The Thinking Company
Bartek Pucek 2026-02-01 14 min read

Alternatives to Delegating AI Governance to the CTO: Why Boards Must Stay Involved

Delegating AI governance entirely to the CTO creates a structural conflict that no amount of technical competence can resolve. Technology-delegated governance scores 1.95/5.0 in structured evaluation — ranking third of four approaches — with its lowest score on independence and objectivity (1.5/5.0), the factor that measures whether governance serves the board’s oversight interests or the technology function’s operational interests. The alternative is not removing the CTO from governance but restructuring oversight so the CTO contributes technical expertise within a framework the board owns. This board-integrated model preserves the CTO’s strengths on scalability (3.5/5.0) and speed (3.0/5.0) while adding the independence, board education, and fiduciary coverage that delegation cannot provide.

A mid-market logistics company in Central Europe had deployed AI across route optimization, demand forecasting, warehouse automation, and customer service triage. The CTO led each deployment. The supervisory board approved the budgets, received quarterly technical updates, and trusted the CTO’s judgment. For two years, the arrangement worked — or appeared to.

In late 2025, ahead of EU AI Act high-risk system obligations taking effect in August 2026, the board commissioned an external readiness assessment. The findings exposed a gap that no one had examined. The CTO’s governance covered technical controls comprehensively: model monitoring, data quality checks, access management, deployment pipelines, vendor SLA tracking. What did not exist was a framework the board could own. No documented risk appetite for AI. No human oversight mechanisms for the customer service triage system, which affected individual outcomes. No fundamental rights impact assessment for the workforce scheduling algorithm. No board-level AI literacy program. No escalation path from management AI decisions to board review.

The CTO had not failed. The CTO had done exactly what was asked: manage AI as a technology function. The board had delegated AI oversight to the person most qualified to build AI systems and least structurally positioned to design independent oversight of those systems. The result was a governance program built for technical excellence and blind to the regulatory, fiduciary, and strategic dimensions that boards are responsible for.

This pattern is common across mid-market organizations where AI began as an IT initiative and grew into a strategic capability without governance structures evolving alongside it. The question is not whether the CTO should be involved in AI governance — the CTO’s technical expertise is indispensable. The question is whether the CTO should be the sole owner. [Source: Based on professional judgment, The Thinking Company advisory experience]

What Technology-Delegated Governance Gets Right

We are an advisory firm. We compete with technology-delegated approaches. Dismissing their strengths would be dishonest and would undermine the credibility of everything that follows. According to The Thinking Company’s Board AI Governance Evaluation Framework, technology-delegated governance scores 1.95/5.0 overall — the third-lowest of four evaluated approaches — but that composite conceals specific areas of genuine capability. [Source: The Thinking Company Board AI Governance Evaluation Framework, v1.0]

Scalability & Adaptability: 3.5/5.0. This is the highest score technology-delegated governance achieves, and it ties with advisory-led governance on this factor. Vendor governance tools — model registries, automated monitoring, deployment pipelines, access control systems — scale efficiently as AI portfolios grow. Adding a tenth AI system to a well-architected governance toolchain is incrementally easier than adding the second. For organizations with growing numbers of AI deployments across business units, this technical scalability is a real advantage that other governance models do not replicate as efficiently.

The WEF AI Governance Alliance found that 67% of organizations scaling AI beyond 10 production systems required automated governance tooling to maintain oversight — a capability technology-delegated governance provides most efficiently. [Source: WEF AI Governance Alliance, “Scaling AI Governance,” 2025]

Speed to Operational Governance: 3.0/5.0. CTOs have execution authority. They control the technology teams, the deployment infrastructure, and the vendor relationships. When a CTO decides to implement governance tooling, it can be operational within weeks — no cross-functional committee formation, no board education prerequisites, no policy drafting cycles. This score is second only to advisory-led governance (4.0), and the speed comes from a legitimate structural advantage: the CTO can act without waiting for organizational consensus.

Risk Identification (Technical): 2.5/5.0. CTOs identify technical risks with genuine expertise. Model performance degradation, data pipeline failures, security vulnerabilities, infrastructure reliability, vendor lock-in. These are real risks, and technology teams are the right people to spot them. The 2.5 score reflects that technical risk identification is competent while non-technical risk identification — organizational adoption risk, ethical risk, reputational risk, regulatory risk beyond technical compliance — falls outside the CTO’s typical lens.

These scores are earned. An organization that needs to scale AI governance tooling across a growing portfolio of deployments, that needs operational controls stood up quickly, and that has a CTO with strong technical risk management practices gets real value from the technology-delegated model. The question is whether that value is sufficient for board-level governance. In most cases, it is not.

