Keeping AI Out of the Boardroom Doesn’t Avoid Risk
How unmanaged tools and poor retention policies invite discovery and cause governance amnesia
I.
Ask a board member why the company made a call three years ago, and watch what happens. Not the decision itself — but the why. The risk that felt too large at the time, the alternative that was considered and set aside, the case that ultimately carried the room. That is what boards are often weighing when they decide whether to adopt AI. Some may reasonably prefer sparse records, while others may value a governed way to preserve more institutional knowledge.
A year ago, the common advice suggested that artificial intelligence ought to be kept out of the boardroom. Fast forward nine months and we are now told that it might come in, so long as it does not record anything for fear of discoverability. What changed in the intervening months? Not the statutory law governing board records and discovery. The law then is the law now.
What changed was a growing recognition that AI has already entered the boardroom whether or not the guidance has caught up to it; directors are feeding whole board books into ChatGPT, often without knowing they were handing their company’s confidential materials to the AI lab’s next training run.
Ninety-two percent of directors, by OnBoard’s research, have already used AI for board work in the past six months.1 Sixty-three percent of them sit on boards with no policy governing that use at all.2 This is not a hypothetical concern for some future board to weigh.
Are general counsels who worry about AI wrong? No. There are real risks created by unmanaged usage. I argue that the risk isn’t that temporary working documents become discoverable when AI enters the boardroom. Rather, the risk that keeps me up at night is the widespread dumping of confidential materials into public AI models because the board has failed itself by not adopting a method or means to enrich its decision-making with secure AI.
Those AI-cautious leaders pay an additional and hidden cost. Those who put off adopting AI for fear of creating more working drafts fail to weigh the upside of AI in the boardroom at all: the restoration and continuation of a board’s own memory.
Like any digital artifact, AI creates discoverable material. But the mistake is treating discoverable as a reason for avoidance, rather than a reason to govern what it creates.
What is true?
- First, a properly managed transcript may serve as a temporary working document, not the record, and the law has never required a working draft to outlive the document it produced.
- Second, the law rewards well-kept records. A sound, consistently applied retention policy, coupled with well-kept records can narrow a company’s exposure, whereas informal recordkeeping invites additional scrutiny.
- Third, refusing to govern this technology does not avoid risk. It substitutes a permanent, unmanaged risk for a manageable one, and boards are already paying that cost.
- Finally, by treating a new technology as an uncontrollable risk, firms forgo tools that preserve useful institutional context. This leads to amnesia — one that saps the board of a durable competitive advantage, diminishing value for shareholders and the communities they serve.
AI may create discoverable material, but discoverability does not require indefinite retention. The solution is to govern the creation, retention, preservation, and deletion of working drafts.
In practice, some boards may reasonably choose to operate with minimal records. That deliberate choice may suit their governance model and business needs. But certain organizations may want to build and benefit from richer institutional knowledge. The question is how to do that safely. Unmanaged AI creates a false choice between forgoing that opportunity and accepting uncontrolled risk. The framework offers a controlled path to institutional memory.
II.
A.
We are asked to believe that records produced by a machine are special, andthat retention policies that already govern working drafts do not apply to those generated by AI. Why? Because a machine produced it, rather than the paralegal who typed the same words? Absent a preservation duty, nobody has ever believed that a first draft must survive, whoever wrote it. Nor is there a reason to believe the specific tool used in the creation of an electronically stored working draft matters. While AI can create more discoverable records, boards can and should govern what they create. Avoiding the issue increases the risk of unapproved tools, while sacrificing the opportunity to strengthen an organization’s governance.
The Federal Rules of Civil Procedure were amended in December 2006 to directly address electronically stored information.3 But discoverability has never meant a company must retain everything it creates, and it certainly doesn’t require keeping every rough draft of every document.4 Absent a preservation duty, a transcript may be considered a working document whether created by a stenographer or a machine.
An initial transcript helps produce a first draft of the minutes. Human review and correction then make the draft the Organization’s own. Once the minutes are approved as the official record, the transcript has served its purpose. It may then be deleted in accordance with the Organization’s established records schedule, provided no other preservation duty applies.
The danger lies in having no policy for what becomes of a temporary working document after it is made. A board that deletes at whim or only after a dispute arises, litigation is reasonably anticipated, or a subpoena arrives has behaved badly. A board that consistently follows a reasonable, documented records schedule, established in the ordinary course, acts in accordance with sound records-management principles
B.
Consider what happens to a company that keeps scattered, informal records instead of formal ones.
