Executive Summary & Fiduciary Governance Matrix
Governance Imperative: As Artificial Intelligence (AI) and Large Language Models (LLMs) become integrated into executive workflows, corporate directors and officers must navigate heightened fiduciary, confidentiality, and regulatory exposures. This Policy establishes explicit boundaries governing platform selection, deliberative privilege, cognitive diligence, and algorithmic oversight to safeguard corporate integrity and maintain robust fiduciary compliance.
Document ID:
POL-GOV-2026-AI01
Effective Date:
August 2026
Revised Date:
September 2026
Target Scope:
Directors, Trustees, Committee Chairs & Officers
Adopting Body:
Board of Directors & Governance Committee
Review Cadence:
Annually / Upon Appointment
Governing Standard:
MGA Fiduciary Governance Standard v1.0
Jurisdiction / Context:
DGCL § 141(e) / ICA 1940 § 15(c) / SEC Rule 2a-5
| Policy Domain |
Core Fiduciary & Legal Mandate |
Operational Restriction / Safe Harbor |
Compliance Verification |
| Platform Security & Confidentiality |
Duty of Loyalty & Duty of Confidentiality; protection of Material Non-Public Information (MNPI). |
Strict prohibition of consumer-grade AI tools; mandatory use of single-tenant enterprise sandboxes with Zero-Data-Retention (ZDR). |
Annual enterprise license audit; prompt sanitization protocols. |
| Deliberative Privilege & Records |
Preservation of attorney-client privilege; maintenance of the official corporate record; 2026 court precedents. |
Prohibition of virtual AI notetakers during executive sessions/legal discussions; permanent deletion of raw audio/transcripts upon minutes approval. |
Corporate Secretary minutes certification; integration with litigation hold procedures; counsel direction. |
| Fiduciary Diligence Standards |
Duty of Care; non-delegability of cognitive oversight (DGCL § 141(e); ASIC v. Bekier standard). |
AI outputs restricted to decision-support only; mandatory human-in-the-loop (HITL) interrogation of full board packs. |
Documented board inquiries; contemporaneous records of anomaly reviews (Boeing defense). |
| Algorithmic & Regulatory Scrutiny |
Section 15(c) ICA 1940 compliance; SEC Rule 2a-5 Fair Valuation; Anti-'AI Washing' enforcement; Aegon precedent. |
Independent validation of adviser algorithms; verification of public AI disclosures against operational practice. |
Annual 15(c) algorithmic conflict reviews; independent valuation model testing; separation of creator/validator. |
| Service Provider Oversight (NEW) |
Adviser vendor due diligence; K&L Gates 2026 guidance; contractual AI warranties and risk management. |
Mandatory quarterly written inquiries of all fund service providers; contractual ZDR and training prohibitions. |
Quarterly AI Oversight Report to board; service provider AI inventory; audit rights verification. |
1. Purpose & Scope
This Policy establishes the governing framework, data boundaries, and fiduciary compliance protocols for all directors, executive officers, and corporate secretaries using Artificial Intelligence (AI) and Large Language Models (LLMs) to support boardroom operations.
The scope of this Policy encompasses all board-level activities, including but not limited to: pre-meeting board pack analysis, committee briefing preparations, draft resolution reviews, strategic scenario modeling, financial disclosure cross-checks, and internal board communications. Adherence to this Policy is mandatory across all standing committees, including the Audit, Nominating & Corporate Governance, Compensation, and Risk Oversight Committees.
2. Platform Segmentation and “Prompt Hygiene”
Absolute Prohibition of Consumer Platforms: Under no circumstances shall any director or officer upload corporate records, financial sheets, or non-public materials into public, consumer-grade AI systems (e.g., standard public ChatGPT, personal accounts). Doing so exposes Material Non-Public Information (MNPI) to external model training and public breaches, violating the fiduciary Duty of Loyalty and Confidentiality.
Mandatory Enterprise Sandboxes: All board-level AI analysis must be conducted strictly within private, single-tenant, enterprise-gated workspaces (e.g., Claude Team, ChatGPT Business/Team, or Microsoft Copilot in-tenant). These platforms must possess contract-level zero-data-retention (ZDR) and “no-training” clauses.
BOARDROOM PROMPT HYGIENE & DATA MINIMIZATION PROTOCOLS:
- • Prompt Sanitization: Directors must avoid including unredacted individual names, social security numbers, bank routing coordinates, or proprietary project code names in prompts.
