On 14 October 2026, Diligent Institute released a survey of 230 board members, executive directors and board secretaries from not-for-profit and public sector organisations. More than half (52%) said their board does not use AI to support risk oversight or strategic decisions. Exactly one respondent described AI as fully embedded in board oversight. And yet 30% named technology and AI modernisation as their first investment priority.
Listed companies are hardly further along. In Diligent's What Directors Think 2026 survey of US public company directors, 8% said their board has strong AI expertise. Only 3% had fully integrated AI into risk oversight and strategic decision-making.
A paradox worth sitting with
Most of those respondents were North American. It would be comfortable to read all this as an American problem. It is not.
On the general public, at least, Australians start from further back. In the University of Melbourne and KPMG global study of trust in AI, 24% of Australians reported any AI training or education, and more than 60% said their knowledge of AI was low. The US figures from the same study: 28% with some training, 57% with limited knowledge. A narrow gap, but in the wrong direction. Australia also ranked lowest of all countries surveyed on the belief that AI's benefits outweigh its risks (30%), and lowest on interest in learning more about it (49%).
These are public figures, not boardroom ones (I have found no Australian equivalent of that 8%). But directors come from the same public. If North American boards are this far behind, where does that leave ours?
The question should trouble us (and it is an opportunity for a young network like Digital Directors ANZ). It also brings us back to one page published by the Australian Signals Directorate.
ASD Essentials: AI accountability sits with the board
The Australian Signals Directorate (ASD), which is the federal government’s intelligence and cyber security agency, and home to the Australian Cyber Security Centre, has released ASD Essentials, a new series of security guidance with chapters for enterprise IT, cloud and operational technology. Alongside those chapters sits a short overview paper, AI considerations within the Essentials, which explains how the whole series applies to AI, whether an organisation consumes, develops or deploys it. Most of that paper speaks to security teams. One page, headed “Executive AI accountability”, speaks to the board.
That page rests on a principle in ASD’s Information Security Manual: executive artificial intelligence accountability. Under it, “the board of directors or executive committee is accountable for ensuring AI is secure, controllable, human-supervised and used in an ethical and accountable manner"
Not the CIO. Not the vendor. Not the well-meaning manager who plugged a chatbot into the shared drive on a Friday afternoon. The board.
It is not new rhetoric. ASD added a principle on executive AI accountability to its Information Security Manual in March 2026. It now appears as GOV-08 in the current principles, right beside GOV-01, executive cyber security accountability.
The placement says a great deal. ASD now treats AI as it has treated cyber security for years: a matter for the people who sign off on strategy, not for the people who keep the servers running.
What ASD asks for
The paper is short and practical. It asks organisations to:
- hold executives accountable for the use, governance and risk management of AI, backed by processes for approval, risk assessment, oversight and ongoing review of AI use cases;
- treat AI systems as assets to identify and govern (models, training data, prompts and outputs, connectors, and the accounts AI agents use to act);
- get executive or delegate approval before switching on AI functions inside cloud software;
- check AI outputs before they inform significant decisions, because accountability for outcomes stays with people.
Nothing exotic here. Ordinary governance, applied to a technology most boards have not yet looked at properly.
Guidance, not law (which matters less than it seems).
ASD is clear: the paper is general guidance, not legal advice. For most private companies and not-for-profits, nobody will audit against it tomorrow morning.
But guidance of this kind becomes the yardstick. Directors already owe a duty of care and diligence under section 180 of the Corporations Act. When an AI system leaks client data, or produces a decision nobody can explain, the question put to the board will be a simple one. What did you know, and what did you put in place? I would not want to be the director explaining that a national framework existed, and the board never discussed it.
The courts may take their time. Insurers will not. In cyber, they already price risk against ASD-style controls. Some Australian policies now exclude losses from serious vulnerabilities left unpatched for weeks, and underwriters scan from the outside to check that the patching a business declared is the patching it actually does. Nothing comparable exists yet for AI (I have found no Australian policy wording that excludes a loss because the board ignored ASD's AI guidance). Expect it, though. First the questionnaire: do you keep an AI inventory, and who approves new use cases? Then the exclusion. A board that cannot answer will pay more, or discover it is uncovered at the worst possible moment.
The honest problem and 3 questions
Some of us at Tricore Tech sit, or have sat, on boards. We know how an agenda fills up: finance, risk, people, the roof that leaks again. AI rarely gets twenty minutes. It now needs them.
The harder issue is skills. Most SME, not-for-profit and local government boards we know have no one at the table who can read an AI inventory, test a vendor's claims about where prompts are stored, or ask whether the agent connected to the finance system has its own identity (and its own limits). That is not negligence. It is a gap. ASD has turned that gap into a governance issue, and insurers are likely to put a price on it.
Three questions for your next board meeting
- Do we know every AI system in use here, including the ones nobody approved?
- Who approved each one, and on what risk assessment?
- When an AI output feeds a significant decision, who checks it before anyone acts on it?
Vague answers? Then you have found your starting point. You are also in good company.
Where Tricore Tech fits
We built AI Director on Demand for this. It gives a board or executive team access to an experienced AI governance director on a retainer, without the cost of a full-time hire.
The work follows what ASD now asks for: finding the AI already in use, setting up approval and risk assessment for new use cases, placing human oversight where it matters, and reporting to the board in plain language.
Our READY method opens with a Reality Check for the same reason ASD opens with asset identification. You cannot govern what you have not found.
ASD has said where accountability for AI sits. With the board. Whether the board knows what it is holding is another matter.
Contact Us