The Board's Duty to Monitor AI Is Now a Documentation Test

The gap that the 2026 numbers expose

Governance analyses published through 2026 set out a gap that boards can no longer treat as a back-office concern. Roughly 88 per cent of organisations now deploy artificial intelligence (AI) in some operational form, while only about 25 per cent have a board-level policy that governs it. The same analyses draw the obvious legal line. Where a technology is material to the business and the board has not monitored it, directors face Caremark-style exposure, the duty to monitor that flows from the Delaware decision In re Caremark International Inc. Derivative Litigation. The decisive question in any such claim is narrow and unforgiving. Did the board establish a reasonable system of oversight, and can it produce documented evidence that it treated AI as a board-level risk? The minutes that say a committee discussed AI do not answer it. The record of what the AI was allowed to do, what it actually did, and who authorised it does.

Why intentions in the minutes are not a defence

A duty to monitor is not a duty to mean well. The Caremark line and its successors, including Marchand v. Barnhill, turn on whether the board built and maintained a reporting system for a mission-critical risk, and whether it acted on the red flags that system surfaced. Courts read the documentary trail. A board that cannot show the trail is presumed not to have monitored, because under this standard the absence of evidence is itself the failure. AI sharpens the problem in a specific way. The systems that boards are now accountable for do not merely advise. They act. They move money, draft and send communications, change records, and trigger downstream processes at machine speed and machine volume. A discussion noted in the minutes describes an intention. It does not establish that the organisation's AI was governed, that its actions were constrained, or that a human held the authority when a consequential action ran. For a director, the exposure is not that the AI made a mistake. It is that there is no defensible record showing the board ever required the AI to be governed at all.

The three questions a court will actually ask

Strip the governance frameworks back and the inquiry reduces to three questions, each of which demands evidence rather than assertion. First, what was the AI permitted to do? A board needs a defined and recorded scope of authority for each autonomous system, not a general policy gesturing at responsible use. Second, what did it actually do? Every consequential action needs to be captured at the moment it happened, attributable to a specific system and a specific decision, in a form that cannot be edited after the fact to flatter the board. Third, did a human hold the authority? For actions that carry real consequence, the record must show that authority was exercised at the point of execution, not granted in the abstract months earlier. A governance regime that cannot answer all three with primary evidence is a regime of intentions. Under a duty to monitor, intentions do not survive contact with a regulator or a court.

Oversight is an engineering property, not a policy statement

The reason most organisations sit in the 75 per cent without board-level AI policy is not negligence. It is that conventional systems make the required evidence impossible to produce honestly. Application logs are mutable, scattered across services, and written by the same systems whose behaviour they purport to record. They can be edited, truncated, or quietly aligned with whatever story the organisation prefers after an incident. A board cannot put that in front of a regulator and call it proof, because the other side will ask the only question that matters: how do we know this record was not changed? Oversight that withstands scrutiny has to be a property of the system itself. The record has to be created at the moment of action, bound to the action cryptographically, impossible to alter without detection, and verifiable by someone who does not trust the organisation that produced it. That is an engineering specification. It is not something a policy document can supply, and it is the specification that the Mickai Sovereign Intelligence Operating System (SIOS) was built to meet.

The Open Audit Record is the evidence a board can stand behind

Mickai is a Sovereign Intelligence Operating System, built, live, and production-ready, and its answer to the duty to monitor is the Open Audit Record (OAR). The OAR is an append-only, hash-chained ledger in which every consequential AI action is recorded. Each action is signed before it executes, using Federal Information Processing Standard 204 (FIPS 204) ML-DSA-65, a post-quantum digital signature standard from the United States National Institute of Standards and Technology (NIST). Signing before execution is what converts a log into evidence, because the authorisation is committed to the chain at the moment of the act and cannot be reconstructed afterward to suit a narrative. The signing keys live in a Trusted Platform Module (TPM) on hardware the operator owns. A browser-resident verifier lets any third party, a regulator, an auditor, or a court-appointed examiner, replay the chain offline and confirm that the record is intact and that each action was authorised. The board does not ask anyone to trust its word. It hands over a record that verifies itself.

Authority at execution, held by a human and proven on the chain

The third question, whether a human held the authority, is answered by how Mickai gates dangerous actions. Authority at execution means a consequential action does not run on a standing permission. It is gated at the point of execution, and within the Mickai architecture several of the fifty brains must agree before a dangerous action proceeds. The Sentinel capability is the hard floor: it stops agents from wiping or exfiltrating data, so the most damaging classes of action are blocked at the substrate rather than relying on the model to decline. Every one of these decisions, the gate, the agreement, and the human authorisation, lands in the Open Audit Record as a signed object. For a board, this is the difference between asserting that a human was in the loop and proving it. The record shows not only that an action occurred but that authority was exercised at the moment it ran, by whom, and under what constraints. That is the documented evidence a duty to monitor demands, generated as a by-product of normal operation rather than assembled defensively after an incident.

Anchoring the record beyond the organisation's reach

A record a board controls is a record a board can be accused of curating. Mickai removes that objection by anchoring the audit chain outside the operator's reach. Pantheon is a sovereign Layer 1 built in Rust on the Polkadot Software Development Kit (SDK), with the audit record as a native consensus object across fifteen Layer-2 application chains, and the audit root anchored to Bitcoin. Anchoring to an independent public chain means the existence and integrity of the record at a given time can be confirmed against infrastructure the organisation does not own and cannot rewrite. For a director, this closes the last gap in the Caremark inquiry. It is no longer possible to argue that the evidence was produced or altered to defend the board, because the integrity of that evidence is witnessed externally. The portfolio behind this architecture, 101 filed United Kingdom patent applications covering approximately 2,234 claims, all owned by Mickai LTD with named inventor Micky Irons, reflects how much of this is original engineering rather than configuration.

What boards should require now

The 2026 figures will not improve on their own, and the legal exposure is already live. A board that waits for an incident to discover its records are mutable, scattered, and unverifiable has answered the duty to monitor in the worst possible forum. The remedy is not another policy committed to the minutes. It is to require that the organisation's AI runs on a substrate where governance is a property of the system: a defined scope of authority for every autonomous action, a tamper-evident record of what each action did, signed before it ran, and a human authority gated at execution and proven on the chain. That is what the Open Audit Record provides, and it is what a board can put in front of a regulator or a court without flinching. Under a duty to monitor, the question is never whether the board cared about AI. It is whether the board can prove it governed it. The boards that can will be the ones that built the proof into the system before they needed it.