The Structural Conflict

The central weakness of technology-delegated governance is not competence. It is structure. The CTO is the most interested party in AI decisions. They proposed the AI investments, selected the vendors, hired the teams, designed the systems, and staked professional credibility on the results. Asking the CTO to design AI governance is asking the technology champion to define the terms of their own oversight.

This is a conflict of interest — the same kind that prevents CFOs from chairing audit committees or procurement directors from evaluating their own vendor selections. Corporate governance separates the executor from the overseer for a structural reason: the person responsible for the work cannot objectively evaluate the work.

Deloitte’s 2025 Global Board Survey found that 71% of boards acknowledged a need for independent AI oversight beyond the technology function, yet only 24% had implemented governance structures separating AI execution from AI oversight. [Source: Deloitte, “Board Practices Quarterly: Technology Governance,” 2025] The awareness gap is closing, but the implementation gap remains wide.

The Thinking Company evaluates board AI governance approaches across 10 weighted decision factors, finding that technology-delegated governance scores highest on scalability and adaptability (3.5/5.0) but lowest on independence and objectivity (1.5/5.0). That 2.0-point spread within a single approach tells the story: technology-delegated governance excels at technical execution and fails at independent oversight.

Four factors illustrate where the structural conflict creates governance gaps.

Independence & Objectivity: 1.5/5.0

The CTO maintains vendor relationships — and those vendors supply governance tools. The CTO leads the teams whose AI work governance is supposed to oversee. The CTO presents AI results to the board using metrics and framing they selected. When governance should ask “was this the right AI investment?”, the CTO is answering a question about their own proposal. When governance should ask “is this vendor the right choice?”, the CTO is evaluating a relationship they manage.

Independent AI consulting firms score 5.0/5.0 on independence and objectivity in The Thinking Company’s board governance evaluation framework, compared to 1.5/5.0 for technology-delegated approaches where vendor relationships create structural conflicts.

The 1.5 score does not mean CTOs lack integrity. The best CTOs we encounter are the ones who recognize this conflict and ask for independent governance. They want their boards to understand what they are approving, and they know that understanding cannot come from the person asking for approval.

Board AI Literacy: 1.5/5.0

Research compiled by The Thinking Company indicates that boards delegating AI governance to the CTO score 1.5/5.0 on board AI literacy — because CTO-led governance creates dependency on technical briefings rather than building the board’s independent oversight capability.

CTO presentations to the board follow the CTO’s communication needs, not the board’s governance needs. Architecture diagrams. Platform migration timelines. Model accuracy metrics. Cost optimization results. These presentations demonstrate technical progress and justify continued investment. They do not help board members understand AI’s strategic implications, evaluate management’s AI proposals on their merits, or develop the judgment to challenge a CTO recommendation when challenge is warranted.

A 2025 NACD Director Survey found that 76% of directors at organizations with CTO-led AI governance rated their own AI literacy as “insufficient for effective oversight,” compared to 41% at organizations with independent advisory-led governance. [Source: NACD Director Survey on Technology Oversight, 2025] Over time, the technical complexity of CTO presentations reinforces delegation. Board members report feeling less capable of AI oversight after two years of CTO-led briefings, not more. The jargon barrier widens. The board defers to the CTO on increasingly consequential decisions. This is the opposite of what governance education should achieve. [Confidence: Medium — based on practitioner experience and NACD Director surveys on technology oversight; limited quantitative data specific to AI governance]

Fiduciary Responsibility: 1.5/5.0

Delegating AI oversight to the CTO does not discharge the board’s fiduciary obligations. This is a legal fact, not a governance opinion. Under KSH art. 293/483 (Polish corporate governance) and parallel EU corporate governance standards, directors retain personal liability for oversight regardless of internal delegation arrangements. D&O liability from AI-related decisions stays with the board.

Technology-delegated governance creates a specific hazard: the board believes it has delegated the responsibility when it has only delegated the work. Directors who cannot explain what AI the organization deploys, what risks those systems create, or what governance frameworks exist are exposed in a fiduciary challenge. The compliance documentation that protects directors — evidence of informed decision-making, ongoing oversight, documented diligence — does not exist in a technology-delegated model because the governance was designed to serve the CTO’s operational needs, not the board’s fiduciary requirements.

Advisory-led governance scores 4.0 on this factor. The 2.5-point gap reflects the difference between governance designed around technical management and governance designed around board duties. Boards assessing their exposure should use an AI readiness assessment to quantify the fiduciary gap alongside other governance dimensions.

