The Organisation for Economic Co-operation and Development (OECD) is an international organisation, as well as a forum and knowledge hub focused on designing better policies for better lives and the global standard setter in the field of corporate governance.
This survey is conducted by the OECD to understand how corporate governance practices are evolving with the growing use of artificial intelligence (AI) and to inform future policy discussions. It will also contribute to the effective implementation of the G20/OECD Principles of Corporate Governance, which provide internationally recognised guidance to strengthen corporate governance frameworks and practices. Where there is a diversity of views within the company, respondents are encouraged to base their answers, as much as possible, on positions taken by the board or senior company management.
The questionnaire consists of 20 short multiple-choice questions and is not expected to take substantial time to complete.
The aggregate results of the survey will contribute to a report summarising the main findings. This report will be shared with the OECD Corporate Governance Committee and used to inform policy discussions around the effective implementation of corporate governance policies and frameworks in response to the growing use of AI.
If you have any questions, please do not hesitate to contact the OECD Capital Markets and Financial Institutions Division: Takashi Sudo and Manjuni Fernando at oecdsurveyaicg@oecd.org.
Thank you in advance for taking the time to fill this survey.
Definition
For the purpose of the survey, the following definition in OECD AI Principles is used: An AI system is a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.
Personal Data Protection Notice
Please note that the survey will collect personal data. Your answers and data provided will only be accessible and reviewed by the policy analysts working on this project. The information and views shared by companies will be integrated in the report in unattributed form, both aggregated and anonymous. The personal data collected through this survey will be securely stored on a platform managed by OECD, and retained for one year after the adoption of the final report.
The OECD is committed to protecting the personal data it processes, in accordance with its Personal Data Protection Rules. Under the Rules, you have rights to access and rectify your personal data, as well as to object to its processing, request erasure, and obtain data portability in certain circumstances. To exercise these rights in connection with this survey, please contact the OECD Capital Markets and Financial Institutions Division: Takashi Sudo mailto:and Manjuni Fernando at oecdsurveyaicg@oecd.org.
Please indicate your organisation name: International Corporate Governance Network (ICGN)
Please indicate the contact person: Jakub Brejdak
Please indicate the contact person’s email address: policy@icgn.org
Board oversight, competencies and risk management
Discussion by board
- Over the past 12 months, which AI-related topics have been discussed at the board level? (Select up to 3)
☐ Corporate strategy and integration of AI (e.g. use cases, cost-effectiveness, AI implementation roadmap)
☐ Investment in AI technologies or infrastructure
☐ AI‑related risks and associated risk management and control frameworks (e.g. operational risks, reputational risks)
☐ Compliance with AI-related regulations and impact of AI regulatory developments
☐ Data governance, privacy issues and cybersecurity
☐ Responsible AI use (e.g. fairness, bias, accountability)
☐ Human resources implications (e.g. automation, redundancy risks, recruitment, skills displacement, organisational restructuring)
☐ Investor questions regarding AI and AI-related disclosure
☐ AI has not been discussed at board level
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
Which AI-related topics do you expect companies to discuss at the board level? You may either select up to three items from the list above or provide brief perspectives.
| Companies should discuss AI at board level where it is material to strategy, business model, risk or stakeholder outcomes. Key topics should include how AI is being used or developed across the business; whether it creates competitive opportunities or dependencies; and whether the board has sufficient knowledge to oversee related risks. Boards should also consider responsible AI policies, accountability structures, data governance, privacy, cyber security, IP risks, reliance on third-party AI tools, workforce impacts, human oversight, environmental impacts and regulatory compliance. From an investor perspective, the board should be able to explain how AI systems are designed, trained, tested and monitored, and how management mitigates risks to the company, people and society. Companies should also assess stakeholder and human rights impacts in a sufficiently granular way. Employees, customers and communities are not homogenous groups, and AI may affect workers, consumers, children, women, people with lower literacy, marginalised groups and other stakeholders differently. Risk assessments should therefore consider immediate, cumulative and longer-term impacts where relevant, including the potential for AI systems to amplify existing inequalities or bias. Furthermore, in many emerging market economies, technological advancements and automation-driven efficiencies are often perceived by senior management as a threat to established ways of working rather than as an opportunity to enhance long-term competitiveness. Such resistance can slow the pace of innovation and limit the benefits that AI can deliver. Consequently, boards should actively assess not only where AI can be deployed to create value but also whether the necessary cultural shift is taking place within the organization. This includes evaluating management’s commitment to AI adoption, the willingness of employees and leadership teams to embrace new technologies, and the extent to which AI initiatives are being integrated across business functions. By encouraging a culture that is receptive to innovation and continuous adaptation, boards can help ensure that companies are better positioned to capture the opportunities presented by AI while remaining competitive in an increasingly technology-driven environment. |
- Does the board receive regular reporting or updates on AI-related developments, risks, or strategy?
