Why Your Board Shouldn't Rush to Cement an AI Strategy (And What to Do Instead)

There’s a valid argument for not prematurely designing a formal AI strategy when board-level understanding remains limited. Consider the data: 79% of board directors have minimal AI knowledge, only 13% of S&P 500 companies have directors with AI expertise, and nearly half haven’t put AI on the board agenda [1,2,3]. Meanwhile, 70-85% of AI pilots aren’t making it to implementation, with the share of companies abandoning projects jumping from 17% to 42% between 2024 and 2025 [4].

The question isn’t whether boards need to engage with AI - they clearly do.

It’s whether rushing to create comprehensive strategies without adequate literacy leads to better outcomes than building foundational understanding first. The failure rates suggest it doesn’t.

Where Premature Strategies Go Wrong

Most AI failures aren’t technical - they’re strategic. Projects get approved without clear links to business value, boards can’t distinguish capability from vendor hype, and initiatives become expensive experiments rather than purposeful programmes.

The scaling problem is equally telling: 88% of prototypes never reach production, with 62% stuck permanently in pilot phase [4]. This isn’t just about technology or data limitations. It’s often about boards approving strategies based on demonstrations without understanding the infrastructure, data governance, and organisational change required to scale.

For UK organisations, the regulatory complexity adds another layer. The government is legislating for frontier AI whilst sector regulators develop their own guidance [5,6]. The EU AI Act has extra-territorial reach affecting any system touching EU citizens. Without proper understanding, boards risk expensive compliance failures - as Air Canada discovered when held liable for their chatbot’s misinformation in 2024.

Building Foundational Literacy

The alternative to premature strategy is deliberate capability building. Leading boards are moving beyond presentations to hands-on learning - directors using the same LLM across meetings, experimenting with prompts, debriefing on what works [9]. Some are using AI to analyse their own board dynamics. The approach that seems most effective combines practical experience with role-specific training, helping directors understand not just what AI does, but where it breaks.

There’s a straightforward skills gap at board level.

UK boards need directors with expertise in AI alongside those with experience navigating economic cycles and geopolitical shifts. Only six of the top 50 US companies by market cap have directors with AI backgrounds, and they’re all tech companies [3]. Whether through recruitment, advisory boards, or external advisors, organisations need access to people who understand AI’s business implications and limitations - not necessarily technologists, but those who’ve implemented it and lived with the consequences.

Execution Planning Over Strategy Documents

Rather than comprehensive strategies, consider focused execution that builds capability whilst delivering value. This mirrors the dual-stream approach to AI strategy — running tactical experiments alongside longer-term capability building. Successful pilots tend to address specific pain points, deliver measurable results in 3-4 months, and teach something valuable whether they succeed or fail. An 8-week framework works well: setup, iterative development in sprints, assessment and scaling plans. The goal is validation and learning, not immediate production.

Less excitingly, infrastructure matters more than most organisations expect.

Clean, accessible data with proper governance:

Integration capabilities that work with existing systems.
Risk management frameworks (the ICO has been actively regulating AI and data usage [8]).
Change management - only a third of companies prioritised this in 2024, yet organisations that invest in culture see dramatically higher adoption rates.

Adaptive Governance Frameworks

Only 35% of companies have AI governance frameworks, often because they’re trying to design perfect systems rather than starting with something workable [1].

For UK organisations, ISO/IEC 42001:2023 provides useful structure - it’s the world’s first international standard for AI management systems, following a plan-do-check-act approach [7]. If you’re already ISO 27001 or ISO 9001 certified, it complements rather than replaces existing frameworks. The advantage of ISO 42001 is that certification demonstrates formal compliance and can support regulatory requirements.

As a complementary approach, the Databricks AI Governance Framework offers practical implementation guidance with 43 considerations across 5 pillars: AI Organisation, Legal and Regulatory Compliance, Ethical Oversight, Operational Monitoring, and Risk Management [10]. Where ISO 42001 provides the certifiable standard, Databricks offers operational detail for implementation. You don’t need to implement everything from either framework immediately - start with what matters most for your risk profile.