- • Context Minimization: Query inputs should be restricted to the minimal context necessary to obtain analytical assistance, utilizing generalized descriptions where feasible.
- • Access Controls: Enterprise sandbox credentials must be protected via multi-factor authentication (MFA) and restricted strictly to authorized corporate personnel.
3. Preserving Deliberative Candor and Attorney-Client Privilege
AI Notetakers and Verbatim Recording Restrictions: Automated meeting assistants and virtual recording tools (e.g., Otter.ai, Fireflies.ai) are strictly prohibited during formal executive sessions or any discussions involving legal counsel. This prevents the waiver of attorney-client privilege in discoverable transcript texts. Using AI to record or transcribe meetings can create a detailed, lasting governance record that may be discoverable in litigation and could chill robust and open board deliberations.
Sole Official Legal Record: The approved, condensed, human-drafted meeting minutes remain the sole official legal record of proceedings. Under Delaware law, drafts of minutes prepared by lawyers are privileged; however, exchanges with a chatbot may be discoverable and should not be treated as privileged communications.
Mandatory Deletion of Raw Audio and Drafts: All raw meeting audio, video, automated transcripts, and intermediate AI-generated draft minutes must be permanently deleted immediately upon formal approval of the minutes. This deletion protocol must be integrated with the company's litigation hold framework; if a legal hold is active, automatic deletions must immediately suspend.
Attorney-Client Privilege & GenAI — 2026 Court Precedents ★ NEW
Three significant 2026 federal court decisions clarify the boundaries of privilege and work product protection when board members, directors, or employees use AI tools:
- • United States v. Heppner (S.D.N.Y.): A defendant's self-directed communications with a publicly available AI platform — including consumer Claude — were held not protected by attorney-client privilege or the work product doctrine. The AI was a general consumer tool; the user was not an attorney; the work was not performed at counsel's direction; and the outputs were later shared with counsel rather than prepared at counsel's behest. Privilege and work product protection may be lost when consumer AI tools are used by directors without appropriate attorney-directed safeguards.
- • Warner v. Gilbarco, Inc.: In contrast, AI-generated materials used by a pro se plaintiff were held subject to work product protection because the AI program was used as a tool in the plaintiff's internal drafting process and analytical thought process, and the materials were prepared in anticipation of litigation and not disclosed to an adversary. The plaintiff did not waive work product protection merely by using an AI tool.
- • In re OpenAI, Inc. Copyright Infringement Litigation: A company-generated spreadsheet documenting employee-crafted prompts to and outputs from a large language model was held not protected by attorney-client privilege. By contrast, internal communications recounting legal questions previously communicated to in-house counsel retained their protection. The emerging consensus treats AI tools as instruments, with privilege turning on who directed the AI use and whether materials reflect litigation strategy or mental impressions.
Practical Implication: Directors must use only board-approved enterprise AI platforms — never consumer-grade tools — for any board-related analytical work. Before using AI for any litigation-sensitive analysis, directors should consult with fund counsel. Counsel direction is the key determinant for privilege protection.
4. Fiduciary Duties & Legal Standards of Diligence
Non-Delegability of Judgment: AI is a decision-support input, not a decision-maker. Directors are fiduciaries under Delaware General Corporation Law (DGCL) § 141(e) and cannot delegate their cognitive due diligence duties to machine-learning code.
The Carey Care Standard (ASIC v. Bekier): Under common law standards of care, using AI-generated executive summaries as a substitute for reading, analyzing, and interrogating the full board pack is a breach of the fiduciary Duty of Care. All AI summaries must undergo human-in-the-loop verification.
The Boeing “Yellow Flag” Defense: To align with the August 13, 2026 Court of Chancery Boeing precedent, documented board reviews of model drift, algorithmic anomalies, or active remediations are classified as “yellow flags” (evidence of a functioning oversight system) rather than disloyal “red flags”. The board must keep contemporaneous records of investigations and follow-ups to maintain this safe harbor.
5. Algorithmic Scrutiny & Regulatory Compliance
Vetting Adviser Algorithms (Section 15(c)): Independent fund boards should consider in their annual contract reviews requesting written documentation proving that the adviser's proprietary portfolio-selection, trade routing, and alpha-generation models do not contain structurally embedded conflicts of interest (e.g., optimizing for adviser revenue over shareholder welfare).
