Legitimacy Without Accountability: AI in the Board Pack

Board oversight of AI usually starts with the systems a company deploys. It rarely starts with the documents those systems quietly place in front of the board. That is the gap. An analyst note, an audit opinion, an outside expert’s memo have always carried two things at once: legitimacy, which makes a reader take them seriously, and accountability, which means someone with a name and a professional standard answers if they are wrong. AI can now produce the first without the second.

The result is a new kind of governance risk that does not show up in an AI inventory. Nothing malfunctions. A document simply arrives in the board pack looking like the kind of document directors have learned to trust, and it gets relied on. This essay explains how legitimacy and accountability came apart, what that looks like inside a real decision, and what boards and audit committees can do to put the two back together.

Why did institutional symbols used to be trustworthy?

The lab coat, the audit report, the sell-side note and the fairness opinion earned their authority the slow way. Each sat on top of a structure: a named author, a professional standard of care, exposure to consequence if the work was negligent, and a channel through which the work could be challenged. A director reading an outside analyst’s view could discount it, question it or ignore it, but the director knew who wrote it, under what obligations, and what that person stood to lose by getting it wrong.

Over time, readers stopped checking the structure and started trusting the symbol. That was efficient. The format of a document became a reasonable shortcut for its reliability, because the format was hard to produce without the structure behind it. Formatting a credible equity research note took an equity research department.

That shortcut no longer holds. A language model can produce the format in minutes: the confident summary, the charts, the hedged conclusions, the citation style, the voice. What it cannot produce is the structure. No one signs it. No standard of care governs it. No one’s reputation or license is exposed. And unless someone builds one, there is no channel for challenge.

What does legitimacy without accountability look like in a board pack?

Consider a composite case drawn from patterns that are becoming common. A mid-sized industrial company is preparing a board decision on a large capacity expansion. A strategy analyst, short on time, asks an AI tool for a market outlook “in the style of an independent sector note.” The output is polished. It reads like the work of a respected outside house. The analyst shares it with a colleague as useful background.

Three weeks later, two charts and a paragraph from that output appear in the board pack under the heading “External perspective.” No one intended to mislead. The heading was reused from a previous pack, and the content looked the part. In the meeting, two directors cite the external view as one of the reasons they are comfortable with the demand assumptions. The expansion is approved.

Nothing in that chain was dishonest, and that is the point. The document’s legitimacy came from its look. Its accountability came from nowhere. If the demand assumptions turn out to be wrong, the board will discover that the “external perspective” it relied on had no author who could explain it, no professional who stood behind it, and no record of how it was produced. The board did not lower its standards. It applied its usual standards to a symbol that had stopped meaning what it used to mean.

Is this just automation bias with a new name?

Partly, but the board version deserves its own treatment. Automation bias usually describes an individual who defers to a system’s output in the moment. The board-pack problem is institutional. The output has already passed through several hands, each of whom trusted it a little more because the previous person had forwarded it. By the time it reaches the board, it carries the accumulated credibility of the management process, and directors are looking at it through the governance lens they apply to vetted material.

Directors are also structurally exposed to this. They see a small slice of the company’s information, curated by management, on a fixed calendar. They are trained to rely on what management puts in front of them and to probe selectively, because no board can re-perform every analysis. That reliance is legitimate and necessary. It is also exactly the trust a well-formatted, unowned document exploits, because the board’s habit of probing selectively tends to skip material that already looks independent.

There is also a difference in consequence. A reviewer who defers to a recommendation affects one case. A board that relies on an unaccountable document affects the capital allocation, risk posture or strategy of the whole enterprise, and it does so in a forum whose minutes will later be read as evidence of what the board knew and relied on.

What does human authorship mean for documents that reach the board?

Human authorship is the idea that every consequential decision, and every document that materially shapes one, should be traceable to a person who can explain it and who owns it. It is not a ban on AI. A document can be heavily AI-assisted and still have a human author, provided someone has reviewed it to the standard the decision demands, can defend its reasoning, and has put their name on it.

That distinction matters because the opposite failure is also real. A board that treats every AI-assisted document as suspect will slow itself down and push the use of AI out of sight, which is worse. The goal is not to remove AI from the board pack. It is to make sure that nothing reaches the board looking more accountable than it is.

As one character in a recent book observes, “A review step is not judgment. Approval is not authorship.” A document that has merely passed through management is not the same as a document someone authored.

How can boards and audit committees unbundle legitimacy from accountability?

The practical work is to stop letting format stand in for structure and to ask for the structure directly. Five practices make a real difference.

Label provenance in the board pack. Every substantive document should carry a simple statement of how it was produced: human-authored, AI-assisted with a named owner, or AI-generated and unreviewed. The third category should rarely reach the board, and when it does it should be labeled as such.

Reserve the word “external” for accountable external parties. If no outside firm or named expert stands behind a view, it is not an external perspective, however much it reads like one. This one rule would have stopped the composite case above.

Ask the four structural questions. For any document the board is relying on: who wrote it, under what standard, who answers if it is wrong, and how can the board challenge it? If management cannot answer all four, the document is background, not evidence.

Extend management’s sign-off to AI-assisted content. Whatever certification or representation management already provides on board materials should explicitly cover content produced with AI tools. The audit committee is the natural owner of that expectation.

Record what the board relied on. Minutes that note which documents carried weight in a decision create a record that can be tested later. They also make directors more careful, in a healthy way, about what they cite.

None of these require new technology. They require the board to treat provenance as part of the information it receives, not as an administrative detail beneath it.

Frequently asked questions

Should boards ban AI-generated content from board materials? No. A ban would push AI use out of sight and remove useful analysis. The better standard is disclosure and ownership: every substantive document should state how it was produced and name a person who can explain and defend it. Unreviewed AI output can inform management, but it should not reach the board as evidence.

What should an audit committee ask about AI in board reporting? Start with provenance. Ask management which board materials were produced or assisted by AI, who reviewed them, and to what standard. Ask whether existing sign-offs cover AI-assisted content. Then ask for one example traced end to end, from the first prompt to the board pack, to see how the process actually works.

How is AI legitimacy different from AI accuracy? Accuracy is whether the content is right. Legitimacy is whether readers treat it as authoritative. An AI document can be accurate and still dangerous if it carries authority no one is accountable for, because the board loses the ability to question its source, test its reasoning or assign responsibility when it turns out to be wrong.

Who is accountable when a board relies on an AI-generated document? The board and management remain accountable. AI tools do not carry fiduciary duties, professional standards or legal exposure. That is why provenance matters: if no named person stood behind the document, the accountability defaults to the directors who relied on it and the executives who placed it in the pack.

---

Boards and audit committees that want to review how AI-produced material enters their governance process can start a conversation with Anker Bioss about governing judgment and accountability in AI-shaped work. Related reading: The New Authority: When AI Inherits Credibility and Author, Not Approver.

Jose J. Ruiz is CEO and Managing Partner of Alder Koten and Chairman of Anker Bioss. He develops these ideas at book length in AI in the Org Chart: A Leadership Guide to Implementing AI Without Losing Human Judgment, Accountability, and Trust, published by Elavant Press and available on Amazon.