☐ Yes — on a recurring basis as part of board meetings
☐ Yes — on a recurring basis at board meetings, with additional ad hoc updates as needed
☐ Yes — but on an ad hoc basis only
☐ No
☐ Not applicable
For ICGN/investors
What are your expectations regarding the board receiving regular reporting or updates on AI-related developments, risks, or strategy? You may provide brief perspectives.
| The board should receive regular and sufficiently detailed updates on AI where it is material to the company’s strategy, operations or risk profile. These updates should not be limited to technical developments, but should cover business opportunities, key use cases, risk assessments, incidents or controversies, third-party dependencies, regulatory developments and impacts on employees, customers and other stakeholders. Where companies are materially reliant on AI systems, board reporting should also cover business continuity planning for AI-related disruption, including AI outages, model failures, cyber compromise of AI systems, loss of access to third-party AI services, and failure of AI-enabled critical business processes. Reporting should enable the board to challenge management on whether AI systems are being developed and deployed responsibly, with appropriate human oversight, testing, monitoring and accountability. The frequency and depth of reporting should be proportionate to the company’s exposure to AI, but investors would expect AI-related developments to be integrated into existing strategy, risk, audit, technology or sustainability reporting to the board, rather than treated as an isolated issue. In industries where failure to adopt AI could create significant obsolescence risks, or where AI deployment has the potential to deliver material improvements in efficiency, productivity, or competitiveness, companies may need to accelerate the scaling of AI systems and capabilities. In such cases, board oversight becomes even more critical. Boards should play an active role in ensuring that the pressure to achieve rapid AI adoption does not result in shortcuts that compromise ethical standards, regulatory compliance, data privacy, or risk management practices. As organizations navigate the transition, directors must balance the need for speed and innovation with appropriate governance safeguards, ensuring that AI initiatives are implemented responsibly and in a manner that protects the long-term interests of shareholders and other stakeholders. |
- Over the past 12 months, how often are AI-related matters discussed at board level?
☐ Very frequently (five times or more)
☐ Frequently (three or four times)
☐ Occasionally (once or twice)
☐ AI has not been discussed at board level
For ICGN/investors
What are your expectations regarding how often AI-related matters are discussed at the board level? You may either select item from the list above or provide brief perspectives.
| AI-related matters should be discussed at board level with a frequency proportionate to the company’s exposure to AI and the materiality of related risks and opportunities. For companies developing AI, deploying it at scale, or using it in sensitive areas such as employment, customer decision-making, financial services, healthcare or critical infrastructure, AI should be a regular board agenda item and integrated into strategy and risk discussions. For companies with more limited exposure, periodic updates may be sufficient, but the board should still ensure that AI risks are monitored and escalated where needed. Investors would not necessarily expect a fixed universal cadence, but they would expect evidence that the board is informed, engaged and able to respond promptly to significant AI-related developments, incidents or regulatory changes. |
Board oversight structure
- Does your company have a dedicated committee, executive function, or responsible officer overseeing AI-related issues, including risk management?