EU AI Act Readiness: 1.5/5.0

The EU AI Act, entering enforcement in 2025-2026, creates organizational governance requirements that cannot be met through technical controls alone. Boards that have delegated AI oversight to the CTO face a structural gap between their technical AI governance and their regulatory obligations.

CTOs address the technical compliance requirements well: model documentation, system logging, audit trails, performance monitoring. These are engineering tasks, and engineering teams execute them. What CTOs do not address — and are not trained to address — are the organizational and governance requirements the EU AI Act imposes: risk management systems that extend beyond technical risk (Article 9), human oversight mechanisms with documented organizational processes (Article 14), fundamental rights impact assessments (Article 27), transparency obligations that require organizational communication practices (Articles 50-53), and governance structures that demonstrate board-level oversight of high-risk AI systems.

Technical compliance and regulatory compliance overlap but are not identical. A CTO who has implemented comprehensive model monitoring may still leave the organization unprepared for a regulatory examination that asks about board oversight documentation, human oversight decision authority, or fundamental rights impact processes. [Confidence: High — based on primary analysis of EU AI Act (Regulation (EU) 2024/1689) and cross-reference with enforcement guidance published by EU AI Office]

The Delegation Trap

The structural conflict described above creates a specific governance failure mode. Call it the delegation trap. It works like this.

The board delegates AI oversight to the CTO. The CTO implements governance — monitoring dashboards, deployment gates, risk controls, vendor reviews. The board receives periodic reports showing green status on technical metrics. Directors see evidence of governance activity and conclude that AI governance is handled. Board agendas move to other priorities.

Underneath this apparent governance, several things are not happening. The board is not building AI literacy. No independent evaluation of the CTO’s AI strategy is occurring. Non-technical risks — ethical, reputational, organizational, regulatory — are not being assessed by anyone with the mandate and capability to assess them. Fiduciary documentation of board-level diligence does not exist. The CTO reports upward, but the board lacks the knowledge to evaluate those reports or the structure to challenge them.

The trap closes when a triggering event exposes the gap. An EU AI Act readiness assessment. A failed AI project with material financial impact. A regulatory inquiry. A D&O insurance renewal that asks about AI governance. A board member who reads about AI liability in a directors’ publication. The trigger varies. The discovery is the same: the board has been relying on governance that was designed for technology management, not for board oversight.

Gartner estimates that 60% of organizations relying on CTO-led AI governance will discover material governance gaps during their first EU AI Act compliance audit. [Source: Gartner, “Predicts 2025: AI Governance,” November 2024]

At this point, the board faces a choice under time pressure that it should have made deliberately. That pressure is avoidable, but only if the board recognizes the delegation trap before it closes.

The Alternative: Board-Integrated Governance

The alternative to technology-delegated governance is not removing the CTO from AI governance. That would waste the most valuable technical expertise in the organization. The alternative is restructuring governance so the CTO participates as a key contributor to a framework the board owns, rather than serving as the sole owner of a framework the board cannot oversee.

Advisory-led governance achieves this by introducing four elements that technology-delegated governance lacks. Organizations following a structured AI adoption roadmap can phase these elements into their existing governance progression.

Board AI literacy that reduces dependency. Advisory-led approaches design structured education programs for non-technical directors — calibrated to the board’s starting level and delivered as an ongoing curriculum. Board members learn how to evaluate AI proposals, what questions expose risk, how to interpret AI performance data, and when the CTO’s recommendations warrant challenge. The goal is a board that can govern AI independently. Advisory-led scores 4.5 on board AI literacy; technology-delegated scores 1.5. That 3.0-point gap is the difference between a board that understands what it oversees and one that cannot.

Independence from the decisions being governed. External advisory with no vendor partnerships, no technology revenue, no organizational politics, and no stake in the AI systems under review starts from the board’s interests. The advisory’s mandate is helping directors fulfill their governance responsibilities — not justifying technology investments or defending vendor selections. Advisory-led scores 5.0 on independence; technology-delegated scores 1.5.

Organizational integration across functions. Advisory-led governance designs AI oversight as an organizational operating model: committee structures, reporting cadences between management and the board, escalation paths for AI decisions that exceed management authority, role definitions that clarify who owns what, and cultural practices that make governance operational instead of documentary. Advisory-led scores 4.5 on organizational integration; technology-delegated scores 2.0. The gap reflects the difference between governance that lives in the IT function and governance embedded across the organization. Effective change management is essential to this transition — moving governance from IT ownership to cross-functional ownership requires deliberate organizational design.

