Board of directors: between ritual and strategy, and where AI fits in
"Boards … need to be strong, high-functioning work groups whose members trust and challenge one another and engage directly with senior managers on critical issues" © Jeffrey Sonnenfeld, Yale School of Management, HBR
For the past few years I have worked in several overlapping roles. Founder of an engineering holding in the real sector. Executive coaching to ICF standards. Host of AI masterminds for owners and top management. One storyline runs through all three roles — how decisions get made in large companies. And how often the board of directors turns out to be the place where those decisions are not.
In Kazakhstan and across much of the emerging markets, mid-sized and large business carries a noticeable delta between the form and the substance of the board. The board holds four meetings a year, minutes are drawn up to the Corporate Governance Code, there are independent directors, an audit committee, a remuneration committee. And the real strategic decisions are taken outside the board — by owners, shareholders, executive management. The board remains a ritual in which those decisions are ratified.
This article is about the difference between a ritual board and a working one. Plus about one area that in 2026 is pulling boards apart harder than any other: the governance of artificial intelligence. Today 83% of companies in the S&P 500 disclose AI risks in public reporting. And only 2.7% of directors have explicit AI expertise. That delta is the board's main bottleneck for the next two or three years, and it feeds directly into the value of the company.
A board is behaviour in the room
Structure is form. Behaviour in the room is substance
The main conclusion of thirty years of international corporate governance research was set down by Jeffrey Sonnenfeld of the Yale School of Management in his classic article "What Makes Great Boards Great" (HBR, 2002). The boards that collapsed under Enron, Theranos, Wirecard, FTX and the Boeing 737 MAX formally complied with most of the recognised standards: adequate size, an independent majority, an audit committee, a code of ethics, regular meetings. All those boards failed for one reason — looking right and behaving right turned out to be two different things.
In practice that difference does not run along the charter or the committee structure. It runs along what happens in the room during the meeting. In my experience there are two very practical indicators that show which kind of board you have.
The first. What the chair says once management has finished the presentation. If the first line is "thank you, let's put it to a vote", this is a board that ratifies decisions already taken. If the first line is "let's stop at slide three, I have a question", this is a board that takes part in making decisions.
The second. Where the real decisions get made. If in the room, the board works. If in corridor conversations and calls to management that bypass the board, what you have is a ritual mechanism.
Six signs that your board is ritual
The most telling sign is a meeting that has come down to slides which could have been circulated in advance
This is a condensed list drawn from Sonnenfeld's work and later research by Spencer Stuart, McKinsey and NACD. They all describe the same picture.
Rubber stamp. The meeting comes down to passively watching management's presentations and voting "for" on every item. If there is no substantive dialogue, the board exists for the minutes, not for decisions.
Groupthink. Irving Janis's 1972 concept: the drive for unanimity suppresses realistic appraisal of alternatives. The symptoms are an illusion of invulnerability, stereotyping of opponents, self-censorship, and the emergence of "mindguards" who themselves shield the group from awkward questions. Empirical evidence from 2020: the longer directors serve together, the stronger the effect.
A dominant CEO and a captured board. Bebchuk and Fried of Harvard Law, in "Pay Without Performance", formulated the managerial power hypothesis: executives effectively control their boards and maximise their own remuneration up to the limits of public outrage. The aggregate remuneration of the top five executives of all US public companies from 1993 to 2002 came to 250 billion dollars, around 7.5% of all corporate profit.
The "polite board" syndrome. "Almost no one wants to be a skunk at a lawn party" — that is financier Ken Langone, quoted in Sonnenfeld's article, explaining that directors feel under pressure to fit in so they will be renominated. Objections and doubts stay in corridor conversations; at the meeting there is polite unanimity. In my experience this is the most frequent pattern in post-Soviet business culture, where saying openly "I don't understand how this strategy works" is socially expensive.
Information asymmetry. A striking example from Enron: the chairman and the CEO never told the board that Sherron Watkins had raised serious questions about financial irregularities. The reverse problem is board packs of 500–1000 pages arriving two days before the meeting. McKinsey recorded the key pattern in 2021: on the highest-impact boards, 83% of directors say they actively seek information beyond what management provides; on ordinary boards it is 63%. Twenty percentage points of difference, and a completely different depth of judgement.
