On 16 April 2026, the Australian Institute of Company Directors released its 1H 2026 Director Sentiment Index — the half-yearly check on what 828 sitting directors actually think. The headline economic data was widely covered: rising business costs, RBA monetary pressure, regulatory drag on productivity. The AI strand of the survey was reported less, but it is the strand that matters most at board level. Almost two-thirds of directors report AI is already delivering productivity benefits inside their organisations. More than 80% expect implementation to accelerate. And more than half of the same group say the pace of AI change exceeds the organisation's capacity to govern it. Regulatory expectations top the emerging-risk cluster. Cyber misuse of AI is the single highest-ranked emerging risk on the register.
The view from the executive chair is the same picture from a different angle. BCG's recent CEO survey found that 61% of CEOs feel their boards are rushing them on AI transformation. So directors say the pace exceeds the organisation's capacity, and CEOs say their boards are pushing them faster than they can responsibly move. Both groups are right and both groups are wrong. The shared problem they are describing is not strategy and not technology — it is governance capability. The board cannot calibrate pace because the board cannot read the risk. The CEO cannot get clean direction because the board does not yet have the literacy to give it.
The window for treating this as a 2027 problem is closed. In the eight weeks before and after the DSI was published, APRA wrote to every regulated bank, insurer and super fund naming third-party AI vendor opacity as the widest governance gap and reserving the right to take stronger supervisory action and, where appropriate, pursue enforcement. ASIC followed with a letter to AFSL/AFSR licensees requiring it be tabled at the risk governance committee. The Privacy Act's APP 1.7 automated decision-making transparency obligations commence on 10 December 2026 — roughly 30 weeks from today. The AICD and the Governance Institute issued a joint statement on AI in board minute-taking. Five forcing functions in twelve weeks. The directors saying "pace exceeds capacity" are not making a complaint — they are surfacing a duty-of-care problem they have not yet fixed.
What the DSI is really doing is asking the profession to look at itself. It is the AICD's own members telling the AICD they are behind. That carries a weight a regulator letter does not. ASIC can be debated. APRA can be litigated. A peer-reviewed sentiment index of 828 of us cannot be hand-waved at the next chair's dinner. The honest reading is that the standard for an AI-literate director has moved sharply in the last 18 months, and most of us — including those of us holding the GAICD — are not yet meeting it. The question is no longer whether to lift. The question is which directors do the lifting, and how quickly.
- If 50% of us are operating behind the pace on AI by our own admission, where am I personally in that distribution — and what is the honest evidence for the answer I just gave?
- When did this board last receive an AI register, with named owners, materiality thresholds, and an explicit list of shadow systems we discovered after the fact rather than authorised at the start?
- The DSI ranks cyber misuse of AI as the top emerging risk. What is our specific protocol if a deepfake of our CEO instructs finance tomorrow morning to release a payment — and when was the last time we tested it end-to-end?
- If our CRO walked into this meeting and named the three AI-related leading indicators they monitor for model drift, prompt injection, or vendor concentration, could they do it? If not, what is the 90-day plan to close that gap before we say it again to APRA?
- APP 1.7 commences 10 December 2026. Has anyone in management produced a current inventory of every automated decision-making process this company runs that involves personal information — and is that inventory with the privacy team, or still in someone's head?
- When was the last time a director on this board, myself included, used AI to interrogate a board paper before the meeting — and what did that exercise change about how we read the paper?
- The AI policy was approved 18 or more months ago and has not been substantively reviewed since. By DSI standards, that document is a museum piece — model capability and the regulatory perimeter have both moved hard.
- The board's response to the DSI is to schedule a single 90-minute AI training session for directors. The DSI is naming a literacy gap, not an awareness gap. A single session is theatre.
- AI sits inside one director's portfolio — typically whoever is most enthusiastic — rather than as a standing agenda item with reporting from the CEO against agreed metrics. AI in 2026 is closer to cybersecurity than to ESG. It does not get a champion. It gets a cadence.
- Management briefings consistently use "AI" where the prior generation of vendor decks would have used "analytics" or "automation". The DSI cohort has heard this pattern before, in a different decade. It signals capability dressing, not capability.
- The board cannot articulate, without help, what the company's largest model-related concentration risk is. The DSI specifically flags supplier and regulatory risk as the dimensions where AI most diverges from existing risk frameworks. If the board cannot name the concentration, the framework is not running.
- Directors who own AI in their day jobs — consulting, advisory, vendor or platform roles — are leading the AI conversation in the boardroom without a written conflicts-of-interest plan that the chair can produce on request.
The DSI numbers cut both ways. The two-thirds productivity finding is not noise — it is evidence that AI is creating real value inside Australian organisations right now, and that the boards saying "we don't fully understand it yet" are the same boards reporting the gain. The opportunity is real and the timing is right. Directors who close their literacy gap in the next two to four quarters will sit on boards that approve AI initiatives faster, with cleaner risk framing, and with less rework when APRA, ASIC or the OAIC tests the assurance. The competitive frame for any Australian board is now: are we ahead of, level with, or behind the median DSI respondent. Boards that lift now stop being part of the "pace exceeds capacity" headline and start being part of the much smaller group that can demonstrate it governs this well — which is precisely the position large institutional investors, super funds and ratings agencies will reward over the next 24 months.
The downside is duty-shaped, not commercial. ASIC's Joe Longo has extended s180 Corporations Act duties of care and diligence to AI adoption and use. APRA has explicitly reserved enforcement. APP 1.7 is a hard legislative commencement on 10 December 2026, not a guideline. The directors who told the AICD "pace exceeds capacity" have now put their own evidence into the public record — and the record can be subpoenaed. The DSI is itself the kind of document that will be cited in a future regulator investigation or shareholder action when a board claims it did not appreciate AI risks were this material. As the gap between top-decile and bottom-decile AI-governed boards widens, the bottom decile becomes legally visible. Treating the DSI as background reading rather than as a personal capability prompt is, in effect, filing one's own evidence of the literacy gap into the public domain.
Three moves in the next 60 days. First, make AI a standing agenda item with proper reporting structure — model inventory, vendor concentration, materiality thresholds, leading indicators, incident escalation — not a quarterly topic raised when something interesting hits the press. Second, run a director-by-director personal capability audit against a current AI-literate director framework: identify the two directors who can read a model card and challenge management on it today, and the two more who need to be there in six months, with a written learning plan attached. Third, draft the board's formal response to the DSI in writing — the board's view of its own gap, the specific actions that close it, who owns each, and what the chair will report to the AGM. The DSI is not a survey result to be noted. It is a peer-issued challenge from 828 of us to all of us, and the boardroom answer that meets the moment is documented, dated, and signed.
Researched and drafted by Brad's agentic AI team. Edited and published by Brad Ferris.