May 7, 2024

Are boards overseeing AI?

Cooley LLP

+ Follow Contact

Send

Embed

Cooley LLP

Is there a hotter topic in the business world than AI? AI offers major opportunities for progress and productivity gains, but substantial risks as well. According to FactSet, 179 companies in the S&P 500 used the term “AI” during their earnings call for the fourth quarter of 2023, well above the 5-year average of 73. Among these companies, “the average number of times ‘AI’ was mentioned on their earnings calls was 13, while the median number of times ‘AI’ was mentioned on their earnings calls was 5. The term ‘AI’ was mentioned more than 50 times on the earnings calls of nine S&P 500 companies.” Similarly, Bloomberg reports that “[a]t least 203, or 41%, of the S&P 500 companies mentioned AI in their most recent 10-K report, Bloomberg Law’s review found. That’s up from 35% in 2022 and 28% in 2021. A majority of the disclosures focused on the risks of the technology, while others focused on its benefit to their business.” One of the many challenges that AI presents is on the corporate governance front, in particular board oversight, a topic addressed in this recent paper from ISS, AI Governance Appears on Corporate Radar. For the paper, ISS examined discussions of board oversight and director AI skills in proxy statements filed by S&P 500 companies from September 2022 through September 2023 to “assess how boards may evolve to manage and oversee this new area of potential risks and opportunities.”

SideBar

The appearance of AI as a topic in risk factors has become more common, according to this September 2023 article in Bloomberg, ANALYSIS: The AI Risks That Are Keeping Companies Up at Night. The author examined recent risk factor sections of Forms 10-K to identify AI risks. She found 151 filings in the preceding six months that identified 171 perceived AI-related risks. What were the top two AI-related risks mentioned? According to the author, “poor operational use” (20%) and “competitor’s advantage with AI” (19%), risks that were identified not just by tech companies but also by many brick-and-mortar stores. In addition, 16% cited “pending regulation” as a risk that might limit the company’s AI potential, while 13% expressed concern that AI might turn out to be a poor investment. Nine percent were worried that problems with AI-generated information could damage their reputations. Other concerns expressed were cyberattacks (7%), legal liability (7%), hiring AI-skilled labor (3%), loss of intellectual property (2%) and other (2%).

Board Oversight

What are indicia of “board oversight”? For purposes of this analysis, ISS considered these proxy disclosures to reflect oversight of AI: “(1) the full board or a specific committee either has oversight responsibility of AI or AI was mentioned as one of the topics evaluated by the board or the committee during the year, (2) at least one director has expertise in the field of AI, or (3) the company has established an AI ethics board or a similar governing body tasked with overseeing AI-related topics.” ISS did not include as an indication of oversight references to AI in business strategy or executive officer expertise. You may be surprised at the distribution among these three categories: ISS found that, among the S&P 500, “13% of companies have at least one director with AI expertise on the board, compared with 1.6% with explicit board or committee oversight of AI and 0.8% with an AI ethics board.”

ISS found that over 15% of companies in the S&P 500 disclosed board oversight of AI, including 38% of companies in the Information Technology sector, 18% of companies in Health Care and 15% of companies in each of the Communication Services and Consumer Discretionary sectors. ISS expects more explicit disclosure about board oversight in these sectors in the future.

SideBar

Recently, SEC officials have been raising red flags in speeches about “AI-washing”—apparently, “-washing” is the securities fraud equivalent of “-gate” for political scandals. In January this year, in remarks at an event hosted by Public Citizen reported by law.com, SEC Chair Gary Gensler cautioned companies to be careful about making false claims about their use of AI: “Companies should be ‘truthful about what they’re saying about their claims’….They should also ‘talk about the risks’ of using AI ‘and how they manage their risk,’” Gensler said. And in February, in remarks at Yale Law School, Gensler observed that, whenever there is a buzzy new technology, there are also often false claims about its use. But if “a company is raising money from the public,” Gensler cautioned, the company “needs to be truthful about its use of AI and associated risk.” He noted that “[s]ome in Congress have proposed imposing strict liability on the use of AI models.” He continued:

“As AI disclosures by SEC registrants increase, the basics of good securities lawyering still apply. Claims about prospects should have a reasonable basis, and investors should be told that basis. When disclosing material risks about AI—and a company may face multiple risks, including operational, legal, and competitive—investors benefit from disclosures particularized to the company, not from boilerplate language. Companies should ask themselves some basic questions, such as: ‘If we are discussing AI in earnings calls or having extensive discussions with the board, is it potentially material?’ These disclosure considerations may require companies to define for investors what they mean when referring to AI. For instance, how and where is it being used in the company? Is it being developed by the issuer or supplied by others? Investment advisers or broker-dealers also should not mislead the public by saying they are using an AI model when they are not, nor say they are using an AI model in a particular way but not do so. Such AI washing, whether it’s by companies raising money or financial intermediaries, such as investment advisers and broker-dealers, may violate the securities laws.” (See this PubCo post.)