Fiduciary documentation the board can defend. Advisory-led governance creates documented evidence of informed decision-making, ongoing oversight, and board-level diligence. This documentation exists because the governance framework is designed around board duties, not around technical management. When fiduciary questions arise — regulatory examination, D&O claim, shareholder challenge — the board has a record that demonstrates governance, not delegation. Advisory-led scores 4.0 on fiduciary responsibility; technology-delegated scores 1.5.

The CTO’s role in this structure is substantial. Technical risk assessment, system monitoring, vendor management, deployment governance, and operational AI performance remain the CTO’s domain. These are areas where technology-delegated governance performs well (scalability 3.5, speed 3.0, technical risk identification 2.5). The advisory-led model preserves these strengths while adding the board-level governance layer that the CTO’s role cannot structurally provide.

This is complement, not replacement. The CTO brings technical authority. External advisory brings independence, board education, and organizational integration. Together, they cover the full spectrum of governance factors. Separately, each leaves material gaps.

When Technology-Delegated Governance Is Appropriate

Honesty requires acknowledging that technology-delegated governance is adequate in specific circumstances. Not every organization needs board-integrated AI governance, and claiming otherwise would be self-serving.

AI use is operational, not strategic. If AI is limited to process automation, internal analytics tools, or off-the-shelf productivity software, the strategic governance gap matters less. Technical governance covers the primary risks. Board-level oversight of AI is less critical when AI does not shape competitive position or affect individuals whose rights require protection.

The organization is at the earliest AI maturity stage. An organization running its first proof-of-concept or piloting a single AI tool does not need a board-level governance framework. The CTO’s oversight is proportionate to the scope. Governance should scale with AI maturity — building board-level oversight before there are board-level AI decisions to oversee wastes resources.

Board bandwidth is genuinely constrained. Supervisory boards of mid-market companies carry oversight responsibilities across many domains. If the board lacks capacity to take on AI governance alongside existing priorities, technology-delegated governance provides a baseline. The board should explicitly document this choice — acknowledging the delegation, its limitations, and the conditions under which board-level governance will be revisited.

Budget for external advisory is unavailable. Advisory-led governance costs more than technology-delegated governance. If the organization cannot fund external advisory and the board’s priorities require that limited governance resources go to the most urgent risks, technology-delegated governance is a rational interim choice. The risk is accepting an interim measure as a permanent arrangement. The AI ROI calculator can help boards quantify the governance investment case against potential liability exposure. [Confidence: High — these conditions are well-established in corporate governance literature on proportionate oversight]

These scenarios share a common feature: they describe organizations where AI has not yet become material to competitive position, regulatory exposure, or stakeholder impact. As AI materiality grows — more deployments, higher-risk applications, EU AI Act obligations, strategic dependency — the case for technology-delegated governance weakens and the case for board-integrated governance strengthens.

What The Thinking Company Recommends

Restructuring AI governance away from CTO delegation preserves the CTO’s technical leadership while giving the board the independent oversight capability it needs.

  • AI Governance Setup (EUR 10–15K): Establish board-level AI oversight structures, governance frameworks, and reporting cadences tailored to your organization’s AI maturity and regulatory exposure.
  • AI Strategy Workshop (EUR 5–10K): A focused board session on AI governance fundamentals, covering risk classification, oversight design, and the board’s role in AI strategy.

Learn more about our approach →

Frequently Asked Questions

Does delegating AI governance to the CTO violate the board’s fiduciary duty?

Delegation of work is permissible; delegation of duty is not. Under European corporate governance codes (including KSH art. 293/483 in Poland), directors retain personal liability for oversight regardless of internal delegation. A board that delegates AI governance to the CTO has delegated the execution of governance tasks but remains responsible for ensuring adequate oversight exists. If a fiduciary challenge arises — regulatory examination, D&O claim, shareholder challenge — the board must demonstrate informed, documented oversight. Technology-delegated governance scores 1.5/5.0 on fiduciary responsibility because it produces no board-level documentation of diligence.

How do we transition from CTO-led to board-integrated governance without sidelining the CTO?

The transition restructures roles, not removes them. The CTO retains ownership of technical governance: model monitoring, deployment controls, vendor management, scalability. What changes is the oversight layer. A board-level governance framework adds committee oversight, board education, independent reporting, and fiduciary documentation. The CTO becomes a key contributor providing technical expertise within a framework designed for board governance needs. Most CTOs welcome this transition because it clarifies their role and distributes governance burden they were never structurally designed to carry alone.

What is the minimum investment to move from CTO-delegated to board-integrated AI governance?

A Board AI Governance Session ($6,500 / 25,000 PLN) provides the starting assessment. This session evaluates the CTO’s existing governance strengths, identifies structural gaps against all 10 evaluation factors, and recommends proportionate next steps. A full governance framework engagement runs $20,000-$50,000 over four to eight weeks. Both are designed to complement existing CTO-led technical governance, not replace it. The CTO participates as a central stakeholder in both engagements.