☐ Yes – Specific board committee (e.g. AI committee, digital committee)
☐ Yes – Oversight assigned to an existing committee (e.g. risk committee, technology committee, audit committee)
☐ Oversight handled by the full board
☐ Hybrid or shared responsibility between the board and one or more committees
☐ Yes – An executive function
☐ No specific oversight structure
☐ Other (please specify)
| If you select “Yes – Specific board committee (e.g. AI committee, digital committee)” or “Yes – Oversight assigned to an existing committee (e.g. risk committee, technology committee, audit committee)”, please provide the name of the committee. If you select “Hybrid or shared responsibility between the board and one or more committees”, please briefly describe how responsibilities are shared between the board and committee(s). If you select “Other”, please briefly explain. |
For ICGN/investors
What are your views on companies having a dedicated committee, executive function, or responsible officer overseeing AI-related issues, including risk management? You may provide brief perspectives.
| There is likely no one size fits all best approach to how AI oversight should be structured, in line with the ICGN Global Governance Principles, companies should structure this oversight in a way that most suits their specific circumstances. Depending on the company’s size, sector and AI exposure, oversight may most appropriately sit with the full board, an existing committee such as audit, risk or technology, or a dedicated committee where AI is strategically or operationally significant. Given the cross-cutting nature of AI risks, companies may also consider allocating oversight across different committees. For example, the compensation committee may be well placed to consider workforce and human capital impacts, while the audit or risk committee may retain oversight of cyber security, data governance, internal controls and related assurance. Companies should consider whether committee charters need to be updated to reflect these responsibilities. At management level, companies should identify a responsible executive function or officer with sufficient authority, expertise and access to the board. What matters most is not the title or structure, but whether accountability is clear, risks are escalated appropriately, and AI governance is embedded across strategy, risk management, compliance, data governance, human capital and stakeholder engagement. Dedicated structures may be particularly appropriate for companies developing AI systems or deploying AI at scale. |
Board competencies
- Does your company take specific measures to ensure that board members have sufficient understanding (AI literacy) to discuss AI-related risks and opportunities? (Select up to 3)
☐ Appointment of board members with AI or digital literacy (this does not necessarily require technical expertise)
☐ Board training or education programmes on AI or digital issues
☐ Briefings from external advisors or experts
☐ Briefings from management or internal technology teams
☐ No specific measures currently in place
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
What specific measures do you expect companies to take to ensure that board members have sufficient understanding (AI literacy) to discuss AI-related risks and opportunities? You may either select up to three items from the list above or provide brief perspectives.
| Companies should take practical steps to ensure that board members have sufficient AI literacy to provide effective oversight and challenge to management. This may include regular board training, briefings from internal technology, risk and legal teams, access to external experts, scenario-based discussions on AI use cases and risks, and periodic updates on regulatory, market and technological developments. Briefings from external advisors or experts can be particularly useful, but they should be contextualised to the company’s sector, scale, jurisdictions, business model and stage of development, rather than delivered as generic AI training. Boards should also assess whether they have the right mix of skills at board or committee level, recognising that not every director needs to be a technical expert, but the board collectively should understand the company’s material AI dependencies, opportunities and risks. For companies with significant AI exposure, AI literacy should be part of board effectiveness reviews, succession planning and ongoing director development. This is particularly relevant in emerging economies, where the corporate landscape is often dominated by founder-led or family-controlled businesses, and ownership may be less dispersed. In such environments, companies may operate in silos and exhibit limited transparency regarding their AI-related initiatives, investments, and strategic roadmaps. As a result, shareholders may have limited visibility into the risks, opportunities, and cost implications associated with AI adoption. To strengthen oversight, enhance transparency, and ensure prudent allocation of capital toward AI-related expenditures, having an independent board member with relevant AI expertise could be highly valuable. Such representation can provide objective guidance, challenge management assumptions where necessary, and help align AI investments with the long-term interests of shareholders. |
Use of AI in board activities
- Does your company use AI tools to support board-related activities, including the preparation of materials for board meetings, discussion during board meetings, or timely information sharing between board meetings (e.g. analysis, forecasting, scenario planning, or AI-generated advice or insights)? (Select all that apply)
☐ Yes – for board meeting preparation
☐ Yes – during board meetings
☐ Yes – between board meetings
☐ Under pilot testing – for board meeting preparation
☐ Under pilot testing – during board meetings
☐ Under pilot testing – between board meetings
☐ No
| If you select “Yes” or “Under pilot testing”, please briefly describe how AI tools are used. |
For ICGN/investors
What are your views on companies using AI tools to support board-related activities, including the preparation of materials for board meetings, discussion during board meetings, or timely information sharing between board meetings. You may provide brief perspectives.
