Only 6% of Polish companies use AI strategically, and 46% are organizations with no implementation strategy and no skills in the team (PARP, the Polish Agency for Enterprise Development, and Jagiellonian University, BKL study, 2026). This gap does not come from technology or from budget. It comes from whether someone at board level has decided why the company uses AI and what it deliberately does not do.
WeAreFuture is a Polish AI consulting and implementation firm from Warsaw. We run AI transformations in mid-sized and large organizations - from diagnosis, through implementation, to adoption. For the board of an asset management company we ran a full-day workshop on AI use cases in the organization. At a manufacturing company, handling a request for quotation was cut from several days to around one day. In a pharmaceutical company, adoption of an internal AI assistant rose from limited use to regular use by most of the team after an adoption program. In none of these cases was technology the starting point. The starting point was a board decision.
This article describes the board’s role in AI: what must not be delegated downward, which questions are worth having on the table, and where to start if the answer to most of them is “I don’t know.” I write from an advisory perspective, after several dozen conversations with the boards of Polish manufacturing, financial and service companies.
Is your board wondering where to start with AI? We start with a session after which the board knows where AI makes sense in your industry and where it does not. See how we run AI consulting and strategy.
Why AI is not a topic to delegate to IT
AI has reached the agenda of practically every board, but most boards approach it in one of two ways, and both are wrong. The first is to treat AI as a “technical topic” and delegate it downward, to IT. The second is to react to the noise: “the competition is doing AI, so we have to as well,” with no strategy and no priorities. The first leads to implementations with no direction and risk out of control. The second to costly chaos.
The reflex “let IT handle it” is understandable, because AI sounds technical. But when the board delegates the topic entirely and steps out, what happens is what we described in the chaos of scattered AI implementations: isolated pilots appear with no link to strategy, no business owners and no idea what will come of them. IT gets responsibility for a business decision, and the risk - data, compliance, reputation - is left unsupervised at the right level.
The second mistake is the mirror image. A board driven by the noise around AI pushes “we must have AI,” but does not say why, where or with what priority. The team dashes in several directions at once to show movement, and the company pays for a lot of AI that adds up to nothing.
The common denominator of both mistakes is the absence of the board where its presence is essential. The board, not the IT department, is responsible for four things: strategic direction, capital allocation, risk appetite and organizational culture. None of them can be delegated downward without losing control of the whole.
The data shows this is not a problem of individual companies. Only 28% of organizations using AI say that the CEO oversees AI governance, and in companies with revenue above USD 500 million that share is even lower (McKinsey, “The State of AI,” 2025). The direction of change is clear, though: the share of Fortune 100 companies that disclose AI as a subject of board oversight rose from 16% in 2024 to 48% in 2025, and the share that assigned AI to a specific board committee from 11% to 40% (EY Center for Board Matters, October 2025). The largest organizations are moving AI from the project level to the oversight level. The rest of the market is doing it with a delay.
How to tell the board is too far from AI
There are five signals that are enough for a diagnosis in our practice. If at least three fit, the AI topic has slipped away from board level.
No one on the board knows which AI tools employees use. The question “what are people typing into ChatGPT today” goes unanswered.
AI is discussed in terms of fashion or threat, not value and risk. “Everyone is doing it” and “it’s dangerous” are not decision categories.
There is no single person responsible for the topic. The answer is “IT,” “innovation” or “everyone,” which means: no one.
AI investments are approved one by one, without a picture of the whole. There is no portfolio, only separate budget requests.
The board does not use AI itself. It judges it from the outside, on the basis of stories and presentations.
This list has a practical use: each of the five points indicates a specific gap and a specific move. A lack of knowledge about tools is closed with a map of the AI systems in use, a lack of an owner by naming one person with a mandate, a lack of a picture of investments by a portfolio view, and the board’s distance from AI by skills started from the top. We lay them out in the section “Where the board can start.”
What the board cannot delegate
Four decisions must stay at board level. The team will deliver analyses, options and execution, but the decision belongs to the board.
Four areas in which the decision stays with the board. Analyses, options and execution can come from below, the decision cannot.
Strategy and priorities. Where AI should create value in our business model, and where it is only cosmetic. This is the “where do we play” question, and by definition such a question is not delegated downward. The board must point to the strategic areas so the team does not prioritize blindly.
Capital allocation. AI is an investment, and investments are arranged into a portfolio, not handed out project by project. The decision on how much and in what we invest, and the strategic decision “build or buy,” belong to the board. Without it, every initiative fights for budget separately, and the company has no coherent picture of where the money goes.
