AI Governance · 2026
AI Decisions Beyond Governance Frameworks
Governance Frameworks Help Boards Oversee AI. They Don't Help Boards Decide.
By Zahi Abdein · July 20, 2026
Walk into most boardrooms today and you will find an AI governance framework, or at least a plan to adopt one. NIST's AI Risk Management Framework, ISO 42001, the INSEAD and KPMG board principles: these are serious, useful documents, and boards are right to use them.
Yet something is not working. In a June 2026 BCG survey of 625 CEOs and board members, boards were approving AI investments while fewer than half set governance expectations or made AI risk a standing agenda item. INSEAD and KPMG report that 75% of boards have limited AI expertise. PwC finds only 35% of boards have integrated AI into their oversight activities. And when Grant Thornton asked executives whether they could pass an independent AI governance audit within 90 days, 78% said no.
Here is the uncomfortable conclusion I draw from sitting with boards and executive teams across the Gulf, Europe, and the U.S.: the problem is not a shortage of frameworks. It is that governance frameworks answer a different question than the one boards are actually struggling with.
Oversight is not the same as deciding
A governance framework tells a board what to oversee: risk categories, controls, accountability lines, disclosure. It is a compliance and assurance instrument, and a necessary one.
But the decisions that determine whether AI creates or destroys value are strategic, not supervisory. Should we fund ten pilots or two bets? Is AI a cost lever or a growth lever for us? What happens to our workforce, and who owns that answer? What would make us stop an initiative? No risk register answers those questions. That is why boards can be fully "governed" and still preside over what I call AI theater: visible experimentation, real spending, no decision advantage.
The gap, in other words, is not a governance gap. It is a strategy discipline gap. And strategy discipline is something boards already know how to build. They simply have not applied it to AI.
Six questions boards already trust, applied to AI
For years I have used a simple strategic leadership method with executives, the 6Qs. Six questions, in sequence, that force a leadership team from ambition to executable strategy. Applied to AI, they give boards the decision discipline the frameworks leave out.
Q1
What needs to be created or changed?
This is the question that kills AI theater. Before any tool discussion: what specifically about our business must change, and what is the evidence? If the honest answer is "our competitors are doing something," you do not yet have a case for investment. You have anxiety.
Q2
Where do we want to go?
Direction, stated as decision advantage, not adoption. "Deploy AI across functions" is not a destination. "Cut credit decision time from days to hours without raising risk" is. Boards should refuse AI ambitions that cannot be stated as a business outcome.
Q3
Where should we focus our resources?
Scattered pilots are the most common failure pattern I see. AI spending is expected to double, yet most organizations still cannot say which two or three bets deserve real money, real talent, and real executive attention. Focus is a board-level resource decision, not an IT allocation.
Q4
What is my business strategy?
How does AI change what we sell, how we price, how we operate, and where value migrates in our industry? If the AI plan does not alter the business strategy conversation, one of the two is not being taken seriously.
Q5
What is my people strategy?
This is the question most boards are avoiding, and the data shows the cost of avoidance. A majority of this year's tracked layoff events explicitly cite AI. Capability, culture readiness, redeployment, and the leadership behaviors AI demands: these are strategy questions with hard numbers attached, not an HR memo to be noted.
Q6
How will we implement, evaluate and learn?
Here, and only here, is where the governance frameworks belong. Controls, risk appetite, metrics, learning loops, stop rules. Q6 is where NIST, ISO 42001, and board AI principles plug in, and they plug in well, once the first five questions have been answered.
Notice the order. Governance is the sixth question, not the first. Boards that start with governance are supervising a strategy they never actually made.
What this looks like in practice
A board working this way does something refreshingly simple: it asks management to answer the six questions on a handful of pages, in plain language, with evidence. The quality of the answers tells the board more about AI readiness than any maturity assessment.
Three signals to watch for. First, whether Q1 is answered with evidence or with fear. Second, whether Q3 names what will NOT be funded; a focus decision that excludes nothing is not a decision. Third, whether Q5 has an owner at the executive table; if the people strategy for AI belongs to no one, it does not exist.
The frameworks then do what they were designed to do: assure the execution of a strategy the board understands and chose, rather than substitute for one.
The question worth sitting with
Could your board, today, answer the six questions about AI on one page each, and agree on the answers? If yes, your governance framework is protecting something real. If not, the framework may be giving you the feeling of control without the substance of a decision.
That gap between oversight and decision is where I focus my work with boards and executive teams. It is also, I would argue, where the next two or three years of competitive separation will come from. The organizations that pull ahead will not be the ones with the most sophisticated frameworks. They will be the ones whose leaders asked better questions, in the right order, and had the discipline to answer them.