| Where they deem it to be beneficial, companies may appropriately use AI tools to support board-related activities where this improves efficiency, quality of analysis or timely access to information, but such use should be subject to appropriate safeguards. AI should support, not replace, board judgement, deliberation and accountability. Companies should have clear policies on the use of AI in preparing board materials, including controls over data confidentiality, cyber security, accuracy, source verification and the treatment of privileged or price-sensitive information. Directors should be aware when AI has materially contributed to board papers, analysis or summaries, and management should remain accountable for the quality and reliability of information provided to the board. Particular caution is needed where AI tools are used to summarise complex issues, generate recommendations or support decision-making, as errors, omissions or bias could affect board oversight. |
- When AI-generated analysis, reports or advice is used to support board discussions, what measures are taken at board level, or expected by the board to be put in place by the company, to ensure independent judgement and accountability in decision-making? (Select all that apply)
☐ Board discussions on limitations of AI outputs
☐ Human review and interpretation of AI outputs
☐ Cross-checking AI outputs with alternative sources or analyses
☐ Establishing internal governance or approval processes
☐ Documentation of assumptions, limitations, or confidence levels of AI outputs provided to the board
☐ No formal mechanism
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
When AI-generated analysis, reports or advice is used to support board discussions, what measures do you expect companies to take at the board level, or to be put in place by the company, to ensure independent judgement and accountability in decision-making? You may either select items from the list above or provide brief perspectives.
| Where AI-generated analysis, reports or advice are used to support board discussions, companies should ensure that human judgement and accountability remain clear. AI outputs should be treated as inputs to decision-making, not as substitutes for management advice or board deliberation. Companies should have controls requiring appropriate human review, source verification, testing for accuracy and bias, and clear documentation of where AI has been used in materials or recommendations. Boards should be able to challenge the assumptions, data sources and limitations behind AI-generated outputs, particularly for material or high-risk decisions. Accountability must remain with management for the information provided to the board, and with directors for the decisions they take. Companies must also ensure that confidentiality, data protection and market-sensitive information are properly safeguarded. |
Risk management
- How are AI-related risks integrated into the company’s enterprise risk management framework? (Select all that apply)
☐ AI-related risks included in the enterprise risk register
☐ Oversight by an AI, digital, risk, technology or audit committee (or equivalent body)
☐ AI-specific risk management policies
☐ Managed within broader digital or technology risk frameworks
☐ Internal controls or assurance processes specific to AI risks (e.g. testing, monitoring, internal audit review)
☐ AI-related risks not yet formally integrated
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
How do you expect companies to integrate AI-related risks into the company’s enterprise risk management framework? You may either select items from the list above or provide brief perspectives.
| Companies should integrate material AI-related risks into their enterprise risk management framework rather than treating AI as a standalone technology issue. This should include identifying where AI is used or developed across the business, assessing the materiality of related risks, assigning clear ownership, and establishing appropriate controls, escalation processes and board reporting. Companies should pay particular attention to proactive risk identification. While many companies may have established processes for managing risks once identified, AI-related or AI-generated risks may not always be captured effectively through traditional risk identification mechanisms, particularly where AI use is fast-moving, experimental or embedded in business processes. Relevant risks may include data privacy, cyber security, bias and discrimination, inaccurate or misleading outputs, third-party dependencies, IP infringement, regulatory compliance, workforce impacts and reputational harm. Effective risk management should also consider how AI may create broader dependencies and vulnerabilities that are material to corporate strategy and resilience. For example, reliance on hyperscale cloud, compute infrastructure, foundation models or other third-party AI providers may create exposure to operational outages, concentration risk, changes in pricing or access, and potential cross-sector disruption. The approach should be risk-based and proportionate, with enhanced due diligence for higher-risk use cases or AI deployed at scale. Companies should also monitor AI systems throughout their lifecycle, including testing, validation, incident reporting and periodic review. This should be supported by a strong speak-up culture and clear escalation channels, particularly where AI development or deployment takes place behind information barriers, or in highly innovative and competitive parts of the business. Employees closest to the technology may be best placed to identify emerging risks, and companies should ensure that concerns can be raised, assessed and escalated appropriately to senior management and, where material, the board. |
Internal audit and controls
- What role does internal audit play in reviewing AI-related systems and governance? (Select all that apply)
☐ Reviewing internal controls over AI systems
☐ Assessing model governance and validation processes
☐ Reviewing data governance and data integrity practices
☐ Reviewing compliance with internal policies
☐ No specific internal audit role currently in place
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
What role do you expect internal audit to play in reviewing AI-related systems and governance? You may select items from the list above or provide brief perspectives.
