AI Under Scrutiny: Boards and Regulators Tighten Oversight Amid New Risks

The National Association of Corporate Directors (NACD) has published a new guide, "Director Essentials: Implementing AI Governance," which establishes clear expectations for boards to oversee AI risks ([1]). Released on July 2, 2026, in collaboration with the Data & Trust Alliance, the guidance advises that directors should embed AI risks into their enterprise risk management (ERM) frameworks rather than treat AI as a separate tech issue ([2]). It also calls for formal board-level AI competence assessments and updates to committee charters to assign explicit AI oversight responsibilities, ensuring accountability is baked into governance structures ([3]).

As a widely respected authority on board governance, NACD’s move carries weight with regulators and investors ([4]). The message is that boards that cannot demonstrate a structured approach to AI oversight—such as documented training in AI, updated charters, and defined AI-focused KPIs—will face increasing scrutiny ([5]). In fact, even prior to this guidance, more than 62% of corporate directors reported that their boards had begun dedicating meeting time to discuss AI’s impact and risks ([6]), reflecting growing awareness that AI governance is now a board-level fiduciary duty.

Investors are also signaling that robust AI governance is becoming a competitive differentiator. This week, Palantir’s CEO Alex Karp publicly criticized "frontier AI labs" for “irresponsibly overselling” advanced models and siphoning off companies’ proprietary data without delivering commensurate value ([7]). His remarks, which highlighted the need for secure, enterprise-controlled AI systems, coincided with a 9% jump in Palantir’s stock price ([8]). The market’s reaction suggests that shareholders are rallying behind firms that prioritize protection of data and risk management in their AI strategies.

Federal regulators in the United States are moving swiftly to police how AI systems are being used in business. On July 1, the Federal Trade Commission (FTC) announced it is seeking public comment on a new policy statement to address the problem of AI systems producing manipulated or biased outputs without users’ knowledge ([1]). The FTC warns that artificially distorting an AI’s outputs—for example, to influence users’ behavior or hide biased results—could be deemed “unfair or deceptive” under the FTC Act, making companies liable for enforcement even in the absence of new AI-specific laws. The Commission’s proposal explicitly calls out AI firms that covertly tune systems toward undisclosed ideological or commercial objectives as potentially deceiving consumers and violating existing law ([2]).

This federal push comes as a response to a patchwork of state-level AI regulations and growing concerns about AI’s impact on consumers. In a related move, the FTC’s draft policy challenges state laws that mandate altering AI outputs, hinting at conflicts with legislation like Colorado’s new AI Act. The agency’s statement suggests that such state requirements may be “impliedly preempted” if they compel companies to bias AI systems in ways that conflict with federal principles of objectivity ([3]). This reflects an intensifying effort by the current U.S. administration—underscored by a recent executive order from President Trump—to assert national leadership in AI governance and ensure a unified regulatory approach across states ([4]).

For business leaders, these developments mean that compliance teams must immediately review how their AI models generate and present information. The FTC and other agencies have made clear that enforcement isn’t waiting on new legislation; long-standing rules against deceptive practices are already being applied to AI. Watch for regulatory scrutiny in at least four high-risk areas: misleading AI product claims, biased or discriminatory algorithmic decisions, misuse of consumer data, and failure to disclose AI-driven incidents or breaches ([5]). Companies should proactively audit their AI systems and vendor practices now to ensure transparency, fairness, and alignment with both federal guidelines and any applicable state requirements.

In the UK, the Bank of England has raised an industry-specific alarm on emerging AI risks in the financial sector. The central bank is examining whether existing banking and financial services regulations adequately cover "agentic" AI systems—artificial intelligence agents that can act and make decisions autonomously without direct human input ([1]). Speaking at a European Central Bank forum this week, Deputy Governor Sarah Breeden noted that today’s regulatory frameworks were never designed with self-directed AI trading or payment systems in mind, and she cautioned that relying on human oversight for every action of an autonomous system "is unlikely to be practical" ([2]).

The Bank of England’s review signals to financial institutions that regulators are questioning how to control novel AI-driven activities like automated trading, fraud detection, and cybersecurity operations. This scrutiny could lead to new guidance or adjustments in supervisory expectations for banks and insurers deploying advanced AI. The implication for financial firms is clear: they should proactively evaluate whether their risk controls and governance processes cover the unique behavior of AI agents in critical operations before regulators step in with new rules or enforcement. A failure to do so could result in regulators viewing ungoverned autonomous decision-making as a safety and soundness risk, potentially prompting stricter oversight or penalties.

