83% of S&P 500 Firms Flag AI Risk. Under 3% of Directors Know AI.

By Grace Kim

Between 2023 and 2025, the share of S&P 500 companies disclosing AI as a risk jumped from 12% to 83%, according to The Conference Board. Yet company filings show fewer than 3% of directors have AI expertise. Just 23% of executives said their board was highly fluent in AI, and a quarter said it had low fluency or none at all.

That's the gap: what boards must oversee has exploded; what they understand hasn't kept pace. And the obvious fix—hire AI experts for the boardroom—doesn't close it.

Why isn't recruiting AI experts enough?

Two reasons, according to the analysis. First, AI isn't siloed. It runs through hiring, pricing, customer service, credit, and operations. "There is no single AI agenda item for one expert to own, and every director will vote on matters AI has shaped, whether they realize it or not." Oversight must be distributed, not concentrated in a few expert seats.

Second, expertise is not the same as competent oversight. Someone can understand exactly how a large language model works without ever asking who in the company is accountable for one, or what an AI agent is allowed to spend. Boards face two distinct questions—whether the board knows enough, and whether each director is competent at oversight—and while everyone focuses on the first, the second is largely neglected.

What does the board actually need to oversee?

The research, drawn from an ongoing director-scorecard study at Shadoka, identifies eight foundational areas. Each is a place where AI can do real damage:

• Governance oversight: knowing which individual is accountable for each AI matter, and holding them accountable.
• Data inquiry: knowing what data the company's AI uses, where it goes, and on what legal basis—backed by evidence, not vendor assurances.
• Explanation and disclosure: ensuring the company can explain an AI decision to the person it affects, and that public claims match reality.
• Fairness and affected parties: knowing which groups a system could disadvantage, when it was last tested, and whether problems were fixed rather than just recorded.
• Risk and irreversibility: knowing what the company's AI can do that cannot be undone, and how the board would hear about a failure.
• Human judgment and workforce: ensuring a person can overrule a system in practice, not just on paper.
• Autonomy and agent authority: knowing what AI agents may do, spend, and commit on their own, with a limit and a way to stop each one.

A board that covers some areas but not others is dangerously exposed.

Measure what directors do—not what they know

PwC's 2025 survey of public company directors found two-thirds said their board should spend more time on AI. Fewer than half said their board had an approach to actually overseeing it.

The strongest evidence that someone can perform a task is that they regularly perform it to a high standard. Almost every director would agree the board should know which AI systems the company uses. Far fewer have actually asked to see the list, and fewer still ask for it every time the board reviews AI risk.

First step: ask each director to name the last AI oversight act they performed, and when and where it happened.

Why the floor matters more than the average

A director's level is set by their weakest competency, not their average. Boards already accept this logic for financial controls: under U.S. auditing standards (AS 2201), one material weakness means internal control over financial reporting cannot be considered effective. Nobody averages a material weakness away.

The problem is that directors gravitate to questions they're comfortable asking. A former CFO interrogates the data; a technologist interrogates the model. Depth in one area becomes a reason to skip the others—a CFO who never asks what the company's agents can do is relying on someone else to ask, and if that person is absent or deferring in turn, nobody asks at all.

The floor isn't a demand that every director become an expert in everything. It's a minimum standard every director clears in every area—just as NYSE listing rules require every audit committee member to be financially literate.

First step: ask each director which AI oversight question they'd be least able to answer, and make it their priority for the next quarter.

Can one expert seat carry the load?

No—and the 2026 Spencer Stuart U.S. Board Index shows why. Boards again favored directors with CEO and financial experience, so depth piles up around data and models and thins everywhere else.

Financial controls solve the same problem with the four-eyes principle: no material transaction rests on one person's judgment. One expert's judgment tends to go unchallenged when no one else on the board is equipped to test it. AI oversight should work the same way, with at least two directors working at depth in every area.

First step: map which directors work at depth in each area. Any area with fewer than two is uncovered.

The bottom line: expertise is what a board has—oversight is what a board does, and having the first doesn't guarantee the second. Directors can benchmark themselves via the public Shadoka RAIX director scorecard while the research is ongoing.