AI is growing in the wild. Is your board in control?

AI is transforming business rapidly, but without governance, risks grow. Boards must act now to harness its potential safely.

In brief

• AI adoption is accelerating without proper governance, exposing companies to risks like bias and compliance failures. Training is essential for safe use.
• Boards must implement accountability, cross-departmental governance, and regular audits to ensure responsible AI deployment and mitigate risks.
• Early adopters of AI are gaining significant economic advantages; companies must act decisively to avoid falling behind in the competitive landscape.

AI adoption isn’t waiting for governance. It’s already here – embedded in our phones, baked into everyday software and integrated into corporate workflows, often without oversight. As competition drives down costs, board directors and business leaders face a big question: is waiting the right strategy, or is hesitation the real risk?

From enterprise control to everywhere, instantly

Traditional enterprise technologies, like CRM and ERP systems, required significant upfront capital investment, lengthy procurement processes and dedicated implementation teams. This created natural guardrails: IT departments controlled purchases, finance teams scrutinised budgets and organisations had time to assess risks before deployment.

AI is different. It requires little upfront investment, and employees can access AI-powered tools on personal or corporate devices without IT approval. Voicemail transcriptions, grammar checkers, note-taking assistants and coding copilots are already in daily use.

And yet, most enterprises are yet to establish an AI registry, making it impossible to track or report how many employees have installed AI apps on corporate devices.

This is a serious governance gap. AI is democratised and accessible to anyone with a device. But access doesn’t equal readiness.

Without proper training and governance, AI adoption can expose companies to new risks. That’s why we’ve seen lawyers submit hallucinated case citations, AI recruitment tools exhibit gender bias, AI credit scoring reflect racial disparities and chatbots offer harmful health advice.

The real risk isn’t inaction – it’s ungoverned action.

From wild to wise

Many companies focus too much on the technology and not enough on the people using it. Microsoft's Work Trend Index 2024 found 84% of Australian workers are using generative AI in the workplace. The EY organisation has invested more than US$1.4 billion in AI over eight years. Here’s what we’ve learnt from one of the world’s largest AI rollouts: The democratising event isn’t the license – it’s the training. Without guidance, AI amplifies risks like bias, security vulnerabilities and compliance failures.

Just one in 10 Australian workers says they are being offered AI-specific training. That’s why we built the EY + Microsoft AI Skills Passport – to provide free AI knowledge and skills for anyone aged 16 and older so that businesses and individuals are equipped for the AI-powered world.

AI checklist for boards

As AI becomes integral to business operations, boards must act decisively for responsible and effective deployment. Here are six critical actions to consider:

1. Invest in change management and workforce upskilling – Training employees helps safe adoption and maximises AI’s benefits.
2. Assign accountability for AI strategy, risk and compliance – Designate a leader to determine your organisation’s risk appetite, profile, exposure and controls.
3. Implement cross-departmental AI governance – AI is not just an IT issue; leaders from across the organisation must collaborate to guide its responsible use.
4. Regularly audit AI systems – Continuous oversight helps to ensure AI applications meet ethical, legal and operational standards.
5. Update your cybersecurity and data protection – Reassess and enhance your cybersecurity and data protection strategies to reflect your AI posture.
6. Establish an AI model registry – Tracking AI models from development to deployment strengthens accountability and control.

The views expressed in this article are the views of the author, not Ernst & Young. This article provides general information, does not constitute advice and should not be relied on as such. Professional advice should be sought prior to any action being taken in reliance on any of the information. Liability limited by a scheme approved under Professional Standards Legislation.