The board can set the AI guardrails. But can they reach the decision?

The Signal

I recently attended the Australian Institute of Company Directors Essential Director Update 2026 in Sydney.

Presented by Peeyush Gupta AM FAICD, Non-Executive Director at Dexus, and Penny Bingham-Hall FAICD, Non-Executive Director at Fortescue Metals Group, the national AICD program examines issues currently shaping the responsibilities of Australian directors.

One part of the discussion particularly stayed with me.

AI was not being treated simply as a technology initiative.

It was being discussed alongside organizational resilience, information architecture, information flow and governance. The presentation framed crisis resilience, information flow and AI governance as three interconnected boardroom challenges.

That matters.

Because once AI becomes part of how an organization operates and makes decisions, governing AI cannot sit solely with the technology team.

The board may establish the intent, risk appetite and guardrails.

The question is what happens next.

Can that governance intent survive all the way forward to the decision?

The Boardroom Paradox

One statement in the presentation captured a familiar enterprise problem:

“We are drowning in data, but starving for insight.”

AICD Essential Director Update 2026 · Peeyush Gupta AM FAICD

Organizations have spent years building data platforms, warehouses, lakehouses, catalogs, governance frameworks, analytics environments and increasingly AI infrastructure.

Yet having more data does not necessarily produce better decisions.

AI raises the stakes because it introduces another consumer of enterprise information, one capable not only of finding and summarizing information but increasingly of recommending and taking actions.

The AICD's updated Director's Guide to AI Governance, developed with the Human Technology Institute at UTS, reflects this shift. It says AI can enhance productivity, improve decision-making and support innovation, while also introducing interconnected risks including cybersecurity and data governance. Its position is that boards have a key role in governing the balance between opportunity and risk.

That creates an important distinction.

A board does not need to determine how an AI agent queries a dataset.

But it does need confidence that the organization can answer questions such as:

• What information is AI using?
• What does that information mean?
• Is it appropriate for this purpose?
• Who is allowed to access it?
• Which policies apply?
• Where did it come from?
• If AI contributes to a consequential decision, can the organization explain the evidence behind it?

Those are no longer simply data questions.

They are governance questions.

“Guardrails, Not Brakes”

Another phrase from the Essential Director Update captured the balance particularly well:

“Guardrails, not brakes.”

AICD Essential Director Update 2026 · Presentation material

The presentation described an AI governance roadmap progressing through three stages: efficiency, effectiveness and differentiation.

• Efficiency begins with copilots automating routine tasks, with attention to issues including Shadow AI and data security.
• Effectiveness moves AI into business processes, introducing considerations such as human oversight and algorithmic bias.
• Differentiation takes AI toward proprietary innovation and potentially high-stakes decisions.

Source: AICD Essential Director Update 2026. Presentation material supplied by Harry Linggoputro.

The further AI moves along that path, the more important the information underneath it becomes.

An AI assistant helping someone draft an email presents one type of governance challenge.

An AI system helping allocate capital, respond to a vulnerable customer, assess a claim, change a production schedule or recommend a material business action presents another.

Australia's own responsible AI guidance makes a similar connection. The Australian Government's AI guardrails include accountability, risk management, data quality and provenance, testing and monitoring, meaningful human oversight, transparency and record keeping. Importantly, the guidance describes these as ongoing activities, rather than controls applied once at the beginning of an AI project.

NIST takes a similar lifecycle view. Its AI Risk Management Framework describes governance as a cross-cutting function that should be infused throughout the management of AI risk, with risk management continuing across the AI system lifecycle.

That is an important signal.

Good governance should help organizations use AI responsibly, not simply stop them from using it.

From Governance Intent to Governance in Action

This is where I think the conversation becomes particularly interesting.

A board can establish risk appetite.

It can approve an AI governance framework.

It can define accountability.

The Essential Director Update showed how oversight may span Risk, People and Sustainability committees, covering issues from cyber, privacy, legal and data governance risk to workforce adoption and wider community impacts.

But those principles eventually have to become operational.

• The organization has determined that a particular class of information is sensitive. Does that restriction remain in force when an AI agent accesses it?
• Access depends on someone's role, purpose or business context. Does the same rule apply when the consumer is no longer a person opening a dashboard?
• Two parts of the organization use different definitions of the same measure. Which one does AI receive?
• If AI contributes to a decision, can the organization trace the data, meaning, policy and evidence that informed it?