Risk and compliance. Data, GDPR, the AI Act, reputation. These are company-level risks for which the board is responsible, not an individual team. The board must know where the biggest risk lies - most often it is uncontrolled shadow AI in the context of the AI Act - and what level of risk the company accepts.
Culture and adoption. People look at the board. If the board does not understand AI itself and does not use it, it is hard to expect the rest of the company to. Without sponsorship from the top, adoption gets stuck at a few percent, and the best strategy stays on paper. That is why AI adoption has to be measured with numbers, not impressions, and reported to the board like any other result.
None of these four things is technical. All of them are business. That is why the board, not IT, owns them. The line between the two is easiest to set with a table.
Decision | Board | Team, IT, vendor |
|---|---|---|
Where AI should create value, what we do not do | decides | prepares analyses and options |
Investment portfolio and the “build or buy” decision | decides | prices the variants, recommends |
Acceptable level of risk, compliance, personal data | decides and is accountable | designs and maintains controls |
Owner of the AI topic and their mandate | appoints | executes within the mandate |
Success metric of the implementation and the profitability threshold | approves before launch | measures and reports |
Choice of model, vendor, architecture | accepts the frame and limits | decides within that frame |
Order of implementations and pace | approves priorities | proposes the sequence |
Which questions about AI the board should ask
The board’s role in AI is not to know about models. It is to ask the right questions and make decisions on that basis. Here is a set worth having on the table, grouped by area.
Five areas for the board’s agenda. For each question it is worth noting not only the answer, but also who in the company knows it.
Strategy. Where can AI change our economics, and where is it only a cosmetic improvement? What happens if a competitor does it before we do? Which three to five areas are our priority, and what are we deliberately not doing now?
Data. Is our data in a state that allows sensible implementations? The biggest share of the cost and time of an implementation usually comes from the data layer, not the model itself. Who has access to our data, and do we know where it is?
Risk. Which AI tools are our people already using today, which we may not know about? Are we compliant with the AI Act and GDPR? Where is our biggest single AI-related risk, and who is responsible for it?
People. Do we have the skills in the company to do this and maintain it? Who owns the AI topic - one person, not “everyone”? What does our adoption look like in numbers, not in impressions?
Return. How do we measure whether a given implementation pays off, and do we define that metric before launch or only after the fact? Which current initiatives should we scale, and which should we close?
If the board can answer these questions in substance, it has AI under strategic control. If the answer to most is “I don’t know,” that is no reason for shame: exactly these gaps set out where to start.
A good practice is to go through this list once together, in one meeting, and for each question note not only the answer but also who in the company knows it. Very often it turns out the answers exist, they are just scattered among different people and no one has pulled them together. This exercise alone is often the first step to putting the topic in order.
What the AI Act changes in the board’s responsibility
AI Act compliance has stopped being a topic for the future, because some obligations apply today. The prohibited practices and the obligation to ensure AI skills in the organization, i.e. AI literacy under Article 4, have applied since February 2, 2025 (Regulation 2024/1689, the AI Act). The digital omnibus package postponed the obligations for high-risk systems to December 2027, but the obligation to label AI-generated content comes earlier, in December 2026.
In Poland a national layer is added to this. The Act on Artificial Intelligence Systems (Journal of Laws 2026, item 1003) has applied since August 11, 2026, and its provisions on inspections, proceedings and penalties since October 28, 2026. The supervisory authority is the Commission for the Development and Safety of Artificial Intelligence. The level of penalties comes from Article 99 of the AI Act: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% of turnover for other violations.
From October 28, 2026 the Polish supervisory authority can impose penalties calculated as a percentage of group turnover. This is a management-class risk, not an IT one.
For the board the conclusion is one: since autumn 2026 there has been an authority in Poland that can impose a penalty calculated as a percentage of group turnover. This is a management-class risk, not an IT one. The condition for controlling it is knowing which AI systems the company uses and who is responsible for them. Such a map has to be made inside the company. A starting point for the board’s discussion is our free AI Check: 20 questions, about 7 minutes, full results without email. One of its four parts covers rules and risk, including the AI Act, but it is an assessment of AI maturity, not a compliance audit or legal advice.
Hype versus paralysis: how to hold the right course
When thinking about AI, the board balances between two ditches. On one side hype: “let’s do everything, now, or we’ll fall behind.” On the other paralysis: “let’s wait until it clears up, until it’s safer.” Both end in a loss. Hype leads to chaos and burned budgets. Paralysis hands the advantage to those who act.
The scale of the first mistake is well documented. More than 80% of organizations do not see an impact of generative AI on operating results at the level of the whole company (McKinsey, 2025), and 56% of CEOs report no significant financial benefits from AI - while only 12% see both a cost effect and a revenue effect (PwC, Global CEO Survey 2026). Almost everyone spends money on AI today. A minority show a return.