Similarly, in April remarks at a Program on Corporate Compliance and Enforcement, SEC Enforcement Director Gurbir Grewal cited several statistics showing the immense importance that investors were attributing to AI: “according to a recent survey, 61% of investors believe that faster adoption of AI is very, or extremely, important to a company’s value. That jumps to 85% when including investors who believe it is moderately important.” As a result, there may well be a “perfect storm…brewing around AI.” The staff’s experience with ESG could be instructive he suggested: when institutional investors began to indicate interest in companies with ESG strategies, “companies had meaningful financial incentives to exaggerate, or make misleading statements about, their supposed ESG activities or products. After all, saying that you have an investment strategy or business plan that incorporates ESG considerations is pretty easy; creating one and sticking to it is another matter.” In recent years, the SEC has brought several enforcement actions against this type of misconduct.

And the SEC has begun to see similar misleading statements with regard to AI and has brought an action against two registered investment advisers for making false and misleading statements claiming AI capabilities that, the SEC charged, they did not have. Grewal suggested that advisers “[t]ake a step back, and ask yourselves: do these representations accurately reflect what we are doing or are they simply aspirational? If it’s the latter, your actions may constitute the type of ‘AI-washing’ that violates the federal securities laws.” And the same may well apply to public companies that disclose AI-related information. In that case, he advises, companies must ensure that their disclosures are not materially false or misleading, particularly as AI-related disclosures by public companies are increasing. He advises companies and their advisors to adhere to general principles of “proactive compliance”: educate themselves about emerging and heightened AI risk areas as they relate to their businesses; engage with personnel inside the company “to learn how AI intersects with their activities, strategies, risks, financial incentives, and so on”; and execute by updating policies and procedures and internal controls specific to the company and effectively implementing those policies and procedures.

Full board/committee. Among the S&P 500, ISS found that disclosure of full board or committee oversight of AI was not at all common, with just 1.6% of the S&P 500 providing specific disclosure. Companies in the Financials sector most frequently (4.2%) disclosed AI oversight responsibility at either the level of the full board or a specific committee, followed by InfoTech and Health Care both at 3.0% and Industrials at 1.3%. When a board committee has been assigned responsibility for AI oversight, ISS observed that the responsibility was often delegated to an existing committee, such as the audit committee, which may have also recently been handed responsibility for cybersecurity oversight. (All of which may explain why the audit committee is often referred to as the “kitchen sink of the board.” See this PubCo post.) Other committees with AI oversight responsibility may include a dedicated technology committee, a committee overseeing public policy matters and/or environmental and social risk, regulatory issues, privacy or risk management.

With regard to ISS’s attribution of board oversight as a result of mentions of board or committee discussion of AI, “ISS found that some companies included a discussion of non-financial regulatory risks, which include responsible AI use, while most company disclosures simply disclosed that “the board is responsible for constantly evaluating the competitive landscape and keeping pace with investments in the company’s business offerings and technology, which include AI.”

Director expertise. ISS found that board expertise was the “most common evidence of a board’s readiness to oversee AI-related risks and opportunities.” What were the indicia of board expertise? In its analysis, ISS included current or past employment with companies in AI or relevant to the AI industry, employment titles related to AI, director at companies in AI or relevant industry, AI Certification, and committee or board member with AI oversight. To no one’s amazement, the InfoTech sector was tops, with 30% of S&P 500 InfoTech companies having at least one director with AI-related expertise, followed by the Consumer Discretionary (mostly cars and components) and Health Care (primarily equipment and services) sectors, both with 15% of boards having at least one director with AI expertise.

AI ethics and review board. While it’s not exactly oversight at the board level, ISS viewed the organization of a multi-disciplinary ethics or review board to oversee AI as an indication of “a systemic and organizational oversight mechanism relating to this emerging technology.” ISS found these types of boards disclosed in two sectors: Communication Services (5%) and InfoTech (4.5%). The common element that ISS identified among these boards was the “presence of a multi-disciplinary group to ensure an ethical approach to AI. More specifically to Communication Services, disclosure for the AI ethics board was part of a risk assessment framework, similar to disclosures for board audit committees.”

Conclusion

ISS concluded that, with the expansion of AI, institutional investors may well expect companies, particularly those in industries more heavily impacted by AI, to establish appropriate processes for board oversight of AI risks and opportunities, including disclosure of “relevant board skills and oversight responsibilities.” According to ISS, at least four shareholder proposals already been submitted this season asking for “greater transparency on the use and impact of AI technology.”

[View source.]

Send Print Report

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.