Whatever your approach, start with baseline governance:

Clear accountability for AI decisions.
Ethical principles that address fairness and transparency.
Risk assessment integrated into existing processes.
Compliance mechanisms aligned with UK regulatory expectations and the EU AI Act (and beyond) where applicable.

Stop treating AI as a separate strategy. Embed it in existing strategic conversations - digital transformation, customer experience, operational efficiency, risk and compliance, talent planning.

The UK government established the Regulatory Innovation Office in October 2024, working with the AI Safety Institute and sector regulators [6]. If you’re in financial services, your regulator is developing specific guidance. Stay ahead of this rather than waiting for mandates.

Questions Worth Asking

Effective board oversight doesn’t require deep technical expertise. It requires asking questions that surface genuine understanding:

How does this AI initiative directly support business objectives?
What happens if we don’t pursue it - genuine competitive risk or FOMO (fear of missing out)?
Could we achieve similar outcomes without AI?
Do we have the data infrastructure and governance required?
What specific capability gaps exist, and how will we close them?
What does our change management approach look like beyond communications?
What could go wrong, and would our mitigation strategies actually work?
How will we ensure fairness and transparency operationally?
Are we compliant with UK GDPR and the Data Protection Act 2018 [8]?
If we interact with EU markets, what’s our EU AI Act exposure?
Have we considered ISO 42001 as a framework [7]?
What specific, measurable outcomes define success?
How will we know if this delivers value versus activity?
At what point do we acknowledge something isn’t working and redirect resources?

A Pragmatic Approach

The organisations making progress aren’t necessarily those with the best strategy documents. They’re building capability methodically:

Audit AI literacy across the board and senior leadership honestly. Establish hands-on learning programmes - directors using LLMs across meetings, experimenting, debriefing. Map where AI systems are being used or could be used, including purpose, effectiveness, cost, and stakeholder perspectives.

Understand your regulatory context through sector-specific guidance, ICO guidance on AI and data protection [8], and DSIT developments. Consider ISO 42001 as structural scaffolding, even without immediate certification [7]. Run focused pilots that deliver measurable value in 3-4 months whilst revealing capability gaps.

Establish baseline governance covering ethics, risk, and compliance, with commitment to iterate as understanding grows. Get actual AI expertise through board recruitment, advisory boards, or external advisors. Integrate AI oversight into existing board committees rather than creating isolated structures.

If you’ve already developed an AI strategy, treat it as a living document that evolves with board literacy and organisational capability. The risk isn’t moving too slowly - it’s committing to approaches that outpace your ability to execute them competently. Premature failures can derail entire programmes.

Looking Forward

The gap between AI’s potential and most organisations’ ability to realise it remains substantial. Two-thirds of boards still have minimal AI knowledge (down from 79% - progress, but gradual) [1,2]. In January 2025, the UK launched its AI Opportunities Action Plan with ambitions to make the UK an AI superpower through infrastructure investment, public sector adoption, and securing homegrown capability [6]. It’s a solid strategy, but it requires organisations capable of executing on it.

The organisations that will likely thrive aren’t those ticking boxes for investors. They’re building genuine literacy, learning through focused execution, and adapting as both their understanding and the technology evolve.

Having spent a career driving digital transformation in many different industries (including book publishing), the pattern feels familiar: successful technology adoption requires balancing ambition with pragmatism, innovation with governance, vision with honest assessment of capability. AI follows similar rules, just with compressed timescales.

What’s your organisation’s approach to board-level AI literacy? Are you seeing similar strategic gaps, or have you found approaches that work? How are you navigating the UK’s evolving regulatory landscape? I’d be interested to hear how others are approaching this.

References:

Related reading: The Disposable Masterpiece extends the same argument to the build layer: treat AI solutions as time-boxed value extractions, and measure success by the understanding accumulated across cycles rather than the longevity of any one deployment.