| Where there is a material risk, it may be appropriate for internal audit to provide independent assurance that AI governance and controls are working as intended. This could include reviewing whether AI use cases are identified, risk-assessed and approved; whether controls address data quality, privacy, cyber security, bias, human oversight, third-party tools and regulatory compliance; and whether incidents are escalated appropriately. Internal audit could also test whether accountability is clear and whether board reporting gives a reliable picture of material AI risks. For higher-risk AI applications, specialist expertise may be needed. For other companies, relying on external assurance providers may be more appropriate, either in addition to internal audit or instead of it, depending on the appropriateness of the skills and resources of the internal audit function and the level of risk identified by the Board. Investors can assess a company’s commitment to responsible AI governance through external certifications and assurance mechanisms. One example is ISO/IEC 42001, the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS). Such certifications can provide an independent indication that a company has adopted structured processes for managing AI-related risks, governance, ethics, and compliance. By evaluating the extent to which a company’s operations, business units, or AI applications are covered by these certifications, shareholders can gain insight into the seriousness with which management approaches AI oversight. While certifications should not be viewed as a substitute for effective governance, they can serve as a useful benchmark for assessing the maturity of a company’s AI risk management framework and its commitment to responsible AI deployment. |
Data governance and privacy
- How does your company ensure appropriate data governance, privacy protection, cybersecurity, ethics in the use of AI? (Select all that apply)
☐ Data governance policies (including data sovereignty, such as data localisation)
☐ Privacy and data protection compliance frameworks
☐ Cybersecurity control policies
☐ Ethics policies
☐ Board oversight
☐ Oversight by an AI, digital, risk, technology or audit committee (or equivalent body)
☐ Reviews by internal auditor
☐ Not applicable
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
How do you expect companies to ensure appropriate data governance, privacy protection, cybersecurity, ethics in the use of AI? You may select items from the list above or provide brief perspectives.
| Companies should embed data governance, privacy, cybersecurity and ethics into the full AI lifecycle, from design or procurement through to deployment and monitoring. This should include clear policies on permitted AI use, data quality and provenance, access controls, information security, retention of personal or sensitive data, and the use of third-party AI tools. Companies should also address the risk of “shadow AI”, where employees use unsanctioned AI tools, chatbots, browser plugins or autonomous agents without appropriate IT, legal or security oversight. This can create risks of data leakage, exposure of confidential information or intellectual property, and compliance breaches. Companies should assess higher-risk AI applications before deployment, including testing for bias, discriminatory outcomes, privacy risks and cyber vulnerabilities. Appropriate human oversight should be in place, especially where AI affects employees, customers or other stakeholders. Companies should also recognise that AI is increasingly used by employees across the organisation, not only by specialist teams or senior management. Appropriate training should therefore be provided to operational owners and front-line users, so they can identify, mitigate and escalate AI-related risks, including risks arising from unsanctioned or inappropriate AI use. This should be also supported by clear mechanisms for reporting concerns, handling complaints and collecting user feedback on AI-related issues. This should include appropriate escalation channels and, where relevant, integration with existing whistleblowing policies and grievance mechanisms. |
Framework on board oversight, competencies and risk management
- In your view, is additional guidance on AI-related corporate governance frameworks covering board oversight, board competencies, and risk management likely to be needed? (Select all that apply)
☐ New regulatory requirements may be necessary
☐ Clarification of existing frameworks may be needed
☐ Additional voluntary guidance may be helpful
☐ Existing frameworks and guidance may be sufficient
☐ No view / Unsure at this stage
| Please briefly explain, including which areas you consider particularly important. |
For ICGN/investors
What are your views on the need for additional guidance on AI-related corporate governance frameworks, covering board oversight, board competencies, and risk management? You may select items from the list above or provide brief perspectives.
