NACD’s Blue Ribbon Commission gave boards a clear mandate: govern technology with greater insight, oversight, and foresight. But knowing what to do and having the infrastructure to do it are two very different things.
If you serve on a board, you’ve probably seen the report - or at least heard the headlines. NACD’s most recent Blue Ribbon Commission report, Technology Leadership in the Boardroom: Driving Trust and Value, identified six converging forces that demand stronger board-level technology governance and offered ten recommendations to address them.
The recommendations are solid. Upgrade board structures. Define decision-making authorities. Establish clear technology metrics. Ensure directors maintain proficiency with emerging technologies. Enable exploratory discussions between the board and management.
Read that list and most directors nod along. Then they open their next 200-page board pack and nothing changes.
That’s not because directors don’t care. It’s because the report answers what boards should do without fully addressing how - especially now, when the technology governance challenge has become primarily an AI governance challenge.
The Urgency Has Outpaced the Recommendations
The Commission identified “innovations outpacing board member experience” as one of its six governance drivers. That was true when they published their findings. It’s dramatically more true now.
Generative AI has moved from boardroom curiosity to enterprise-wide deployment in a matter of months. Directors who were just getting comfortable discussing cloud strategy and cybersecurity are now expected to govern AI adoption, algorithmic risk, data privacy at scale, regulatory uncertainty across jurisdictions, and workforce disruption - often in a single meeting.
Here’s the math that makes this hard: a director spends maybe four to six hours preparing for a board meeting. In that time, they need to absorb the financials, understand operational updates, review committee materials, and now also develop informed positions on whether management’s AI strategy is sound, whether the organization’s liability exposure has been assessed, and whether third-party AI vendors have been properly vetted.
The NACD recommendations tell boards to “establish and maintain necessary technology proficiency.” But proficiency in what? The AI landscape shifts between the time board materials are distributed and the time the meeting starts. How do you maintain proficiency in something that changes weekly?
The Preparation Gap Is the Governance Gap
This is the disconnect we see with every board we talk to. The aspiration is clear: directors want to govern technology - especially AI - with the rigor these decisions demand. The reality is that traditional preparation methods make it nearly impossible.
Consider what the BRC report asks when it recommends “enabling exploratory board and management technology discussions.” That’s a great recommendation. But exploratory discussions require directors who’ve done enough preparation to explore. If you’re still trying to understand the basics of what management presented, you’re not exploring - you’re catching up.
Or take “clearly define the board’s role in data oversight.” That requires directors who understand their organization’s data architecture, regulatory obligations, and competitive exposure well enough to set meaningful boundaries. Not at an engineering level - but at a level that goes well beyond skimming the CTO’s five-page summary in the board pack.
The pattern repeats for every recommendation. Each one assumes a level of director preparedness that the traditional board cycle - static materials, limited prep time, quarterly cadence - simply doesn’t support. The recommendations aren’t wrong. The infrastructure to execute them doesn’t exist for most boards.
What Operationalization Actually Requires
If you take the ten recommendations seriously, what would it actually take to implement them? We’ve mapped this against our 6 C’s framework - Consume, Comprehend, Contextualize, Challenge, Collaborate, and Confidence - because the gap between recommendation and practice is ultimately a preparation gap.
“Ensure trustworthy technology use aligned with organizational purpose and values.” This requires directors who can Contextualize - who understand not just the AI initiative in front of them, but how it connects to the organization’s risk appetite, strategic direction, and the regulatory environment that may look completely different six months from now.
“Establish and maintain necessary technology proficiency.” This is a Comprehend problem. Directors don’t need to become technologists. But they need to understand AI well enough to ask whether management has stress-tested a deployment for bias, whether data governance practices are adequate, or whether the organization’s approach to AI aligns with emerging regulatory expectations. That understanding doesn’t come from a one-time briefing. It comes from preparation that builds knowledge cumulatively, meeting over meeting.
“Enable exploratory board and management technology discussions.” This requires the full stack: directors who’ve Consumed the materials deeply enough to Comprehend them, Contextualized them against prior decisions and external developments, and arrived with the Confidence to Challenge management constructively - while being prepared to Collaborate with fellow directors who bring complementary expertise.
“Design board calendars and agendas to ensure focus on forward-looking discussions.” Even a perfectly designed agenda fails if directors haven’t prepared to engage with it. Forward-looking discussions about AI strategy, competitive positioning, and technology-driven transformation require directors who’ve done enough preparation to think ahead - not directors still processing last quarter’s metrics.
The AI Governance Irony
There’s something uncomfortable about the current situation that’s worth naming directly.
Boards are being asked to govern AI. To ensure it’s trustworthy. To set guardrails. To evaluate whether management is deploying it responsibly. And they’re trying to do this using a preparation process that hasn’t fundamentally changed since board packs went digital fifteen years ago.
Meanwhile, directors who recognize that AI could help them prepare better face a security problem: consumer AI tools aren’t safe for confidential board materials. Paste your board pack into ChatGPT and you’ve created training data exposure, compliance violations, and a trust problem with management that undermines the very governance relationship you’re trying to strengthen.
The irony is pointed: the same technology boards need to govern could help them govern more effectively - if deployed with appropriate security, within appropriate governance boundaries, in service of director preparation rather than as a replacement for director judgment.
From Aspiration to Practice
The NACD Blue Ribbon Commission produced exactly the kind of thoughtful, actionable guidance the governance community needs. The ten recommendations are a clear articulation of where boards should be heading.
But recommendations without infrastructure are just aspirations. And for most boards, the infrastructure gap is real. They don’t have preparation tools that build cumulative knowledge. They don’t have secure AI that respects the confidentiality of board materials. They don’t have systems that connect today’s AI governance discussion to last quarter’s data privacy review to the regulatory developments that emerged last week.
That’s the gap we built Aureclar to close. Not to replace the thinking directors need to do - that’s still the job - but to provide the governance preparation infrastructure that makes NACD’s recommendations operationally possible. Every meeting. Not just when someone remembers to try harder.
Your board has the recommendations. The question is whether it has the tools to act on them.
The NACD Blue Ribbon Commission report, Technology Leadership in the Boardroom: Driving Trust and Value, and its executive summary are available through NACD. The full report is accessible to NACD members.
Aureclar helps boards operationalize governance best practices - starting with preparation. See how it works