AI in your business: what directors need to know

AI is increasingly being integrated into core business operations across many sectors.

From credit models to compliance, recruitment to fraud detection, functions that once depended on human judgement are increasingly being handed to automated processes. A company might ask AI to shortlist a stack of CVs using some defined criteria, and then present the hiring manager with only the shortlisted CVs.

For most business owners, the benefits are obvious but the risks are less so and the risks that matter most to directors are not always the ones that make the headlines.

Delegating authority does not mean delegating responsibility

This is the most important message in this article.

When a director allows an AI system to make material decisions on behalf of a business, they do not transfer their legal responsibility for the consequences of those decisions. The fiduciary duties that directors owe to their company remain firmly in place, regardless of how sophisticated the tools they use have become.

This matters because AI failure is not always visible. When a traditional IT system fails it is obvious. AI systems can, however, fail quietly: continuing to operate while drifting away from their intended outcomes, producing subtly biased outputs, or amplifying small errors into significant commercial damage. For example, this could include rejecting business from good customers or approving those with bad credit.  By the time the problem becomes apparent, the exposure may already be serious, threatening the very future of that business.

The question for directors is not whether they can trust AI. It is whether they can demonstrate, if called upon to do so, that they exercised proper oversight of it.

Clarity over where AI is making material decisions

The starting point is understanding where AI is making decisions in your business. That means knowing which processes are automated, whether those outputs are treated as binding, and which functions – revenue, credit, compliance, customer access – carry the greatest exposure if something goes wrong. Directors who cannot answer these questions put themselves at risk.

Proportionate governance for high-impact applications

Not all AI applications carry equal risk and governance should reflect that. Where AI is being used in pricing, underwriting, anti-money laundering, hiring or customer access, there should be defined performance metrics, validation processes, escalation thresholds and regular reporting to management. Oversight in name only is not sufficient; in any scrutiny after a failure has happened, the absence of documented governance will be difficult to justify. 

Meaningful human oversight

The existence of a human override is not enough. Directors need to be clear on when human judgement should override automated outputs, who has the authority to intervene and how conflicts between a system’s output and an individual’s judgement are resolved. These are not theoretical questions – directors will be expected to address these points if a business were to collapse. 

Ask the right questions

Directors should be pressing their teams on specifics. Which decisions are now automated that were previously manual? What would happen if those systems were wrong, and crucially, how would we know? Have failure scenarios been tested, including silent failures where a system continues to operate but produces flawed outputs?

The answers matter less than the evidence that the questions were asked and taken seriously.

Documented actions

Perhaps the most important practical step from a personal protection standpoint is also the most straightforward: keep records. When AI influences a material outcome, a clear record of approvals, reviews and any challenge to automated outputs is a director’s best defence if decisions are later scrutinised. Good documentation supports better decision-making in the moment and preserves stakeholder confidence if problems emerge.

A question of when, not if

AI dependence is no longer a future concern. For many businesses, it is already the present. 

Directors who engage with the issues raised in this article now, and can demonstrate that they have done so, are in a materially stronger position than those who cannot.

Kreston Reeves dedicated Restructuring team is not just there to help when things go wrong. It is there to ensure that if they do, directors are not left personally exposed. If you need any assistance with your business, please do not hesitate to get in touch.