| AI presents a new topic to be assessed, risk managed and governed, that governance should seek the same outcomes as management, control and oversight of any other material business risk. Additional guidance might be helpful if it is practical, risk-based and aligned with existing corporate governance principles. In some markets, this could be reflected in national corporate governance codes or related guidance, which may need updating as AI becomes more relevant to board oversight, board competencies and risk management. The focus should be on clear accountability, informed board challenge, proportionate controls, human judgement, transparency and escalation of material risks, while avoiding a one-size-fits-all model. Broader AI frameworks may also be relevant: international principles, such as the OECD AI Principles, can support common expectations for responsible AI, while binding regulation, such as the EU AI Act, may help raise baseline standards for AI quality, safety and risk management. |
Disclosure and investor engagement
AI-related disclosure
- Does your company currently disclose any information related to AI? This may include the use of AI in operations, AI-related strategy, risk management, governance, oversight arrangements and related targets.
☐ Yes
☐ No
| Provide web addresses (URLs) to relevant reports or disclosures. (If the company name field was left blank, you may omit the hyperlinks and provide a brief description only.) |
For ICGN/investors
Not applicable
Location of disclosure
- In which reporting documents is AI-related information disclosed? (Select all that apply)
☐ Regulated mainstream report (e.g. annual report, mandatory financial filings required under periodic disclosure obligations)
☐ Integrated report (a voluntary report that combines financial and non‑financial information)
☐ Sustainability report (a report focusing on environmental, social, and governance (ESG) topics)
☐ Digital report (a report focused on the company’s digital strategy, including the use of digital technologies)
☐ Corporate governance report
☐ Investor presentations
☐ Company website
☐ Other (please specify)
| If you select “Other”, please specify the name of document(s). (If the company name field was left blank, the reference documents or hyperlinks may be skipped.) |
For ICGN/investors
In which reporting documents do you expect AI-related information to be disclosed? You may either select items from the list above or provide brief perspectives.
| Where material, AI related information should be integrated into the relevant parts of all aspects of company reporting – as for any other material risk. It may be appropriate to include relevant material information related to the use and governance of AI in all of the above documents. Investors require sufficient disclosure to assess both the opportunities and risks arising from AI adoption. The objective should not be to create a separate reporting framework for AI, but to ensure that material AI-related information is disclosed through the reporting channels most relevant to investors. Consistent and decision-useful disclosures can improve transparency around AI investments, governance arrangements, risk management practices, and expected business outcomes, enabling shareholders to better evaluate management’s stewardship and the long-term sustainability of value creation. Where AI-related opportunities or risks are material to a company’s operations, strategy, or competitive position, they should be reflected in regulated mainstream reports, including annual reports and other mandatory filings. Industry-specific disclosures may also be appropriate where AI adoption has the potential to materially affect business models, operational resilience, or long-term value creation. |
- If AI-related information is disclosed in regulated mainstream reports (e.g. annual report), in which section(s) is it typically included? (Select all that apply)
☐ Business strategy
☐ Risk factors
☐ Management discussion & analysis (MD&A)
☐ Corporate governance section
☐ Sustainability section
☐ Other (please specify)
| If you select “Other”, please specify the section or part and the type of report (e.g. director’s introduction in the annual report for FY2025) |
For ICGN/investors
When AI-related information is disclosed in regulated mainstream reports (e.g. annual report), in which section(s) do you expect it to be included? You may either select items from the list above or provide brief perspectives.