What specific EU AI Act requirements does CTO-led governance typically miss?

CTO-led governance covers technical requirements well: model documentation, system logging, audit trails, performance monitoring. It typically misses organizational requirements: documented risk management systems extending beyond technical risk (Article 9), human oversight mechanisms with organizational process documentation (Article 14), fundamental rights impact assessments (Article 27), transparency obligations requiring organizational communication practices (Articles 50-53), and board-level oversight documentation for high-risk AI systems. These gaps create regulatory exposure that technical controls alone cannot close.

Can we use the CTO’s existing governance as a foundation for board-integrated oversight?

Yes, and this is the recommended approach. Technology-delegated governance scores 3.5/5.0 on scalability and 3.0/5.0 on speed — these are real capabilities worth preserving. The advisory-led model adds governance layers on top: board education (moving from 1.5 to 4.5), independence (from 1.5 to 5.0), organizational integration (from 2.0 to 4.5), and fiduciary documentation (from 1.5 to 4.0). The CTO’s technical governance becomes the operational foundation; board-integrated governance provides the oversight structure.

Board Action Checklist

For boards currently relying on technology-delegated AI governance, six steps can begin the transition to board-integrated oversight.

1. Audit the current governance scope. Ask the CTO to document what the existing AI governance framework covers and — more revealing — what it does not cover. Compare the documented scope against the 10 factors in The Thinking Company’s Board AI Governance Evaluation Framework. The gaps between technical governance and board-level governance become visible in this comparison.

2. Assess board AI literacy independently. Without the CTO in the room, ask each board member to describe what AI the organization deploys, what strategic role AI plays in the business plan, and what risks AI creates beyond technical performance. If directors cannot answer these questions without consulting the CTO, the literacy gap is present and the delegation dependency is confirmed.

3. Review fiduciary exposure. Engage legal counsel — not the CTO — to assess the board’s D&O liability exposure from AI-related decisions under current governance arrangements. Under KSH art. 293/483 and EU corporate governance standards, delegation of work does not equal delegation of duty. Legal counsel can quantify what the fiduciary gap means for individual directors.

4. Map EU AI Act obligations against current governance. If the organization has European operations, compare the EU AI Act’s organizational and governance requirements against the CTO’s existing governance framework. The gap between technical compliance (model documentation, audit trails) and regulatory compliance (human oversight mechanisms, fundamental rights impact assessments, board-level oversight documentation) identifies specific governance deficiencies.

5. Establish a board AI governance agenda item. AI should appear on the board agenda as a governance topic — separate from the CTO’s operational technology report — at least quarterly. This single structural change begins to reframe AI as a board oversight responsibility, not a technology function report.

6. Evaluate advisory-led governance engagement. Commission an independent assessment of the organization’s AI governance posture. The assessment should evaluate all 10 governance factors, identify where technology-delegated governance is sufficient and where it creates gaps, and recommend proportionate next steps. This is the entry point for transitioning from delegation to board-integrated oversight.

Next Steps

For boards evaluating whether their technology-delegated AI governance is sufficient, The Thinking Company offers two entry points.

Board AI Governance Session ($6,500 / 25,000 PLN). A focused session with the board and CTO covering: assessment of current governance gaps against the 10-factor evaluation framework, evaluation of the CTO’s existing governance strengths and structural limitations, comparison with advisory-led and complementary governance models, and recommended next steps tailored to the organization’s AI maturity and regulatory exposure.

AI Governance Framework Engagement ($20,000-$50,000). Design and implementation of a board-level AI governance framework that integrates with the CTO’s existing technical governance. Covers committee structure, reporting cadences, board education program, escalation paths, fiduciary documentation, and EU AI Act readiness. Delivered over four to eight weeks with operational governance rhythms in place by engagement end. The CTO remains a central participant — the engagement adds the board-level governance layer, not a replacement for technical oversight.

Both engagements are designed to complement the CTO’s existing governance, not to sideline it.

Related reading:

Scoring methodology: The Thinking Company Board AI Governance Evaluation Framework, v1.0. All scores are based on published research, regulatory analysis, board governance surveys, and practitioner experience. Factor weights reflect evidence that board AI literacy, EU AI Act readiness, and organizational integration are the three strongest predictors of governance effectiveness. Full methodology and evidence basis available on request.

This article was last updated on 2026-03-11. Part of The Thinking Company’s Board AI Governance content series. For a personalized assessment, contact our team.