AI, Regulation and Risk: Questions for Boards to Consider

Board agendas continue to evolve as organizations respond to changing risks, opportunities and stakeholder expectations. The 2026 proxy season offered new insights into shareholder priorities and governance practices, while developments in artificial intelligence (AI), international tax, enterprise risk management and regulatory oversight raise important questions about strategic decision-making.

As year-end approaches and organizations begin planning for 2027, boards have an opportunity to consider how these developments may affect their priorities and strategies. The following questions can help guide focused, forward-looking discussions in the boardroom.

1. What lessons should we take from the 2026 proxy season?

The close of the 2026 proxy season gives boards an opportunity to look beyond whether individual proposals passed or which directors were reelected. It provides a chance to consider what voting results and shareholder engagement may signal about investor priorities.

Across the market, shareholder proposal activity declined, as governance issues, board composition and emerging topics such as AI continued to draw attention. For public companies, voting patterns and investor feedback provide useful information for planning the next proxy cycle. Approximately 300 shareholder proposals went to a vote at S&P 500 companies, down 18% from 2025.

Rather than waiting until proxy preparation begins, boards should review the season’s results and investor conversations while they are still fresh.

Questions to consider include:

• Did any directors, compensation proposals or other ballot items receive lower support than expected? If so, do we understand why?
• What did we learn from shareholder engagement before and during proxy season?
• Are there governance practices or disclosures that investors questioned or that may warrant reconsideration before next year’s proxy?
• How do our board composition, skills, disclosures and succession planning compare with evolving investor expectations, including expectations related to AI and technology oversight?
• What issues emerged during the 2026 proxy season that boards should begin addressing now rather than waiting for the 2027 proxy process?

2. Are we managing AI risk while still capturing its potential value?

As AI moves from experimentation into everyday business operations, boards face a dual responsibility. They must understand how the organization is managing new risks while also consider where AI can improve efficiency, decision-making and competitive position. Effective oversight does not mean eliminating risk or slowing adoption. It means establishing governance that allows the organization to pursue appropriate AI opportunities within its risk appetite.

That requires visibility into where AI is currently used, including employee-enabled tools and AI embedded in third-party technology, as well as a process for evaluating new applications. Boards should consider whether management has established appropriate guardrails without creating barriers that prevent the organization from realizing AI’s potential value.

Questions to consider include:

• Do we have sufficient visibility into where and how AI is being used across the organization, including employee-enabled tools and third-party applications?
• How does management identify and evaluate opportunities to use AI to improve operations, productivity, customer experience or decision-making?
• Are AI opportunities evaluated against risks such as data privacy, cybersecurity, model reliability, bias, transparency and regulatory compliance?
• Do our governance and approval processes distinguish between higher- and lower-risk AI applications so controls are proportionate to the risks involved?
• How are we measuring whether AI investments and initiatives are delivering the expected business value?

3. Are we aware of what Pillar Two is and are we taking a strategic approach to compliance?

Pillar Two is the Organization for Economic Co-operation and Development’s (OECD) global minimum tax framework, intended to ensure large multinational companies pay at least a 15% effective tax rate in each jurisdiction in which they operate. As countries continue to adopt and refine these rules, the implications extend beyond tax compliance for multinational groups within scope (generally those with annual revenue exceeding €750 million). In 2026, the OECD released a “side-by-side” set of safe harbor rules that apply for fiscal years beginning in 2026. The guidance effectively turns off the income inclusion and undertaxed profits rules for eligible U.S.-parented groups that elect to apply the safe harbor. However, domestic minimum top-up taxes imposed by other countries still apply.

Pillar Two can influence tax planning, financial reporting, data requirements and decisions regarding investment, organizational structure and operating models.

Boards do not need to master the technical mechanics of the rules, but they should understand where the organization may be affected and whether management has incorporated those considerations into broader tax and business planning.

Questions to consider include:

• Do we understand which jurisdictions may subject us to the global minimum tax rules and how that exposure could expand as additional countries adopt them?
• Where are we in scope, and does our ultimate parent’s location qualify us for side-by-side relief?
• Has management identified other available safe harbors and evaluated opportunities to simplify compliance?
• Do our tax, finance and technology teams have the data, processes and controls needed to meet reporting requirements?
• What impact could these rules have on our effective tax rate, financial statement disclosures and long-term tax strategy?
• Are domestic minimum top-up taxes, if applicable, reflected in our financial statements and financial disclosures?
• Are tax, operational and investment decisions being evaluated with these requirements in mind?

4. Is our enterprise risk management (ERM) process helping us make better decisions?

Many organizations have established ERM frameworks for identifying, assessing and reporting risk. As risks become more interconnected and change more quickly, boards should consider whether the ERM process is producing timely, actionable information or simply documenting risks the organization already knows about.

An effective ERM process should connect risk with strategy and decision-making, establish clear ownership and help management recognize when changing conditions require action. That may mean supplementing traditional risk assessments, reporting cycles and risk registers with more dynamic approaches, including early warning indicators, scenario analysis and ongoing risk discussions.

Boards should ask:

• Is our ERM process identifying information that changes or improves business decisions, or is it primarily documenting known risks?
• Are risk assessments connected to strategic planning, capital allocation and other significant business decisions?
• Do significant risks have clear owners with the authority and accountability to respond as conditions change?
• Are we using forward-looking indicators and scenario analysis to identify when a risk is increasing or assumptions may no longer be valid?
• Does the information provided to the board focus attention on the risks and opportunities that matter most, or has ERM reporting become too broad or routine to be useful?

5. Are we prepared to respond strategically to regulatory change?

Regulatory change has become an ongoing strategic risk affecting business models, corporate governance, technology and stakeholder confidence. Boards should understand whether management has established processes to monitor regulatory developments, identify blind spots and determine when a strategic response is necessary. The objective is not to react to every proposal or headline, but to distinguish developments requiring action from those that warrant continued monitoring. By connecting regulatory intelligence with enterprise risk, organizations can anticipate potential disruptions and make informed decisions before issues escalate.

Boards should consider the following questions as part of their oversight responsibilities:

• Do we have a structured process to identify, evaluate and prioritize regulatory changes across jurisdictions, markets and business activities?
• How does management determine which regulatory developments require immediate action, which require monitoring and which create strategic opportunities or risks over time?
• What processes or frameworks help uncover blind spots, including those affecting legal, compliance, technology and third-party relationships?
• When regulatory change signals a need to pivot, how do we ensure decisions are timely and aligned with our strategy?
• How are high-impact regulatory risks communicated to the board, and do we have the information needed to challenge assumptions and monitor readiness?

Looking Ahead

These questions reflect a common challenge for boards that effective oversight requires more than knowing that policies, controls and processes are in place. Boards also need to consider whether those mechanisms are producing useful information, supporting sound decisions and adapting as business conditions change.

Reviewing lessons from proxy season, balancing AI opportunity with risk, considering the broader implications of Pillar Two, reassessing the value of ERM and preparing for regulatory change can help boards focus their attention on areas where thoughtful oversight can make a meaningful difference.

For additional insights on governance, risk and issues affecting public companies, subscribe to Weaver’s monthly insights. Contact us to learn how Weaver can help your organization strengthen oversight and prepare for what’s ahead.

©2026

Featured

SEC Reform, Capital Allocation and Governance: Four Questions for Public Company BoardsRead Article

 

Executive Resource

SEC Reform, Capital Allocation and Governance: Four Questions for Public Company Boards