BDO, a global professional-services firm offering audit, tax, advisory and risk services, found in its 2026 Board Survey that while 80% of organizations have a clear governance framework for overseeing AI adoption and cybersecurity risk, only 36% of company directors were very confident that their board has the right skills and experience to provide that oversight. Another 49% were somewhat confident, while 15% were not confident.

BDO conducted the survey in June and asked directors of more than 200 U.S. companies directors across a wide range of industries to assess their boards’ AI governance frameworks, expertise and confidence in overseeing AI, cybersecurity and data governance. 

The findings, which were released on October 19, matter because boards are increasingly responsible for overseeing AI, cyber and data risks as adoption accelerates. 

AI Governance Needs Data Foundations

For chief data officers (CDOs), the survey highlights a gap between formal AI governance structures and the expertise needed to make them work.

A governance framework is not enough if boards and executive teams cannot assess data quality, lineage, access controls, privacy safeguards and model risk. CDOs can provide that operational visibility.

The findings also reinforce the need for AI governance to be tied to data governance. Organizations should be able to show which data feeds AI systems, who can access it, how it is protected and how AI-related incidents are detected and remediated.

Board Oversight Is Not Enough

Although most directors expressed confidence in their oversight systems, 15% said their boards lacked the right skills and experience for AI, cybersecurity and data governance.

That gap is significant because AI incidents can escalate quickly from technical failures to regulatory, reputational and financial risks. CDOs can help close it by translating data-governance controls into clear board-level metrics and risk reporting.

The survey suggests that organizations should treat AI governance as an enterprise capability. Data quality, access controls, incident response and accountability need to operate continuously across the business.