You can see it at the extremes. One company launches ten AI initiatives at once so as “not to fall behind,” and after a year cannot show the board a single implementation that paid back. Another waits for the “right moment” until a competitor builds an advantage that can no longer be easily caught up with. In both cases what was missing was not courage or caution, but prioritization: a decision on what we do now, what later, and what we deliberately do not do at all.
The board’s role is to hold the course between them: conscious, prioritized action based on facts, not on fashion or fear. This is the stance of a practitioner, not of an enthusiast or a skeptic. It is worth applying it to advisors and vendors as well. An advisor who says “always implement, everything, with us” is not an advisor, but a salesperson. The value of advisory often lies in saying plainly what not to do and what to let go.
This is also the place for an independent, outside view. An advisor not tied to selling a specific tool looks at a company’s situation differently from a vendor who has its own product to sell. For the board this means recommendations based on what is good for the company, not on what happens to be in the offer. This is what we build our AI consulting and strategy on: first we understand the context and the risk, and only then do we say what makes sense and in what order.
What advisory for the board does not do. It does not replace the legal department or a law firm - we work together with them. It does not sell regulatory panic: if an area does not create significant risk for your organization, we say so plainly. It does not end with a report left on a shelf - every module ends with a decision-ready material. And we do not start work if there is no sponsor on the board, if the goal is only brainstorming, or if we do not see a sensible next step after it ends.
Where the board can start
From strategic questions to concrete moves. Here are four steps the board can start with, without engaging a big program right away.
1. Do a short Discovery or a readiness audit. Instead of guessing, start with a map: which processes, what state of data, which risks, which priorities. With us, an AI readiness audit takes 2-3 weeks and Discovery 1-4 weeks, and it ends with an implementation map with a cost estimate, not a report on potential. It is the foundation on which all further decisions stand.
2. Name the owner of the AI topic. One person with clear responsibility and a mandate from the board. Without it the AI topic will dissolve between departments, just as shadow AI spreads when it belongs to no one.
3. Set up governance and policy. Define how the company uses AI, which data goes where, and how you manage risk and compliance with GDPR and the AI Act. The minimum is three elements: an AI usage policy, a register of risks and decisions, compliance procedures. This is a topic the board must cover with oversight, not leave to chance.
4. Invest in skills, starting with the board itself. A board that does not understand AI will not ask good questions and will not reliably assess either the risk or the return. Building AI skills in the team is worth starting from the top, because it is the cheapest way to make all further decisions better. Since February 2, 2025 this is also an obligation under the AI Act, not just good practice.
A first step you can take right now: a half-day strategy workshop for the board alone. With us this is the Inspiration module, one or two sessions of four hours each. The result is three things that immediately put thinking in order: a shared language around AI, a map of three to five priorities and a list of the main risks. A small effort that turns the general “we have to do something about AI” into a concrete, agreed agenda.
It is also worth settling right away how often the board returns to the topic. AI changes fast, so a one-off discussion goes stale quickly. A standing, short item in the board’s working rhythm works better than a big annual “AI strategy” that is written once and sits in a drawer.
From questions to a system
The answers to the questions in this article are not an end in themselves. They add up to a strategy, and a strategy needs a system that will carry it out. The board sets the direction, but a direction without an operating model turns back into a set of random projects.
At WeAreFuture we base this operating model on the AI Engine, a shared company context used by people and agents: data about customers and products, procedures written down step by step and decision rules, connected to the company’s systems. We build it in stages, process by process, in a collaboration model in which an AI consultant and an AI engineer work alongside the client’s people, and every stage ends with an assessment of the effect and a decision on the next one. The board’s role is to set the direction and watch risk and return; the system’s role is to make sure that direction is carried out in a repeatable way. How it all fits into a broader AI transformation in a Polish company we describe separately.
If your board faces the question “where do we actually start with AI” today, this is exactly the moment to start from strategy, not from a tool. See our advisory modules for the board or book a call, and we will help put the AI agenda in order at board level.
Frequently asked questions
Is AI a topic for the board or for IT?
For both, but in different roles. Execution and some of the technology decisions lie with IT and the teams, while strategy, capital allocation, risk and culture are the board’s domain. Delegating everything to IT is a mistake, because it deprives AI of direction and leaves risk unsupervised at the right level.
Where should the board start with AI?
With a short Discovery or a readiness audit, which gives a map of processes, state of data, risks and priorities. Then by naming an owner of the topic, setting up governance and building skills, starting with the board itself. This lets you make decisions on facts, not on impressions or fashion.
Which questions about AI should the board ask?