This is the gap between governance intent and governance in action.

Why Governance Has to Become Active

This is closely related to something we have been exploring at Data Tiles for some time: Active Governance.

Traditional governance is very good at documenting intent.

It can tell an organization what data exists, who owns it, how it is classified, what policies apply and how information should be handled.

But as AI becomes another consumer of enterprise information, documentation alone is not enough.

Governance increasingly has to participate in what actually happens.

At Data Tiles, we describe Active Governance as moving governance from documentation into execution: keeping context, policy, ownership, quality, lineage and permissions connected to trusted data products as they are created and consumed.

This is not an argument for replacing existing governance platforms or board frameworks.

Quite the opposite.

The value lies in operationalizing the intent they establish.

• If governance says who should access something, that policy should affect access.
• If data quality is insufficient for a particular use, that should influence whether the product can be consumed.
• If information is sensitive, the appropriate restrictions should remain attached to its use.
• If AI consumes the product, governance should not disappear simply because the consumer has changed.

Governance intent needs to survive the journey from policy to product to AI to decision.

Explore Active Governance

The Decision Is Where Governance Becomes Real

There is another reason this matters.

Governance is ultimately tested not by the existence of a policy, but by what happens when someone or something uses information.

• A lending decision.
• A customer interaction.
• A supply-chain intervention.
• A regulatory submission.
• A clinical or operational recommendation.
• A board decision.

That is the moment when meaning, access, quality, lineage and policy stop being abstract concepts.

They affect an outcome.

This is why our view at Data Tiles is increasingly decision-driven.

Rather than beginning with all the data an organization could make available to AI, start with the decision.

• What decision are we trying to improve?
• What information does that decision require?
• What business context is needed to interpret it?
• What governance applies?
• What evidence needs to remain traceable?

Then work backwards.

We set out this approach in more detail in The Decision-Driven Enterprise: governance, context and meaning designed around the decisions the business needs to make, rather than around the data that happens to be available.

The same principle appeared in my previous Market Signal on AI-ready data products: once people and AI depend on a data product for a decision, governance, context and business meaning have to remain connected to that product at the point of use.

What We See Across APJ

Across Asia Pacific and Japan, organizations are moving quickly from AI experimentation toward operational use.

The conversations are changing accordingly.

The question is becoming less:

“Can we build this?”

and increasingly:

“Can we put this into production responsibly?”

That requires more than a capable model.

It requires trusted information, clear ownership, business context, access controls, traceability and governance that continues operating as data moves into analytics, applications and AI.

The infrastructure is often already there.

The challenge is connecting the governance organizations have invested in with the moments where information is actually used.

And that is why I think the boardroom conversation I heard at the AICD Essential Director Update is so important.

AI governance does not finish when the board approves the framework.

In many ways, that is where the work begins.

How Data Tiles Operationalizes This

Latttice is the Data Product Workbench from Data Tiles.

It enables business, data and governance teams to create trusted, governed data products across the organization's existing enterprise environment, bringing business context, policy, ownership, quality, permissions and lineage closer to the data people and AI actually consume.

Its Active Governance approach is designed to make governance operational at creation and consumption, rather than leaving governance as documentation alongside the product. Policy can therefore remain connected as trusted information moves into analytics, applications and AI.

The distinction is important.

• The board establishes governance intent.
• Governance teams translate that intent into policy and controls.
• The business understands the decision and its context.
• Data provides the evidence.
• Active Governance helps those controls travel with the information.
• People and AI make decisions within them.

That is how guardrails become more than principles.

They become part of how the organization operates.

The Market Signal

The AICD Essential Director Update reinforced something I expect we will hear much more about as enterprise AI matures.

AI governance is becoming business governance.

Boards will increasingly need to understand where AI is being used, what risks it introduces, how accountability works and whether the organization has appropriate guardrails in place.

But the next challenge sits below the boardroom.

Organizations have to turn those guardrails into operating reality.

The opportunity is not to put governance in the way of AI.

It is to make governance sufficiently active that trusted AI can move faster within the organization's intent.

The board can set the guardrails.

The real test is whether those guardrails survive all the way to the decision.