What must Directors do When Their Company Adopts AI?
Directors must ensure that the adoption of artificial intelligence aligns with their statutory duties under the Corporations Act 2001 (Cth), particularly the duty to act with care and diligence. This requires implementing governance measures such as board-level risk oversight, due diligence on data inputs, and ongoing monitoring of AI performance.12
The Australian Institute of Company Directors (AICD) advises that effective AI governance frameworks include human oversight mechanisms and regular evaluation of AI outputs for reliability and bias.1 For example, a healthcare provider using AI to triage patient inquiries must verify that the system's training data is representative and that clinical decisions remain subject to qualified review. A property developer employing AI to forecast market demand should assess whether the model accounts for local planning laws and economic indicators. Failure to embed these safeguards may breach s 180 of the Corporations Act 2001 (Cth), which imposes a duty of care and diligence measured against what a reasonable director would do in the same circumstances.
How does the Duty of Care Apply to AI Adoption?
The duty of care and diligence under s 180 of the Corporations Act 2001 (Cth) requires directors to exercise the degree of care and diligence that a reasonable person would exercise in the circumstances, including when overseeing the adoption and use of AI. This includes taking reasonable steps to ensure they are informed about how the technology works, its limitations, and potential legal or operational consequences. Failure to do so may breach their statutory duty.3
Courts assess whether a director acted with the care and diligence that a reasonable person in their position would exercise. In Vines v Australian Securities and Investments Commission [2007] NSWCA 75, the Court of Appeal confirmed that directors must inform themselves about significant matters that could affect the company's operations or compliance posture.3 A healthcare provider using an AI diagnostic tool must ensure directors understand its accuracy limits and regulatory implications under health privacy laws. A property developer deploying AI for tenant screening must verify the system complies with anti-discrimination laws. These scenarios fall squarely within AI governance and directors' duties, where oversight gaps can expose directors to personal liability for losses arising from unchecked AI deployment.
Why can Poor AI Oversight Lead to Liability?
Poor AI oversight can expose directors to personal liability because the duty of care and diligence under s 180 of the Corporations Act 2001 (Cth) requires them to exercise the degree of care and diligence that a reasonable person would exercise in the circumstances, including when overseeing new technologies such as AI. Failure to do so may constitute a breach of statutory and common law duties, as courts assess whether directors took reasonable steps to inform themselves about significant operational changes.3
In Vines v Australian Securities and Investments Commission [2007] NSWCA 75, the Court of Appeal held that directors must actively engage with emerging risks that could affect the company's financial position or legal compliance. A healthcare provider using an AI tool to triage patient inquiries without validating its accuracy could breach s 180 if the system provides misleading advice that harms patients or triggers regulatory penalties. A property developer relying on an untested AI model to forecast project costs might face claims if the inaccuracy leads to insolvent trading under s 588G. These scenarios illustrate how gaps in AI governance, such as skipping independent validation, ignoring bias audits, or failing to monitor outputs, can create legally actionable failures.
What Governance Steps Satisfy Directors' Duties?
Directors satisfy their statutory duties by implementing board-level governance frameworks that actively oversee AI adoption, including risk assessment, human oversight, and ongoing performance monitoring. This approach aligns with the duty of care and diligence under Corporations Act 2001 (Cth) s 180 and ensures decisions about AI are informed and diligent.1
The AICD advises that effective governance requires due diligence on data sources and clear accountability for AI outcomes.2 A healthcare company using AI to triage patient inquiries must ensure clinicians retain final decision-making authority and that the system is regularly tested for accuracy. A property developer deploying AI to forecast market demand should validate inputs against independent data sets and document board reviews of model limitations. These steps demonstrate the active oversight expected under s 180, which obliges directors to act with the care and diligence that a reasonable person would exercise in the same role.1
What should Directors Review Before Adopting AI?
Directors should review whether proposed AI systems align with their statutory duties under the Corporations Act 2001 (Cth), particularly the duty of care in s 180 and the duty to act in good faith under s 181. This includes verifying that adequate risk assessment, human oversight, and performance monitoring are embedded in the company's AI governance framework.1
Board-level oversight must extend to due diligence on data sources and the integration of AI within existing risk management systems.2 A healthcare company using AI to triage patient inquiries must ensure the system does not generate misleading advice that could breach the Australian Consumer Law or compromise clinical safety protocols. A property developer deploying AI for lease analysis should confirm the tool's outputs are regularly validated against actual tenancy agreements.
Review checklist:
- Whether the AI implementation includes documented risk assessments aligned with the company's risk appetite;
- If human oversight mechanisms are in place to review high-stakes AI decisions;
- That performance monitoring tracks accuracy, bias, and compliance with legal obligations over time.
These steps form part of sound AI governance and sit squarely within directors' duties under Commonwealth law.