The key ones are questions about strategy (where AI changes the economics), data (is it ready and who has access), risk (shadow AI, compliance with the AI Act and GDPR), people (skills, owner of the topic, adoption in numbers) and return (how we measure profitability and whether we define the metric before launch).
Does the board have to understand AI technically?
Not technically, but enough to ask the right questions and reliably assess risk and return. The board does not need to know how to build models, it needs to understand where AI creates value, where the risk lies and how to tell value from noise. Since February 2, 2025, ensuring AI skills in the organization is also an obligation under Article 4 of the AI Act.
“Build or buy”: who decides?
The strategic frame of this decision, i.e. how much we invest, what is key for us and what level of control over data is required, belongs to the board. The technical details and the recommendation are prepared by the team or an advisor. The point is that “build or buy” decisions come from a coherent strategy and are not made ad hoc, project by project.
How should the board measure the return on AI?
Through metrics defined before launch, not after the fact. Most often it is time (a shorter cycle), cost (fewer hours on repetitive tasks) or quality. It is important that every implementation has a business owner and a clear indicator. A benchmark from our practice: handling a request for quotation at a manufacturing company cut from several days to around one day.
Why does a board need an external AI advisor?
For an independent perspective not tied to selling a specific tool, for experience from many implementations in different organizations, and for speed. A good advisor will also say what not to do, which for a board is sometimes more valuable than another list of things to implement. It is worth building an internal team in parallel, but at the start an outside view shortens the road and reduces the risk of costly mistakes.
How does the AI Act change the board’s responsibility?
The prohibited practices and the AI skills obligation have applied since February 2, 2025, and the obligations for high-risk systems apply from December 2027. In Poland the Act on Artificial Intelligence Systems has applied since August 11, 2026, and the provisions on inspections and penalties since October 28, 2026; supervision is exercised by the Commission for the Development and Safety of Artificial Intelligence. Penalties reach EUR 35 million or 7% of worldwide turnover, so this is a board-level risk. This is not legal advice - confirm specific obligations with a lawyer, and do a first mapping of the situation in the free AI Act audit.
Do we need a separate AI committee on the board?
Usually not at the start. More important than a committee is naming one person responsible for the topic, setting up governance and making AI a standing item in the board’s existing working rhythm. A separate body only makes sense at greater scale and complexity - for comparison, in 2025, 40% of Fortune 100 companies assigned AI oversight to a specific board committee. At the beginning what counts is clear responsibility and regularity, not another structure.
How much does AI advisory for the board cost?
Each module has a closed scope and duration: a workshop for the board is one to two sessions of four hours each, a readiness audit 2-3 weeks, Discovery 1-4 weeks, governance 1-4 weeks. Pricing depends on the size of the organization and the scope. You can start with one module and not continue - each ends with a clear answer, not an open list of further steps.
Sources
PARP and Jagiellonian University (2026), Artificial Intelligence in Companies: readiness for adoption, skills and needs. BKL research report - 23% of companies actively use AI; 6% are pioneers using AI strategically, 46% are low-readiness companies, with no implementation strategy and no skills in the team.
McKinsey (2025), The state of AI: How organizations are rewiring to capture value - 28% of organizations name the CEO as the person overseeing AI governance, less in companies above USD 500 million in revenue; more than 80% do not see an impact of generative AI on EBIT at the organization level.
EY Center for Board Matters (2025), Cyber and AI oversight disclosures - AI as a subject of board oversight: 48% of Fortune 100 companies in 2025 versus 16% in 2024; a board committee responsible for AI: 40% versus 11%; AI in the skills of board members: 44% versus 26%.
PwC (2026), 29th Annual Global CEO Survey - 56% of CEOs see no significant financial benefits from AI, 12% report both a cost and a revenue effect.
Regulation (EU) 2024/1689 of the European Parliament and of the Council (AI Act) - Article 4 (AI skills) and the prohibited practices have applied since February 2, 2025; Article 99 sets the maximum penalties.
Act of July 3, 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003) - entry into force 14 days after publication on July 27, 2026; chapters on inspections, proceedings and penalties after 3 months from publication; supervision: the Commission for the Development and Safety of Artificial Intelligence.
WeAreFuture’s own data (2026): handling a request for quotation at a manufacturing company cut from several days to around one day; adoption of an internal AI assistant in a pharmaceutical company from limited use to regular use by most of the team after an adoption program; a full-day AI workshop for the board of an asset management company.
See also: AI transformation in a Polish company, i.e. how board decisions translate into the whole change program. And Claude AI adoption in a Polish manufacturing company - case study: what happens when the board takes the AI topic on itself and watches the numbers.