More broadly, international regulators are also adapting their rulebooks to the fast-evolving AI landscape. For instance, just days ago the European Union approved an "Omnibus" legislative package that, among other changes, postpones the EU AI Act’s stringent high-risk AI compliance deadlines by roughly 16 months (to December 2027 for stand-alone high-risk systems) ([3]). At the same time, that new EU law explicitly bans the generation of non-consensual sexual deepfakes and child abuse images by AI ([4]), reinforcing that certain AI-driven harms will not be tolerated. These moves, alongside the Bank of England’s initiative, highlight a global trend: regulators in different jurisdictions are actively closing gaps in how laws apply to advanced AI, especially in sensitive sectors. Companies operating across borders must stay agile and ensure their AI deployments meet the highest applicable standards in all markets.

Recent events have shown that AI failures can quickly translate into legal risks and public backlash for enterprises. On July 1, a whistleblower from Wisk Aero—Boeing’s autonomous air taxi subsidiary—filed a lawsuit alleging she was wrongfully terminated for raising safety concerns about the company’s AI-driven flight software ([1]). The former software manager claims that Wisk’s executives pushed to curtail FAA-mandated testing of a flight-critical AI system to meet aggressive timelines, and that after she warned of potential safety hazards, she was dismissed in retaliation ([2]). This case, likely one of the first of its kind in the autonomous aviation industry, underscores that employees are increasingly willing to blow the whistle when they believe AI deployments jeopardize safety, creating significant legal liability and regulatory attention for employers.

Meanwhile in the UK, grocery giant Sainsbury’s faced criticism when its new AI-powered facial recognition system misidentified an innocent shopper as a threat ([3]). Sainsbury’s had expanded the Facewatch facial recognition technology to 150 stores to flag repeat shoplifters, but a false match led staff to eject a customer who had done nothing wrong ([4]). The incident has raised concerns about privacy and bias in AI surveillance, and it serves as a cautionary tale: misuse or over-reliance on AI in customer-facing settings can result in tangible harm to individuals and expose companies to reputational damage and legal complaints.

These AI-related incidents illustrate that the theoretical risks of AI are now becoming real-world problems with enterprise consequences. They align with recent analyses suggesting that the most significant AI safety risks emerge when AI systems are deployed in live business processes and interact with sensitive data at scale ([5]). The key takeaway for executives is that strong AI governance and thorough risk assessments must be in place throughout the AI system lifecycle—from development and testing through deployment and monitoring. Neglecting to do so not only endangers public trust and safety but can also lead to lawsuits, regulatory penalties, and long-term brand harm.

In response to rising regulatory pressure and risk awareness, leading tech companies are beginning to issue their own AI governance frameworks to guide enterprise clients. On July 1, cloud data firm Snowflake unveiled a comprehensive governance framework called "The Agentic Enterprise: AI Governance for Marketing Leaders (2026)" to help organizations deploy AI "agents" in marketing safely ([1]). The Snowflake guide emphasizes that an AI strategy cannot be separated from data governance: unified access controls and strict data accountability must be treated as prerequisite safeguards rather than afterthoughts when implementing autonomous marketing AI tools ([2]). It specifically highlights privacy measures for AI that interacts with customer data, warning of risks like unauthorized data exfiltration by self-directed AI assistants and urging companies to enforce robust permission boundaries and data minimization practices ([3]).

Snowflake’s move reflects a broader industry trend of vendors and large enterprises attempting to self-regulate in advance of formal laws. Another example is marketing automation firm Attentive, which recently published its own five-step framework for governing agentic AI use in business operations ([4]). These industry-driven frameworks can provide practical blueprints for companies to follow, but they also introduce a new dimension of vendor risk. Compliance officers should note that adopting a vendor’s AI governance recommendations does not absolve the company of legal responsibility—if the vendor’s controls don’t meet regulatory standards, the enterprise remains fully liable for any compliance failures ([5]) ([6]). As regulators (in the EU, UK, and U.S.) signal interest in how companies manage AI agents, aligning internal practices with both industry best practices and binding regulations will be essential. Forward-looking boards may even press their organizations to implement such frameworks now, both to improve AI risk management and to demonstrate good-faith efforts to regulators and investors.