82% of Directors Use Generative AI; 6% Have a Board Policy── When tools arrive before the rules that admit them, the reason behind an approval can no longer be reconstructed

In June 2026, a survey of 104 directors at US public companies reported that 82% had used generative AI in their board work over the previous six months, while only 6% said a formal board-level policy existed. When the people who approve use generative AI with no rules of their own, what does their approval still guarantee? A tool used without rules leaves no trace, so an approval can vouch for the verdict alone, never for the path that led to it.

01More than eight in ten boards now use AI without rules of their own

Three figures sit side by side. Eighty-two percent used it. Fifty-four percent said their company has no guidance for director use of AI. Six percent reported a formal policy specific to the board. Of all the instruments available to the people who oversee, generative AI is the least overseen.

A year ago the picture was different. In the same survey in September 2025, the usage figure was 66 percent. Sixteen points in nine months. Nothing in the survey suggests the rules moved at the same rate.

What this article ends with is not a call to write a policy. It is a call to add four fields to the approval record.

02The survey counted whether directors used AI, not the substance of that use

Unless you settle what the 82 percent counted, you will draw the wrong conclusion from it. Corporate Board Member and Diligent Institute put the questions to 104 directors at US public companies. The sample is around a hundred people, and the population is limited to listed US firms.

The breakdown by purpose is published. Roughly 30 percent used it to summarise meeting materials; 45 percent used it to prepare for meetings or to research peer companies.

Two things were not asked. Which tool was chosen. And which documents were put into it. Board papers include unpublished results, acquisition work and personnel matters. That space was left blank, and only the fact of use was counted.

This is not a complaint about the questionnaire. Put those two questions on a form and they stop being questions anyone answers honestly. Few directors will write down that they pasted unpublished results into an unapproved tool. What went uncounted went uncounted less because the survey was loosely drawn than because self-report cannot reach it. If it is to be counted at all, the record has to change, not the questionnaire.

One stage counted, two stages uncounted. The trouble, when it comes, usually comes from the middle.

03Promotional-material approvals carry the same gap in the record

Nobody knows which tool received which document. That gap is not confined to a questionnaire. It appears in the same shape in approval records.

The approval box keeps the verdict, the date and the signature. It does not keep which tool the reviewer fed the draft into, which of the returned options was adopted, or which were discarded. If the route to that single line of approval is unwritten, nobody can reproduce the same judgment six months later.

The two settings differ in scale and in legal standing. They agree on which items to keep and which to drop. Both keep the conclusion and drop the route to it.

The cost of dropping the route does not only surface during an audit. It surfaces when the person changes. A successor cannot read out of the record why the predecessor decided as they did, and so the same question is argued again from zero.

04As long as the tool belongs to the individual, the policy always arrives afterwards

Routes go unrecorded in boardrooms and in material review for the same reason: the tool arrives before the rule that would have required a record.

The survey shows that sequence numerically. Forty-nine percent of directors had heard of consumer AI tools, outside company-approved systems, being used for board work. Ninety-six percent knew of no instance in which board materials had been entered into an unapproved environment.

The two figures look inconsistent. The survey does not explain the gap, and there is nothing here to support a claim that anyone is concealing anything. One thing is certain: something reaches nearly half of directors as hearsay while almost nobody can name a case. The blind spot itself has taken numerical form.

A tool in someone's own hands waits for no permission. Until use surfaces, the company has no cases to write rules about. So the policy always trails the practice.

05Fix four fields in the record and the path to an approval becomes reproducible

If policy trails practice, then the form of the record has to be settled without waiting for the policy. Four fields are enough.

The two highest-use purposes in the survey both fit these four fields. For summarising meeting papers, the scope of material entered is the scope of the summary. For background research, it is the rejected findings that matter later.

None of the four takes a minute to write. Set against the agreement-building a policy document requires, the effort is an order of magnitude smaller.

06Usage, missing guidance and personal tools leave three separate tasks

Adding the four fields does not settle why they were missing. That splits three ways.

1. Usage at 82 percent

The overseers become subject to oversight themselves. A board exists to oversee management, and generative AI has entered the process that produces its oversight material. When the overseer cannot account for their own instrument, the ground under the oversight thins.

2. No guidance, per 54 percent

Without a definition of deviation, no breach can be detected. Formal policy stands at 6 percent. Where nothing states what must not be done, someone can cross the line without any finding that a line was crossed.

3. Consumer tools, per 49 percent

There is a route that leaves nothing at all in company records. Tools running outside approved systems put neither their usage history nor their inputs under company control. EU rules may oblige deployers to retain logs, but in some places those logs are never generated.

Each needs a different remedy. Usage is answered by the form of the record, missing guidance by an explicit list of prohibitions, personal tools by supplying an approved instrument first. One policy document does not close all three.

07Regulators will ask for records, not for the policy document

Of the three tasks, only one can be verified from outside: whether records exist. Whether a policy exists is visible in a single sheet of paper. Whether that policy operated shows up only in the record of the day.

Regulation is already turning that way. EU rules require deployers of high-risk AI to keep automatically generated logs for at least six months. The same regulation asks deploying organisations to build understanding among the people who use these systems.

Those rules do not reach Japanese companies or material review directly. What can be read from them is a direction: in a dispute, the thing demanded is the record, not the policy. In the United States, boards have long been held to a duty to put reporting systems in place for critical risks and to monitor them. Whether such a system existed is, again, answered by records.

Seen from material review, the direction is already familiar. When a reviewer has to demonstrate to an outsider that review was working, what can be produced is not the judgment but its traces. Generative AI entering the drafting stage left the traces one field short. Adding that field does not require waiting for regulation.

The share of companies with a policy will rise. Once it has risen, the question becomes how that policy showed up in each individual approval.

An approval can vouch for the verdict and no further. The path to it is vouched for only when the tool used and the answers rejected are written down.

Writing a policy takes consensus, negotiation and revision. Adding four fields to a record form takes none of those. Reversing the order is faster.

The two middle stages the survey never counted can be counted in your own approval records. For now, that is the part within reach.