AI tools are increasingly being used by boards of companies (both at a board level and on an ad hoc basis by individual directors) to analyse financial and accounting data; market trends; the competitor landscape and various other issues with a view to gaining a deeper understanding of the performance of the business and to make (hopefully) more informed decisions.
However, as AI tools become more embedded in board-decision making processes, the line between human and machine decision making becomes increasingly blurred. The deployment of those AI tools to support the decision-making of a board of directors of an English company engages several overlapping directors' duties under the Companies Act 2006 (CA 2006). While there is no prohibition on boards using AI as an aid, the statutory framework imposes constraints that create meaningful legal exposure if AI is adopted without proper governance.
The duty to exercise independent judgment (Section 173)
Under s 173(1) CA 2006, each director must exercise independent judgment. The purpose of this duty is to preclude directors from placing themselves in a position where they are unable to, or do not, exercise any discretion in carrying out their duties. A director who simply follows the output of an AI model without applying critical thinking risks breaching this duty. While case law establishes that a director may legitimately accord weight to the views of those with greater expertise, this is subject to the director having "weighed that fact critically, according to his own level of skill, expertise and general intelligent common sense." The same reasoning would apply to AI-generated recommendations: a director must engage with the substance of the output and not treat it as determinative. A director who effectively cedes judgment to the output of an AI tool or other algorithm may arguably then be in breach of this statutory duty.
The duty of care, skill and diligence (Section 174)
Section 174 CA 2006 requires directors to exercise the care, skill and diligence that would be exercised by a reasonably diligent person with both the general knowledge, skill and experience reasonably expected of a person carrying out the director's functions and the actual knowledge, skill and experience that the director has. This dual objective-subjective standard creates several risks in relation to AI.
First, a director cannot simply delegate responsibility for a decision to an AI system and treat the matter as concluded. The duty of supervision requires directors, both collectively and individually, to maintain a sufficient knowledge and understanding of the company's business and to supervise delegated functions. While directors are entitled to delegate particular functions and to trust the competence of those below them, the exercise of delegation does not absolve a director from the duty to supervise the discharge of the delegated functions. If an AI system produces flawed analysis that results in loss to the company, a director who failed to interrogate or verify that analysis would potentially be exposed to a claim for breach of section 174. In Re Westmid Packing Services Ltd (No. 2), Lord Woolf MR stated that "each individual director owes duties to the company to inform himself about its affairs and to join with his co-directors in supervising and controlling them."
Second, the question of reasonable reliance is critical. By analogy with professional advice, reliance on AI output will only be defensible where the reliance is reasonable. Relevant factors drawn from the case law on reliance on advisers include whether the director had any reason to doubt the correctness of the output, whether the adviser was fit for purpose, whether the director asked all reasonable questions, and whether the issue was one on which the director could not reasonably have been expected to form a view personally. An AI tool that is not designed for the specific decision in question, or that is known to produce unreliable outputs, would not provide a reasonable basis for reliance; much as advice from an adviser not competent to advise on the issue will not protect a director.
Third, directors may be equally liable for inaction as for action under Section 174. A board that adopts AI without implementing adequate oversight mechanisms, for example by failing to establish processes for validating AI outputs or testing for bias, may be found to have failed in its supervisory duty. As was stated in Australian Securities and Investments Commission v Healey, "a director is not an ornament, but an essential component of corporate governance" who must "take a diligent and intelligent interest in the information available to him or her, to understand that information, and apply an enquiring mind to the responsibilities placed upon him or her."
Collective decision-making and the risk of groupthink
Directors must exercise their powers collectively as a board.
Where an AI tool generates a single recommendation that all directors accept without challenge, the board risks falling into the kind of "groupthink" that the UK Corporate Governance Code 2024 identifies as a threat to effective decision-making. The Financial Reporting Council considers that factors that might limit effective decision-making include insufficient knowledge and ability to test assumptions, a lack of openness, and inadequate information or analysis. An over-reliance on AI-generated outputs could create precisely these conditions.
The UKCG Code Guidance emphasises that the board should invest time in its decision-making, including obtaining input from key stakeholders and experts, and reserving adequate time to consider all issues. If a board uses AI to short-circuit a specific decision making process, this could expose directors to a breach of directors’ duties.
D&O insurance considerations
Directors should also be mindful of the evolving landscape in relation to (D&O) insurance coverage, with some insurers now seeking to include exclusions and carve outs for “any actual or alleged use, deployment or development of AI”; whilst other insurers are choosing to underwrite and price AI risks for an additional premium as opposed to excluding those risks entirely.
As happened with cyber insurance coverage, the market is rapidly responding to the risks posed to business operations by the deployment of AI. It is therefore important for companies to discuss this specific issue with their insurance broker to understand the scope of existing cover and ensure on renewal that coverage is as broad as possible and confronts this issue robustly.
Practical tips
Boards seeking to mitigate these risks should ensure that: AI is treated as one input among several in the decision-making process, rather than a substitute for board deliberation; directors are able to understand the basis on which the AI system has generated its output, so that they can genuinely exercise independent judgment; the board establishes governance processes around the use of AI—including policies on validation, human oversight and escalation—analogous to the supervisory structures it would adopt when delegating to management; and board minutes record the extent to which AI was used and how directors satisfied themselves as to the reliability of its outputs.
A final thought
English law does not prohibit boards from using AI tools, and properly deployed AI may in fact assist directors in fulfilling their duty to ensure they are adequately informed. However, the statutory duties under sections 173 and 174 CA 2006 require directors to remain the decision-makers and not to rely on AI tools without adequate scrutiny.
