Corporate Boards at Risk: The New AI Liability Standard
The EU delayed the AI Act's high-risk deadline by 16 months and a lot of boards exhaled. That exhale is the mistake. A moved deadline in Brussels changes nothing about director liability in Delaware, where the Caremark line of cases makes oversight of mission-critical risk a personal duty — and 'we were waiting for the EU deadline' reads badly in a deposition.
The Promise
- The delay is real where it applies. Annex III high-risk use cases — recruitment, credit scoring, the high-stakes ones — moved from August 2026 to December 2027, and Annex I product-embedded systems moved to August 2028.
- The defensible record is buildable and cheap: a recurring board agenda item, a quarterly dashboard with named risks and named owners, and directors who have actually read Articles 4 and 50.
- Boards that ask harder questions earlier survive this arc. That was true through the cyber decade, and the questions themselves are three sentences long.
The Risk
- Article 4, AI literacy for any organisation deploying AI, is already in force, and Article 50 disclosure still applies from 2 August 2026. The deployer obligations stayed on the original clock. Fines reach up to 7% of global revenue for the worst violations.
- Marchand v Barnhill (Delaware Supreme Court, 2019) revived Caremark. Blue Bell Ice Cream had a listeria outbreak, three people died, the Chancery court dismissed the claim and the Supreme Court reversed it. The case survived to discovery, and the directors faced personal liability that D&O insurance does not extinguish.
- In re McDonald's (2023) extended the same duty to officers. A chief people officer faced personal exposure for failing to oversee workplace harassment risk, and the opinion was explicit that officers owe the same oversight duty as directors, scaled to their role.
- Most enterprises have already made AI mission-critical by their own statements. The annual report says AI is core to strategy; the board minutes do not match. That inconsistency is the second Caremark prong — conscious disregard — handed to a plaintiff.
What moved, and what didn’t
The EU pushed the AI Act’s high-risk obligations back this spring. The Annex III use-case systems — recruitment, credit scoring, the high-stakes ones — moved from August 2026 to December 2027. Sixteen months. The Annex I product-embedded systems moved to August 2028.
Here is what did not move. Article 4, AI literacy for any organisation deploying AI, is already in force. Article 50, disclosure of AI use to the people affected by it, still applies from 2 August 2026. The deployer obligations stayed on the original clock, and fines reach up to 7% of global revenue for the worst violations.
The fines get the headlines. The board exposure does not.
Two jurisdictions, one trigger
The European fine is the company’s problem. The Delaware fiduciary case is the director’s problem. Different jurisdictions, different theories of liability, and the same trigger event: an AI failure the board could have asked about and did not.
In 1996 the Delaware Court of Chancery wrote the Caremark standard. In 2019, Marchand v Barnhill lowered the bar to bring a claim. In 2023, In re McDonald’s extended it to officers. None of those moved this spring, and most directors haven’t connected them to AI yet.
Marchand, and why the legal community called it a revival
Blue Bell Ice Cream had a listeria outbreak. Three people died. A shareholder filed a Caremark claim arguing the board had failed to oversee food safety — the company’s mission-critical risk. The Court of Chancery dismissed it. The Delaware Supreme Court reversed.
The case survived to discovery, and the directors faced personal liability that D&O insurance does not extinguish.
For twenty years these claims had been dismissed almost reflexively. After Marchand the standard sharpened: boards must show they actively monitored mission-critical risks. Not that a system existed on paper. That they used it.
Then In re McDonald’s extended Caremark to corporate officers, with an opinion explicit that officers owe the same duty of oversight as directors, scaled to their role.
The two prongs
Caremark is shorthand for In re Caremark International Inc. Derivative Litigation, Delaware Court of Chancery, 1996. The court created a fiduciary duty beyond ordinary business judgment: directors must make a good-faith effort to implement and maintain an information and reporting system for mission-critical risks.
The first prong is total failure — the board never put a reporting system in place. The second prong is conscious disregard — the board put a system in place and ignored the red flags it produced.
Most enterprises have already made AI mission-critical by their own statements. The annual report says AI is core to strategy. The board minutes do not match. That gap is a second-prong argument, pre-assembled.
After 25 years in cybersecurity I have watched this exact arc. Twenty years ago boards delegated cyber understanding to the technical team, and the boards that survived asked harder questions earlier. AI is following the same arc on a compressed timeline — and the delay just told every board it has more time than it does.
What each seat does now
If you are an executive, start with what D&O insurance does and does not do. Caremark liability is premised on bad faith, which is precisely the territory where coverage thins.
If you are an IT leader or a CISO, the board has just become your most important customer. It needs a flow of information from you that it can document.
If you are a director, three actions: a recurring agenda item, a quarterly dashboard, and read the EU AI Act — Articles 4 and 50 specifically.
The cybersecurity precedent is Equifax in 2017. A hundred and forty-seven million records, and a board that faced shareholder derivative litigation naming individual directors.
Three questions, out loud, on the record
One. Do we have a documented AI risk reporting cadence to the board, with named risks, named owners, and a specific monitoring schedule?
Two. Is AI written into our risk register as a mission-critical risk? Inconsistency between the annual report and the register is the second-prong argument.
Three. If a shareholder filed a Caremark claim against this board tomorrow, could we produce eighteen months of records demonstrating active oversight of AI risk?
AI oversight has crossed the line from a CIO problem to a director problem. The European deadline moved. Your fiduciary duty didn’t.