Competence gaps. Especially at the seams between industries and during technological transitions. According to Spencer Stuart's 2024 data, about a quarter of nominating and governance committee chairs say they have one or more directors who "should no longer be on the board", most often because the director's skills and expertise are out of date. And that is before AI made it onto the agenda in earnest.
What distinguishes a working board
The best boards are not the most harmonious ones. They run on trust and productive conflict
Sonnenfeld's formula: trust plus constructive conflict. High trust between board members and, at the same time, open discussion in which it is acceptable to challenge each other's assumptions and management's assumptions. The UK Corporate Governance Code 2024, in Principle H, formalises this as a requirement for non-executive directors to "provide constructive challenge, strategic guidance, offer specialist advice and hold management to account". Psychological safety for dissent — without it, independence of mind stays a declaration.
McKinsey recorded a quantitative pattern that I consider the most telling in the whole topic. Directors who rate their impact on the company as very high spend 41 days a year on the board. Those who rate their impact as moderate or below spend 19. The 22-day difference does not go into formal reporting — everyone spends exactly 4 days on that. The difference goes into strategy, performance management, M&A deals, organisational health. Board effectiveness is not about a director's status or fee. It is about the investment of time.
The institutional practices through which a working board sustains itself.
Executive sessions without the CEO and without the controlling owner. At least twice a year, an hour to an hour and a half. This is a separate format layered on top of the main meeting, in which independent directors can say what they do not say in front of the CEO. In my view this is the earliest and cheapest investment in board effectiveness.
A competence matrix as a living document. Not a box in the annual report to shareholders, but a matrix reviewed annually that determines who gets invited onto the board and who gets moved off it.
The board pack a week before the meeting, not two days. And questions submitted in writing before the meeting, so that the meeting itself discusses substance rather than clarifications of fact.
External effectiveness evaluation every three years. Spencer Stuart, Egon Zehnder, Russell Reynolds — one of the big partners. In the S&P 500, 28% of companies use that option; in Kazakhstan there are isolated cases.
Separation of the CEO and chair roles. 60% of the S&P 500 in 2024 — an all-time high; in 1998 it was 16%. The UK Code requires separation as a baseline standard.
Tenure limits for independent directors. UK Code — 9 years, Singapore — 9 years with no extension, Spain — 12. In Kazakhstan the tenure of some chairs exceeds 20 years.
None of these points on its own makes a board work. But if all six are missing, the board is in all likelihood a ritual one.
The AI competence gap. The main area for upgrading boards right now
83% of S&P 500 companies disclose AI risks. 2.7% of directors have explicit AI expertise
The figures come from a Conference Board study of December 2025. The dynamics are particularly telling: disclosure of AI risks in the S&P 500 grew from 12% in 2023 to 83% in 2025. Over a longer run, from 2021 to 2025, the share of directors with disclosed AI expertise went from 1.5% to 2.7%. The topic on the agenda grew sevenfold; the competence in the room did not quite double. Only 23% of executives consider their board "highly fluent in AI". Fewer than 10% say their companies are fully prepared to comply with AI regulation.
Meanwhile the regulatory perimeter is already here. The EU AI Act came into force on 1 August 2024. Fines of up to 7% of global annual revenue for prohibited practices, up to 3% for breaches relating to general-purpose models and high-risk systems. That lifts AI governance to board level as a fiduciary duty. The NIST AI Risk Management Framework, ISO/IEC 42001:2023, the SEC rule on disclosing cyber incidents in Form 8-K within four business days — the technical minimum that is already shaping the expectations of investors and regulators.
And here is the most interesting figure. Peter Weill of MIT Sloan CISR studied "digitally savvy boards" — boards in which at least half the directors have deep digital understanding. Such boards show 17% higher revenue growth and 38% higher market capitalisation compared with peer companies. A durable difference in company value depending on the composition of the board.
