This article explores the strategic dilemma Boards face in categorising cybersecurity and artificial intelligence risks within governance frameworks. As regulatory pressure and technological complexity increase, the way these risks are “labelled” significantly impacts Board oversight.
Boards must choose between elevating cyber and AI to standalone strategic risks (increasing visibility and accountability) or integrating them as sub-risks of information governance (ensuring a holistic view of the data lifecycle).