SEC Rule 2a-5 Fair-Valuation: For alternative or illiquid assets valued using algorithmic or third-party AI inputs, the board should request independent mathematical model validation.
Anti-AI-Washing Mandates: To prevent civil and personal regulatory liability under the SEC Marketing Rule (Rule 206(4)-1) and inter-agency enforcement campaigns (e.g., FTC Operation AI Comply), directors should consider independently verifying the substantiation of all public AI marketing disclosures.
SEC Enforcement Precedent — Quantitative Model Risk Management ★ NEW
While direct GenAI enforcement precedent remains limited, the SEC's enforcement action against Aegon USA Investment Management and Transamerica provides directly analogous guidance. Those firms failed to validate the quantitative models steering portfolio decisions and failed to supervise a junior analyst who created and relied on those models. Although no GenAI was involved, the case underscores why rigorous model supervision matters and illustrates that overseeing AI is fundamentally a classic risk management exercise — not a novel, technology-specific obligation.
Boards should satisfy themselves that the adviser has in place: (i) independent validation of any AI or quantitative model steering investment decisions; (ii) separation of duties between model creators and model validators; and (iii) documented escalation procedures when models exhibit drift, anomalous outputs, or material deviations from expected performance.
6. Emerging Boardroom Risk Pressures (2026)
- • SEC Rule 14a-8 No-Action Suspension: Because the SEC has discontinued issuing no-action letters for shareholder proposals, the Nominating & Governance Committee should evaluate and exclude proposals (including those demanding AI risk audits) with appropriate legal analysis, mitigating exposure to adverse proxy advisor recommendations.
- • FinCEN CTA BOI Exemption: Compliance teams shall monitor the permanent rollback of beneficial ownership reporting for domestic entities to optimize the corporate compliance registry.
- • D&O Policy Audit: The board should periodically review its Directors and Officers (D&O) liability insurance to ensure there are no exclusions for regulatory actions or civil claims arising from automated, algorithmic decisions.
- • 2026 SEC Regulatory Outlook — No Single AI Rule: Brian Daly, Director of Investment Management at the SEC, has made multiple 2026 statements indicating that he does not expect a single "AI Rule." Instead, GenAI use should align with existing, technology-neutral compliance requirements — fiduciary duty, the Marketing Rule, books and records obligations, and written policies and procedures. Boards should not wait for AI-specific rulemaking before implementing rigorous governance frameworks. ★ NEW
- • GenAI Books and Records Consideration: Boards should direct management to assess whether AI prompt inputs and outputs constitute required books and records under applicable securities laws. Until that assessment is documented, AI-generated outputs used in decision-making should be retained consistent with the firm's general record retention schedule, unless a more specific legal hold or regulatory requirement applies. ★ NEW
- • Board AI Literacy Development: The board should pursue a continuing AI education curriculum. Directors need sufficient literacy to evaluate management's AI disclosures, ask informed questions of service providers, and exercise independent judgment when AI outputs are presented as decision support. Blanket prohibitions on AI are not practical; informed, policy-governed engagement is the appropriate fiduciary response. ★ NEW
7. Policy Administration & Annual Compliance Attestation
This Policy shall be administered under the joint supervision of the Nominating & Corporate Governance Committee and the Fund Chief Compliance Officer. All sitting directors, newly appointed board members, and executive officers must execute an annual written attestation confirming their understanding of, and strict adherence to, these boardroom AI governance standards.
ANNUAL BOARDROOM AI FIDUCIARY COMPLIANCE ATTESTATION
MGA Standard v1.0
"I hereby certify that I have read, understand, and agree to strictly comply with the Boardroom AI-Use Policy, including the absolute prohibition of consumer-grade AI tools for non-public data, the restriction of AI notetakers in privileged sessions, and the requirement for human-in-the-loop diligence."
Governing Standard: MGA Fiduciary Governance Standard v1.0
Attestation Cadence: Annual / Upon Appointment
Director / Officer Name:
Title / Board Role:
Signature & Date: Date:
8. Service Provider AI Oversight & Quarterly Reporting
★ NEW
Mandatory Quarterly AI Inquiries of Fund Service Providers
REQUIRED PRACTICE: The investment adviser shall conduct at least quarterly written inquiries of all fund service providers and vendors regarding their use of artificial intelligence in the delivery of contracted services, including any ad hoc AI-related deployments or requests. The aggregated results of such inquiries shall be reported to the fund board at each regularly scheduled quarterly board meeting.
