Board Oversight of AI

Short Answer

Board oversight of AI begins with the entity’s governing law, material uses and actual risk. Business Organizations Code § 21.419, added by SB 29 in 2025, supplies specified director presumptions for covered Texas corporations, including listed corporations and corporations that opt in through their governing documents. It is not a rule for every Texas entity. For a Delaware corporation, Marchand v. Barnhill illustrates oversight of a mission-critical risk; it is a Delaware decision, not a Texas AI duty. Public-company and investment-adviser statements about AI also face securities-law scrutiny. Directors need reporting that identifies material deployment, incidents and unresolved controls rather than a general assurance that the business has an AI policy.

Which Laws Apply

• Texas AI-specific: Texas Responsible Artificial Intelligence Governance Act (TRAIGA)’s defenses, which reward documented testing and internal review (Business and Commerce Code § 552.105(e)).
• Generally applicable Texas law: Business Organizations Code §§ 21.401 and 21.419 for corporate management and specified director presumptions; Business Organizations Code § 1.102 for internal-affairs law. Entity form and governing documents matter.
• Federal: securities disclosure rules; SEC actions on misleading AI claims.

What Boards Ask About

• Which AI uses are material to revenue, operations or legal exposure.
• Which uses make or shape decisions about customers, employees or patients.
• What the company tells investors, customers and regulators about its AI.
• Who owns AI risk in management, and how incidents reach the board.
• How the company would answer a TRAIGA civil investigative demand, which may request documentation on purpose, data, metrics, limitations and monitoring (Business and Commerce Code § 552.103(b)).

Disclosure Risk

The SEC settled actions in March 2024 against two investment advisers for false claims about their use of AI, and the Texas Attorney General has used the Deceptive Trade Practices-Consumer Protection Act (DTPA) against a company’s AI accuracy claims. Statements in investor materials, marketing and regulatory filings should match what the company’s systems actually do.

Recording Oversight

Minutes should identify the material information received, the decision and any requested follow-up. A record of informed deliberation can support a governance defense, subject to the governing law and facts. Merely mentioning AI in a board packet does not establish adequate oversight or resolve a claim.

Illustrative Example (Hypothetical)

A Texas-incorporated insurer adopts AI tools for claims triage. Given SB 815 and the Department of Insurance’s June 2026 bulletin expecting human review of consequential AI-supported decisions, the board asks management for a quarterly report on AI-supported claim decisions, review rates and complaints, and records the discussion.

What Is Unsettled

Whether a particular reporting failure supports a governance claim depends on governing law, entity form, materiality and the alleged conduct. A process record supports informed decisions; it does not guarantee the business-judgment rule will resolve every claim.