What this means for a typical board. Management brings an AI strategy to the meeting: use cases, return on investment, a project roadmap. The board votes. And nobody on the board asks the right questions: which model is used, on what data was it fine-tuned, how is the security perimeter built, how does all this map onto the regulatory frame of the EU AI Act, what are the risks of model hallucinations in live operation.
Management is confident the board has approved the strategy. The board is confident it is overseeing AI. What has actually happened is a formal sign-off accompanied by an expansion of risk, and now that risk sits on the company, because the annual report states that the board oversees the AI agenda.
This is the same delta between form and substance. And in the case of AI it turns into real damage quickly. Air Canada and its hallucinating chatbot in February 2024; the EEOC against iTutorGroup in 2023 (a 365-thousand-dollar settlement and a five-year injunction over an algorithm that rejected women aged 55+ and men aged 60+); the deepfake fraud at Arup in January 2024 (15 transfers totalling 25.6 million dollars on the basis of a video call with a faked CFO). These are only some of the public cases with real sums and court decisions attached.
What a director with AI expertise does on a board
An AI director translates the abstract "AI changes everything" into concrete risks, metrics and decisions
The main function is substantive argument with management in an area where a board without a specialist is deaf by default. From my experience in my own companies and in work with other owners, an AI director closes four specific tasks in the board's work.
Translating AI initiatives into management decisions. Management arrives with a presentation saying "we are adopting AI"; the AI director asks the right questions. On which processes? With what data? What is the metric showing that adoption actually returns money rather than remaining an image exercise? Do you have an AI-native accounting system, or are you bolting agents onto an old one?
Oversight of AI risks as a separate category. This is not part of cybersecurity — AI risks have their own physics: model risk, data governance, hallucinations in live operation, AI-enabled impersonation attacks on financial operations, discrimination in recruitment algorithms. A board without an AI expert does not assess those risks, because it does not know which way to look.
Preparing for regulation. The EU AI Act works in stages: prohibited practices from February 2025, governance from August 2025, rules for high-risk systems from August 2026. ISSB IFRS S1/S2, the SEC rule on cyber incident disclosure, NIST AI 600-1 for generative AI. Management does not always see the regulatory window. An AI director treats it as a board duty.
The AItomation paradox. This is a management thesis I repeat in front of different audiences. Alongside the AI tools, you have to rebuild the internal regulations. If you have automated work that used to take three hours and it now takes twenty minutes, the remaining two and a half hours do not on their own turn into additional output for the company. They turn into the employee's personal time. A board with a director who has real AI adoption experience sees that delta and puts it to management.
Benchmark public cases. Andrew Ng, founder of Google Brain and Coursera, was appointed to Amazon's board on 9 April 2024. That is the clearest "AI director" appointment in Big Tech and a signal: even Amazon, with its own AWS stack and 4–8 billion dollars invested in Anthropic, decided the board needed a voice that reads model architecture. Reid Hoffman, co-founder of LinkedIn and a partner at Greylock, has been on Microsoft's board since 2017 and sits on the environmental, social and public policy committee, whose charter includes responsible AI development.
What such directors actually do. It is rarely work with code or with specific technical artefacts. It is work with the right questions at the right moment. A finance-director emeritus on an audit committee does not do the auditor's job — they close the zone in which management could work around the auditor. An AI director does not do the CTO's job — they close the zone in which the board might miss a decision that later turns out to be expensive.
The best practice according to Spencer Stuart 2024 is a hybrid: two or three directors with a deep AI foundation, AI education for the whole board, annual deep-dive AI sessions, and independent AI advisory boards. An isolated "subject matter expert" will not build that infrastructure — they have neither the mandate nor the working hours.
What the OpenAI story teaches
A board with the right composition of mandates can still fall apart if it has no counterweight with operating experience
The story of November 2023 is instructive for anyone thinking about the governance of AI companies. On 17 November 2023 the OpenAI board — Ilya Sutskever, Adam D'Angelo, Helen Toner and Tasha McCauley — dismissed Sam Altman without stating public reasons. Within five days a huge share of the staff threatened to leave, Microsoft offered to employ the team, and Brockman left of his own accord. On 21 November Altman was reinstated and the board was reconstituted: Bret Taylor became chair, with Adam D'Angelo and Lawrence Summers remaining.
