AI literacy for board directors: seven rules for using AI tools safely

Directors can build their AI skills without putting confidential information or legal privilege at risk, but only if they follow some basic safeguards. Here are seven practical rules.

Why does this matter for boards?

In a PwC Corporate Directors Survey in 2026 in the US, 71% of directors named AI as the main skill their boards need to strengthen for effective oversight. PwC comments that boards should treat AI literacy as a baseline responsibility for every director.

Trying out AI tools yourself is a good way to learn what they can do. AI literacy, though, is as much about knowing a tool's limits and how to use it safely as it is about using it more often. We expect an increase in disputes arising from the use of AI without proper safeguards. Directors who build good habits now will protect themselves and their organisations.

Protect confidentiality and privilege

1. Know what kind of tool you are using. Consumer AI tools are personal versions, free or paid, of products such as ChatGPT, Claude and Gemini. Their terms often allow the provider to keep what you enter, use it to train its models, or have it reviewed by staff. The same risks can apply to embedded AI features in tools you already use, such as AI search in web browsers, AI assistants in email or office software, and meeting transcription tools. Many products come in both consumer and business versions, so what matters is the version you are using, not the brand or whether you pay for it. Entering or uploading confidential information into a consumer AI tool could put it outside your control, breach confidentiality and risk the loss of legal privilege.

2. Use enterprise-grade AI tools for confidential work. Only use enterprise-grade AI tools for confidential or privileged material. These are business versions of AI tools whose terms prevent the provider from using your data to train its AI models, limit how long it keeps your data, and keep your data confidential. Check the terms before you use a tool for board work. If you do not have access to an enterprise-grade tool, do not use AI for legal or other confidential matters. Where the organisation has an AI policy, familiarise yourself with it and follow it. 

3. Keep legal advice out of consumer AI tools. Do not use consumer AI tools to summarise, review or translate advice from your lawyers. If the advice is long or complex, ask your lawyers for a short summary instead. Do not use consumer AI tools to record or transcribe calls or meetings with your lawyers.

4. Remember that AI is not your lawyer. Your exchanges with an AI tool, and anything it produces, are not communications with a lawyer, so you cannot assume that legal professional privilege will protect them.

Think ahead to litigation

5. Involve your lawyers before using AI for court or regulatory documents. Do not use any AI tool to draft or prepare documents for court or regulatory proceedings without your lawyers' input first. In many jurisdictions (including England and Wales), some documents, witness statements in particular, must not be prepared using AI.

6. Treat your AI use as a record. Your prompts, chat histories and AI-generated outputs are all documents. Like any other document, they may have to be retained, and potentially disclosed in litigation. This applies equally to tools and accounts you use personally.

Keep your judgement in charge

7. Form your own view and check AI output. Use AI to test and refine your view, not to form it. As a director, judgement and responsibility remain yours. AI can also "hallucinate", producing confident answers, figures or sources that are wrong. Never rely on AI output as it stands: check facts, figures and sources against the original material and look for what AI may have missed.

What should boards do now?

• Agree which AI tools directors may use for board work. Consider whether the organisation should give directors access to an enterprise-grade tool, so they don't have to source their own.
• Require material presented to the board to state where AI has been used and to confirm it has been checked by the person responsible.
• Consider confidentiality, privilege and disclosure issues before introducing AI into board processes, such as board portals.
• Bring AI records within document retention policies and litigation holds.
• Make safe and responsible AI use part of director training.

Key takeaway: Build your AI skills on enterprise-grade AI tools, and keep confidential and privileged material out of consumer AI tools. Check everything and never let AI replace your judgement.