| This will depend on the specific use of AI in the company, it should be reported on in all material areas as per any other business risk or opportunity and any other material financial reporting or strategic impact. The location of AI-related disclosures should ultimately reflect the nature and materiality of AI’s impact on the business. Given that AI can influence strategy, risk management, governance, operations, and long-term value creation, relevant information may need to be incorporated across multiple sections of a regulated mainstream report rather than being confined to a standalone disclosure. At a minimum, companies should address AI within the risk factors section, including an assessment of whether AI-related risks and opportunities are material to the business. Where AI is expected to materially influence competitive positioning, operating efficiency, capital allocation, or business model evolution, corresponding discussion should also be included within the business strategy and MD&A sections. Similarly, disclosures relating to board oversight, accountability, and governance frameworks should be reflected in the corporate governance section. This integrated approach would provide investors with a more complete and decision-useful understanding of how AI is affecting the company’s long-term prospects. |
Disclosure framework
- In your view, is the current disclosure framework in your jurisdiction sufficient to enable appropriate disclosure of AI-related matters?
☐ New regulatory requirements may be necessary
☐ Clarification of existing frameworks may be needed
☐ Additional voluntary guidance may be helpful
☐ Existing frameworks and guidance may be sufficient
☐ No view / Unsure at this stage
| Please briefly explain, including which areas you consider particularly important. |
For ICGN/investors
What are your views on whether current disclosure framework is sufficient to enable appropriate disclosure of AI-related matters? You may either select item from the list above or provide brief perspectives.
| AI should be integrated into existing corporate reporting frameworks based on the same principle that applies to any other business matter: if it is financially material, it should be reported. Material AI-related risks, opportunities, governance, strategy and impacts should therefore already be reflected, where relevant, in financial statements, strategic reports, directors’ reports and other corporate disclosures. However, given the pace of technological change and the novelty of many AI-related issues, additional guidance, and potentially new reporting standards over time, may be needed to promote consistent, decision-useful and comparable disclosures. We see value in further clarification because, while many companies now reference AI-related risks, the quality and specificity of disclosure varies significantly. Some companies present AI mainly as a factor that may exacerbate established risks, such as cyber security, while more mature reporting identifies AI-specific risks, including bias, discrimination, data privacy, model failures and misuse. This variation can make it difficult for investors to assess a company’s true AI exposure or compare practices across companies, including within the same sector. Targeted guidance could help establish a more consistent baseline for identifying and disclosing AI-related risks, while still allowing companies flexibility to reflect their business model and exposure. |
Investor engagement
- How frequently have investors raised AI-related governance, strategy, or risk management questions during engagement?
☐ About once per week or more
☐ A few times per month
☐ About once per month
☐ Once every few months
☐ About once per year
☐ Rarely
☐ Not applicable
For ICGN
What are your views on the frequency of investor engagement related to AI-related governance, strategy, or risk management? You may provide brief perspectives.
| The frequency of engagement should be proportionate to the company’s exposure to AI and the materiality of related risks and opportunities. For companies developing AI systems, deploying AI at scale, or using AI in sensitive areas such as employment, customer decision-making, financial services, healthcare or critical infrastructure, we would expect AI governance to form part of regular stewardship dialogue. For companies with more limited exposure, engagement may be more periodic or triggered by material developments, incidents, controversies or regulatory changes. |
- Among AI‑related questions raised by investors, what are the most common themes? (Select up to 3)
☐ Board oversight of AI
☐ Corporate strategy and integration of AI
☐ Investment in AI technologies or infrastructure and its financial impact
☐ AI‑related risks and associated risk management and control frameworks (e.g. operational, reputational risks)
☐ Compliance with AI-related regulations
☐ Data governance, privacy and cybersecurity
☐ Responsible AI use (e.g. fairness, bias, accountability)
☐ Human resources implications (e.g. automation, redundancy risks, recruitment, skills displacement, organisational restructuring)
☐ Not applicable
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
What are the most common themes in AI-related questions during investor engagement? You may either select up to three items from the list above or provide brief perspectives.
