AI Adoption Outpaces Trust, Raising New Questions About Director Liability

OXFORD, June 3, 2026 — The rapid integration of artificial intelligence into corporate decision-making is exposing significant gaps in traditional legal standards governing directors' responsibilities, according to new research published by legal scholar Giovanni Vetrugno.

As companies increasingly incorporate AI into strategic and operational processes, legal frameworks designed for human-led decision-making are struggling to keep pace. A recent KPMG study found that 66% of users regularly rely on AI tools, yet only about half trust AI-generated outputs enough to use them in operational decisions. Meanwhile, PwC research indicates that nearly half of technology leaders now consider AI fully integrated into their corporate strategies.

The disconnect between adoption and trust, experts say, has important implications for corporate governance.

"Adoption has outpaced trust," Vetrugno argues. "More importantly, it has outpaced the conceptual tools that govern director liability."

The challenge is particularly evident in jurisdictions such as Italy, where director duties are governed by legal standards developed decades before the emergence of advanced algorithms. Article 2392 of the Italian Civil Code, drafted in 1942, requires directors to exercise diligence appropriate to their role. However, the law assumes that business decisions can be understood, evaluated, and reconstructed by human decision-makers.

Modern AI systems challenge that assumption.

Machine-learning models often operate as "black boxes," producing outcomes that may be difficult to explain even for their developers. This creates uncertainty about what constitutes sufficient oversight when directors authorize or rely on AI-driven decisions.

The issue becomes more complex under the business judgment rule, a legal doctrine that generally protects directors from liability when decisions are made in good faith and on an informed basis. Critics argue that directors may struggle to meet the "informed" standard when key decisions are influenced by algorithms whose internal processes are not fully transparent.

In response, Vetrugno and co-author Sottoriva have proposed a new governance framework known as the TRACE Model, designed to help boards manage AI-related risks without requiring directors to become technical experts.

The framework is built around five principles:

• Transparency – ensuring boards have clear documentation explaining what AI systems do, their limitations, and how they fit into company operations.
• Risk Assessment – continuously evaluating potential biases, system failures, and performance degradation over time.
• Audit Trail – maintaining records that allow companies to reconstruct how AI-assisted decisions were reached.
• Competence – ensuring boards collectively possess the expertise needed to oversee AI through training, advisory committees, or specialist directors.
• Ethics – integrating AI governance into broader environmental, social, and governance (ESG) responsibilities.

According to the authors, the focus should shift from assessing whether directors personally understand complex algorithms to evaluating whether appropriate governance structures are in place.

Although developed with Italian law in mind, the framework addresses concerns emerging across multiple jurisdictions. In the United States, Delaware's Caremark doctrine requires boards to establish oversight systems capable of identifying compliance failures. Similar duties exist under the UK's Companies Act 2006, while German legal scholars have begun discussing concepts of "digital diligence" for corporate directors.

The researchers argue that AI governance should be viewed as an extension of existing oversight obligations rather than as a completely new category of legal responsibility.

As AI adoption continues to accelerate, courts around the world may soon be called upon to determine how traditional director duties apply when algorithms play a central role in corporate decision-making.

"The standard of director diligence is not broken," Vetrugno concludes. "It does, however, need to be read in light of the technologies it is now asked to govern."

Legal experts say the next major AI-related corporate failure could provide the first significant test of those evolving standards.

https://blogs.law.ox.ac.uk/oblb/blog-post/2026/06/directors-and-ai-why-diligence-needs-new-framework