve AI use without understanding its inherent risks and considering appropriate safeguards for affected stakeholders. If they fail to do so, later scrutiny by courts and regulators may find the decision was misaligned with the company’s interests, and in breach of director duties.

Blind reliance on AI output is unlikely to fall within existing safe harbour protections. 

Although directors may delegate powers under s198D, they cannot directly delegate their function to an AI system as though it were a legal ‘person’. Section 201B of the Corporations Act also requires a director to be an individual. This provides a useful reminder that legal responsibility remains a human function and cannot be outsourced to AI. Where a delegate uses AI, directors must still consider whether reliance on that delegate is reasonable in the circumstances and whether s190 (the delegation defence) offers any protection. 

To rely on the safe harbour in s190(2), a director must have believed on reasonable grounds that the delegate would exercise the delegated power in conformity with the duties imposed on the director, and that the delegate was reliable and competent in relation to the power delegated. Where a delegate uses AI in performing a delegated task, a director seeking to rely on s190(2) would need to justify why their trust in that delegate (or an AI platform) was reasonable. This is likely to be difficult to establish given what is known about the limitations of AI, including its potential for bias and hallucination. In practice, this may make it harder for directors to avoid liability.

Similarly, the same caution applies to reliance on information provided by others, particularly where AI plays a role in disseminating, summarising or presenting the information, under s189. The defence of ‘reliance’ on information or advice provided by others becomes harder to satisfy where the AI system operates as a ‘black box’, and the underlying data and reasoning cannot be readily interrogated so as to argue that the reliance was made in good faith and after making an independent assessment of the information or advice (having regard to the director's knowledge of the corporation and the complexity of the structure and operations of the corporation) and the reasonableness of the director’s reliance on the information or advice.

To achieve protection under the business judgment rule in s180(2), a director must, among other things, have informed themselves about the subject matter of the judgment to the extent they reasonably believed appropriate, and have held a rational belief that the judgment was in the best interests of the company. A director’s belief is rational if it was based on reason or reasoning, whether or not the reasoning is convincing or reasonable in an objective sense. The business judgment rule does not excuse passive acceptance of an AI recommendation. If a director simply adopts an AI output without turning their mind to the issue, the safe harbour is unlikely to be available, as relying on AI is unlikely to be considered a ‘rational belief’ and the black box nature of these platforms makes it difficult to be properly informed. 

In the matter of Lanmar Pty Ltd (No 2) [2026] NSWSC 800^[3], two majority directors of a defence consulting firm used ChatGPT to research how to address the perceived underperformance of a minority director and shareholder. ChatGPT framed the issue as an ‘HR problem’, analysing it through an employment law lens rather than as a matter of corporate law. The output adopted an employee performance management framework, disregarding the director-shareholder arrangement governing the parties’ relationship. Justice Black found that the two directors had ‘plainly directed questions to ChatGPT, which it had answered, which wrongly approached the question as one of employment law, rather than by reference to principles of oppression in Australian corporate law’.

His Honour observed that ChatGPT ‘did not prove to be a prudent choice of adviser so far as matters of Australian corporate law were concerned’. The directors’ reliance on ChatGPT led them to adopt an analytically flawed framework, which in turn caused them to embark on a course of oppressive conduct without appreciating the legal risks, ultimately resulting in findings of oppression under s232 and breach of directors’ duties under s181 of the Corporations Act. 

This case provides a current and practical example of the reality that, while AI can be a valuable tool in assisting boards to carry out their duties, it does not replace proper professional advice or the essential human oversight role boards and individual directors play.

[1] Confirmed in the Australian Government’s National AI Plan in December 2025.

[2] Australian Securities and Investments Commission (ASIC) v Healey (2011) 196 FCR 291.

[3] In the matter of Lanmar Pty Ltd (No 2) [2026] NSWSC 800 (Justice Black).