The Delaware Supreme Court put it plainly in 2019, in KT4 Partners v. Palantir: “if a company observes traditional formalities, such as documenting its actions through board minutes, resolutions, and official letters, it will likely be able to satisfy a petitioner’s needs solely by producing those books and records.” But “if a company instead decides to conduct formal corporate business largely through informal electronic communications, it cannot use its own choice of medium to keep shareholders in the dark about the substantive information to which §220 entitles them.” Palantir had done exactly that, making no minutes or resolutions, failing to show how its decisions were made. What was left was only a trail of emails, and the Court sent the plaintiff looking there instead.5
The Delaware legislature’s 2025 rewrite of Section 220 narrowed a shareholder’s reach to an enumerated list of formal records, minutes, resolutions, communications to stockholders, financial statements, and the like, and raised the bar for reaching anything beyond that list to a “showing of a compelling need” proven by “clear and convincing evidence.”6 The practical guidance is clear: keep formal policies and clean minutes, so any inspection hopefully stops at the boardroom door. Keep none, and it can potentially go wherever the company’s actual business was conducted. A board that fears discovery and refuses to take advantage of tools now available to keep improved records has the risk exactly backwards.
Let’s not forget about Caremark,7 decided in 1996 and refined through later decisions: a director’s oversight duty is not satisfied merely by showing up and voting. It requires a reasonable reporting and oversight system; some structure by which problems get caught before they metastasize. An accurate, contemporaneous set of minutes may help establish the existence of a board-level oversight process. AI-assisted tools can strengthen governance and support the creation of those records to help establish compliance with your Caremark duties.
C.
Refusing to adopt and govern AI in the boardroom relocates the discovery risk onto a director’s personal ChatGPT account, where the company’s confidential board materials may sit outside company-approved contractual, retention, access, preservation, and model-training controls.
Boards still taking a laissez faire, see-no-evil approach will be the guinea pigs of what that risk foretells. A board that generates records but maintains no governed system for managing them is choosing a different path, one that emerges five years later, when the directors who made decisions of consequence have rotated off and a bright-eyed replacement finally asks a question that is met with quiet silence. Nobody left remembers.
When directors join, rather than inheriting a company’s memory, they inherit a game of telephone, played across turnover cycles, by people who have mostly already left the building.
III.
We have performed this particular song and dance before, and it is worth recalling how it ended. A decade ago, many who now fear the AI-generated working drafts also feared the cloud. Moving company data off a server in a closet and onto somebody else’s server terrified consumers right up until Amazon and Microsoft built a fence around the pasture: contracts, security commitments, audit trails sturdy enough for them to say yes. The risk became acceptable; mollified by contractual agreements and thoughtful infrastructure that defined how the information was handled and who had access. One might even notice the pattern and call it a precedent.
Sound governance is neither exotic nor theoretical. It does not require faith in machines. Rather, it requires a system that enables you to live out the governance practices and policies that you have defined for your organization. A system that puts decisions in the right hands. The company decides how recordings, transcripts, and other temporary working documents will be managed. Counsel determines whether a portion of a meeting should be recorded and processed by AI or restrict access to sensitive materials. The company controls the deletion schedule and binds the vendor to it.
Governed systems require clear policies and counsel or leadership making judgment calls. A board management platform can support all of this. A secure system that already stores your board materials and extends AI in a controlled way to the boardroom on the company’s own terms. These board portals give agency to general counsels to decide when and what to record at their own discretion. An executive session can still default to pen and paper when the board wants it to. Account-level retention controls, and the ability to freeze deletion when a litigation hold applies. A platform that lets the company execute the policies it has adopted.
IV.
The benefits of adopting a secure board platform with governance grade AI extend further. A board that maintains quality records that it has approved accumulates something it did not have before — institutional knowledge it can consult instead of anecdotal recollection it has to trust. Call this compounding effect Governance IQ; a byproduct that grows with every governed meeting and evaporates with every ungoverned one.
A board can provide a new director with a clear understanding behind a prior decision instead of relying on hallway rumors and old war stories. It can revisit important questions by consulting its own history instead of rearguing the question every time the composition of the room changes. The board can better fulfill its governance duties. That is the difference between an institution that learns and one that simply turns over.
Every board faces some degree of amnesia; that is what unassisted human memory does to an institution over enough meetings and enough retiring directors. Some may accept this trade off. For others, a governed system offers a practical way to address this longstanding challenge of institutional memory loss. I would take it.
About the Author:
Adarsh is OnBoard’s General Counsel & Director, Business Development. He brings over ten years of public sector experience at both the state and federal level. Most recently, he served as a Senior Director of Policy and Research for Indiana Governor Eric J. Holcomb, where he spearheaded the creation of the Next Level Fund, the state’s $250M private equity and venture capital investment vehicle. Adarsh holds a J.D. and Master of Public Affairs from Indiana University-Bloomington, and has served the community in numerous board and volunteer roles and is a two-time recipient of the Sagamore of the Wabash.
