Nobody knows how AI will reshape the firm. Boards still have to govern.

The most common mistake with AI is to begin with implementation: Where can we deploy AI? Who owns it? What should the adoption target be? How many people have been trained? How many use cases are in the pipeline? These are second-order questions.

The first-order questions are whether AI changes what customers value, what they will pay for, who the company competes with and where advantage comes from. AI also democratizes many capabilities, whether research, content production, or data analysis, which raises another question: what happens when customers can do for themselves some of what they currently pay you to do?

If producing an answer, document or recommendation becomes cheap, value moves elsewhere: to assurance, accountability, judgment, proprietary access, integration or the willingness to stand behind an outcome. A customer might pay less for the production of an analysis while still paying someone to determine what it means in their circumstances, accept responsibility for the recommendation and help deliver the result.

Creating value does not guarantee a defensible way to capture it. If every competitor can buy the same capability from the same few providers, its benefits appear in customers' expectations before they appear in margin. What matters is what does not diffuse easily: proprietary data, trusted relationships, distribution, domain expertise and the ability to integrate technology into a complex operation.

The economics need to be real too. The most advanced model is unnecessary for much of the work. In some cases, AI is unnecessary too. The full cost includes models, computing power, integration, data preparation, evaluation, human review, exception handling, controls and vendor margin. Agentic systems can perform more work, but they can also consume more resources and generate more activity requiring supervision.

I would push management to show the cost per completed outcome, not merely the cost per token – and to explain how the business case changes if usage, model pricing or supplier terms change.

Most AI experiments start with individual tasks, such as whether AI can help someone draft a proposal, review a contract, write code or answer a customer query. This is a sensible place to learn, but a poor place to stop. 

In a recent client conversation, I heard how coding output had been accelerated but work was now accumulating in testing and quality assurance. While the developer may now be faster, the delivery system was not. This illustrates a general principle, that local acceleration just moves the constraint. 

Faster software development increases pressure on testing, architecture, security and release management. More content creates a brand and compliance queue. More analysis creates an executive-attention bottleneck. Automated customer contact moves exceptions into an already constrained service operation. When the bottleneck is assurance, pressure builds until people bypass it – and a productivity gain becomes a source of risk.  

Boards must consider these new bottlenecks, and the role of human judgment, as part of their workforce plans. A model's ability to perform a task is not evidence that the organization can safely remove the role. I would want to know what happens to demand, assurance, exception handling, management capacity and the development of future expertise before productivity assumptions become headcount commitments. 

Likewise, local task productivity does not equate to system performance, and system performance does not equate to customer value. All the elements of the operating model (spanning process, organization, information, infrastructure, suppliers, incentives and controls) have to evolve together. Otherwise, successful experiments create a shadow operating model, where work, decisions and accountabilities start moving through arrangements that the formal organization has not designed or governed. 

The longer the gap persists, the harder it becomes to see where value, judgment and risk actually reside.

Capital allocation depends on an assumption about time: build the process, purchase the system, train the workforce and recover the investment over an expected period. With AI now impacting, and potentially shortening, the useful life of a process design, software platform, or skill, that arithmetic changes. Looking at this through the Three Horizons Framework, the horizons can collapse: speculative Horizon 3 work can become a Horizon 1 customer expectation surprisingly quickly.   

In this context, real-options thinking – defined here as a decision-making approach that values flexibility and strategic choices over a rigid plan – offers a useful response to uncertainty. Staged investment, modular architecture and explicit decision points can buy knowledge and preserve the right, but not the obligation, to make a larger commitment later.  

However, optionality should not become an intellectual justification for permanent piloting. A real option must eventually be exercised: the board should know what evidence will cause the company to scale, stop or make its next commitment. 

Another useful framework here is Requisite Pace, recognizing that AI changes not only the cost and quality of work, but its tempo. For a strategically important domain, I would ask management to understand five clocks: 

• Signal half-life: How quickly do the relevant information and assumptions become stale? 

• Decision latency: How long does it take to reach an authorized decision? 

• Change cycle: How long before that decision changes a real product, service or operation? 

• Assurance and learning cycle: How long before the company knows whether the change worked and remained within risk appetite? 

• Recovery cycle: If it fails, how quickly can the company contain, reverse or recover from it? 

AI can accelerate one clock whilst leaving the others untouched. Good governance is not slow governance. It should operate at a tempo appropriate to the consequences of the decision. Likewise, the board should understand the material clock collisions: where opportunity is moving faster than capital allocation, delivery faster than assurance, technology faster than skill formation, or failure faster than recovery. 

AI is not simply another entry on the risk register. It changes existing strategic, operational, people, legal and third-party risks. As it moves closer to consequential decisions, errors can propagate at greater speed and scale. Multiple activities can depend on the same model, data or provider. Systems can change after approval, while their limitations and lines of accountability remain difficult to identify. 

Risk appetite should be expressed in terms of purpose, consequence, autonomy and reversibility – not "AI" in general. 

A company can have a high appetite for low-consequence, reversible employee assistance; a moderate appetite for recommendations affecting operations; and a low appetite for opaque autonomous decisions affecting safety, employment, credit or customer rights. 

The objective is not uniformly more control, but instead to create areas in which the organization can move quickly because the boundaries and potential consequences are understood. 

In sectors and use cases where precision and consistency are key, model risk is another potentially under-recognized part of the picture. I recently heard of two accounting managers using the same data and prompt at different times and receiving different answers. A technical specialist could identify several possible causes: sampling behavior, model version, configuration, context or something in the surrounding system. The governance problem was that the users could not determine which. In a consequential financial process, unexplained variability is a control issue. 

This does not mean AI has no place in financial work. It means controls designed for deterministic software, where the same input always gives the same output, cannot simply be carried across to probabilistic systems like AI models, where identical inputs can produce different results. 

The PRA's model-risk principles apply formally to certain financial institutions, but can offer a useful framework more widely: identify material models, classify them by consequence, establish ownership, validate independently, control their use and monitor them over time, including externally supplied models. 

Ultimately, companies can outsource technology, but not the consequences of using it.