| In practice, AI-related engagement often follows a two-step approach. First, investors seek to understand the company’s AI exposure, including key use cases, reliance on foundation models or third-party tools, types of data processed, involvement in high-risk systems and any AI-related incidents. Once exposure is understood, engagement can then focus on governance, strategy, risk management, public reporting and how responsible AI commitments are being operationalised in practice. The most common themes during investor engagement are likely to focus on whether companies have an appropriate and proportionate approach to responsible deployment, governance and oversight of AI. In engagement, companies could expect questions on how AI is linked to strategy and business model, how the board oversees AI-related risks and opportunities, and whether accountability is clear across the organisation. Other recurring areas include the robustness of risk management processes, data privacy and security, bias and non-discrimination, human oversight, third-party AI tools, workforce impacts, environmental impacts and regulatory compliance. For companies with significant AI exposure, investors may also seek assurance that AI systems are appropriately designed, trained, tested and monitored, and that material incidents or controversies are disclosed in a timely manner. |
Use of AI in disclosure preparation
- Does your company use AI tools to assist in preparing or validating disclosure documents?
☐ Yes – broadly used
☐ Yes – pilot testing or limited use
☐ No
| If yes, please briefly explain how you ensure accuracy and accountability (e.g. human review, approvals or controls) if applicable. |
For ICGN/investors
Not applicable
- If yes, please indicate areas of use (Select all that apply):
☐ Drafting narrative sections
☐ Summarisation of reports
☐ Data aggregation
☐ Data validation
☐ Consistency checks
☐ Regulatory compliance checks
☐ Translation or formatting
☐ Not applicable
☐ Other (please specify)
| If you select “Other”, please briefly describe the area of use and where relevant, the type of document(s). |
For ICGN/investors
What are your general views on companies’ use of AI in disclosure preparation? You may provide brief perspectives.
| Companies may use AI to support disclosure preparation, including drafting, summarising information, identifying inconsistencies or improving internal processes. However, AI should support, not replace, management judgement, board oversight or accountability for the final disclosure. Companies should have clear controls to ensure that AI-assisted disclosures are accurate, complete, balanced and based on verified sources. Particular care is needed to avoid generic language, omissions, hallucinations or selective presentation of information. Where AI is used in preparing material disclosures, companies should ensure appropriate human review, documentation, data protection and safeguards for confidential or market-sensitive information. The final responsibility for disclosure should remain with management and the board, with AI treated as a tool within a robust reporting and control environment. |
Future prospects
- How do you expect AI to influence corporate governance practices over the next decade? (Select up to 5)
☐ Increased board oversight of technology and AI-related risks
☐ More AI-driven decision-making within companies
☐ Greater demand for AI expertise on boards
☐ Improved risk management and monitoring capabilities
☐ Greater reliance on AI for internal controls, auditing and compliance functions
☐ Increased focus on data governance, privacy and cybersecurity
☐ Increased focus on responsible AI (e.g. fairness, bias, accountability)
☐ Increased regulatory and compliance requirements
☐ Changes in workforce oversight due to automation and skills displacement
☐ Enhanced AI-related disclosure and transparency expectations
☐ Greater shareholder engagement on AI-related issues
☐ Limited impact on corporate governance practices
☐ Uncertain / difficult to assess at this stage
☐ Other (please specify)
| If you select “Other”, please briefly explain. |
For ICGN/investors
How do you expect AI to influence corporate governance practices over the next decade? You may either select up to five items from the list above or provide brief perspectives.
| AI is likely to influence corporate governance both as a strategic issue for boards and as a tool used within governance processes. Over the next decade, boards will need to develop stronger oversight of technology-related risks, data governance, workforce impacts, human rights, cyber security and the use of third-party systems. AI may also change how companies prepare board materials, monitor risks, conduct internal audits, engage with stakeholders and prepare disclosures. However, these efficiencies should not weaken human judgement, accountability or transparency. As AI becomes more embedded in business models, investors will expect governance frameworks to evolve accordingly, with clearer board-level competencies, more robust risk management, and better disclosure of how AI is developed, deployed and controlled. The central governance challenge will be to support innovation while preserving trust, accountability and long-term value creation. |