The WilmerHale investigation in March 2024 framed the cause as a breakdown of trust between the board and Altman. No bad faith, no complaints about safety or finances. A communication failure between mission-oriented independent directors and an operating CEO.
What I see as the lesson. A board made up of directors who are "right" by composition — independent, mission-oriented, with relevant expertise — can fall apart if those directors have no counterweight with operating experience. If the board has not a single person who sees the running of a company from the inside, at the level of daily operating work, then technical or ethical imperatives can lead to decisions that break the mechanics of the business.
Anthropic answered this with the Long-Term Benefit Trust, a construction that separates the mission perimeter from the operating board. The trust includes Reed Hastings, Vas Narasimhan and others — each with operating experience and an understanding of how a company works, not only of how a mission works.
For a typical Kazakhstan or CIS board that lesson translates as follows. If you are adding an AI director to the board, it must be someone who has previously run a company, a product, or a large technical function. Pure research experience without an operating background will break against reality on a board exactly as the first OpenAI board broke. Not because those people are incompetent. They simply lack managerial intuition.
Where to start. Six steps for an owner or chair in Kazakhstan
A board works towards results. Formal reporting is the level of committees
If you are an owner or a board chair, and it is obvious to you that the current board operates in ritual mode, there are steps you can take without structural overhaul.
Executive sessions without the CEO and the controlling owner. At least twice a year, an hour to an hour and a half. This is a separate format layered on top of the main meeting, a cultural permission to say "I disagree" without social punishment for it. The cheapest investment in board effectiveness.
A competence matrix as a mandatory element of the annual report. Kaspi.kz and Air Astana already publish such matrices — it is a NASDAQ and LSE requirement. For large private holdings and Samruk-Kazyna portfolio companies, what is a recommendation at the level of the 2021 Corporate Governance Code should become a mandatory line in the annual report, with an explicit "AI and digital competence" entry in the list.
External board effectiveness evaluation every three years. In the S&P 500 such evaluation is carried out by 28% of companies; in Kazakhstan there are isolated cases. Samruk-Kazyna has the resources to make it mandatory for portfolio companies. In my experience it is precisely through an external picture that decisions the owner has long held in mind become possible to push through the board.
Tenure limits for independent directors. Nine years under the UK Code, nine with no extension in Singapore, twelve in Spain. In Kazakhstan some board chairs serve twenty years in one place — which helps neither trust nor the renewal of competence. A 9–12 year limit with a mandatory public justification for any extension is a realistic step.
Separation of the CEO and chair roles. This is the baseline for all public companies in developed jurisdictions. In Kazakhstan the picture is uneven: in some private holdings and quasi-state companies the roles are combined, or effectively combined through the political configuration. Separation plus a strong senior independent director is mandatory infrastructure for a working board.
AI as an explicit position in the board's composition. A hybrid model: two or three directors with an AI foundation, AI education for the whole board, an annual deep-dive AI session, a mandatory AI risk register per the NIST AI RMF. For companies with a European presence — EU AI Act compliance as a board-level task. At the next refresh of the composition, look for an AI-grounded director with operating experience, not a pure researcher or a venture investor with a light AI background.
Kazakhstan has one instrument of its own — the AIFC. English common law in the AIFC allows you to "legally import" the best international practice without waiting for changes to nationwide legislation: a structure modelled on the UK Code, a senior independent director, mandatory third-party evaluation, a declaration on the effectiveness of controls. There is no equivalent to that instrument in Central Asia or the CIS.
A board of directors is the instrument through which an owner gets a second opinion on decisions that are expensive to take alone. A framework of formal reporting does not deliver that. In my experience, a genuinely working board pays back its budget with one right decision a year. And the ritual versions lose several times more with every wrong one.
I do not claim the final word — every company has its own context, and some of these recommendations may not apply. But the basic logic holds: trust plus productive conflict inside the board, and AI grounding around the perimeter, is currently the minimum that separates an effective board from a formal one.
If you have an area where the competence is missing, particularly at the seam between AI strategy and real adoption in operations — write to me and we will talk it through.