Questions Boards Should Require Advisers to Ask Service Providers
As part of each quarterly inquiry, the following questions — drawn from K&L Gates guidance (September 2, 2026) — should form the minimum baseline for service provider AI diligence:
- • Model Training & Data Provenance: How is your AI model being trained, and where does your training data come from? How do you protect against bias in your AI outputs?
- • Output Accuracy & Hallucination Monitoring: How do you ensure the accuracy of AI-generated outputs? Who monitors for hallucinations, and what verification processes are in place?
- • Client & Fund Data Safeguards: How is client and fund data handled within your AI systems? What systems and safeguards prevent data leakage, and how is data stored and retained?
- • Compliance & Independent Oversight: What compliance and monitoring systems govern your AI deployment? Are those systems documented and subject to independent review?
- • Disclosure & Regulatory Approvals: How is your AI usage disclosed to fund clients and counterparties? Are there any regulatory approvals or restrictions applicable to your AI tools?
Service Provider AI Usage Inventory
The adviser shall maintain and deliver to the board a current inventory mapping each material service provider's: (i) AI tools and applications in use; (ii) contracted and actual use cases; (iii) data inputs fed into AI systems; (iv) risk controls and validation procedures; and (v) any prior instances of AI-related errors, hallucinations, or anomalous outputs. Material changes in a provider's AI deployment shall be reported to the board promptly and shall not await the next quarterly cycle.
Contractual AI Provisions in Vendor Agreements
All new and renewed service provider agreements should include the following AI-specific provisions:
- • AI Training Data Restrictions: Explicit prohibition on training any foundation or fine-tuned model on fund, client, or proprietary data.
- • Zero-Data-Retention (ZDR) Commitments: Contractual obligation that fund data is not stored by the vendor's AI systems beyond the duration of the specific query or session.
- • Model Disclosure Requirements: Provider must disclose all AI tools used in delivering contracted services, including any material changes or new deployments.
- • Hallucination Risk Acknowledgment: Provider must acknowledge AI accuracy limitations, describe their hallucination detection and correction processes, and accept responsibility for verifying AI outputs before delivery.
- • AI-Specific Data Breach Notification: Provider must notify the fund within a specified timeframe of any AI-related data incident, model compromise, or unauthorized access.
- • Audit Rights: Fund retains the right to audit or commission an independent audit of the provider's AI governance controls and compliance with the above provisions.
Model Risk Management Oversight Framework
Consistent with the SEC's enforcement posture (Aegon/Transamerica) and K&L Gates guidance, the board should satisfy itself that the adviser maintains a documented AI risk management framework that addresses, at minimum:
- • Governance: Clear ownership and accountability for each AI tool and model used in fund operations.
- • Identification & Mapping: A current inventory of all AI applications across the adviser's own operations and all material service providers.
- • Supervision & Monitoring: A regular supervisory cadence — no less than quarterly — for each AI deployment, including review of accuracy metrics, drift indicators, and usage logs.
- • Escalation Protocols: Documented “stop-button” and escalation procedures to override, suspend, or remediate any AI model exhibiting anomalous, drifting, or inaccurate outputs.
- • Board Reporting: A standardized quarterly AI Oversight Report to the board summarizing service provider AI inquiries, material changes, identified risks, and remediation actions taken.
Policy Revision History
| Policy Revision |
Adoption / Review Date |
Governing Committee |
Primary Notes / Key Amendments |
| v1.1 (Revised) |
September 2026 |
Board of Directors / Nom & Gov |
Incorporated 2026 federal court precedents on attorney-client privilege (Heppner, Gilbarco, OpenAI), SEC model risk precedent (Aegon/Transamerica), SEC Director Brian Daly 2026 outlook, and added Section 8 governing mandatory quarterly service provider AI inquiries and vendor contractual safeguards. |
| v1.0 (Initial Release) |
August 2026 |
Board of Directors / Nom & Gov |
Formal adoption of Enterprise AI sandboxes, 15(c) algorithmic reviews, and Boeing defense safe harbor. |
No Professional Legal, Accounting, or Investment Advice: Information contained in this policy framework does not constitute legal, accounting, tax, or investment advice, nor formal legal opinions. Information contained does not create an attorney-client, auditor-client, or advisory engagement relationship.
© 2026 MARESCA GOVERNANCE ADVISORS | MARESCAGOVERNANCE.COM | ALL RIGHTS RESERVED
Scan vCard