Why "we have an AI policy" is not a defence — what S&C teaches Boards

The Sullivan & Cromwell case landed hard last week. A Wall Street firm that advises OpenAI on ethical AI deployment apologised to a federal judge for filing a court motion riddled with thirty to forty AI-hallucinated citations. The firm had documented AI policies. It had training requirements. It had a secondary review process. None of it was operationally enforced. That is the lesson, in twelve words. This piece is about what to do about it.

What governance that holds actually looks like

The mistake most Boards make is treating AI governance as a documentation exercise. It is not. Lean, defensible AI governance — the kind that holds up to a regulator, an auditor, opposing counsel, or a customer audit — has four operational properties.

It is built into structures the Board already runs.

The audit cycle. The committee architecture. The management reporting. AI governance that lives in a parallel compliance overlay is governance that gets ignored when the operational team is under pressure. Lean governance integrates with the workflow that already exists — making it harder to bypass and easier to demonstrate.

Accountability is allocated clearly — Board to executive committee to operations.

Each layer knows what it owns. The Board owns the framework and the strategic posture. The executive committee owns operational implementation. Operations own the daily controls. Each layer can produce its own evidence on demand. There is no shared ambiguity into which the failure can dissolve.

The cadence matches how AI moves.

AI capability shifts in months. Regulatory expectations shift in quarters. Governance built for an annual review cycle is governance that is permanently behind. The Board needs to see AI risk and capability quarterly, at minimum — informed by structured external meetings, not just internal reporting.

It goes beyond compliance — to ethics, responsibility, and human oversight.

Compliance gets the firm to the line. The dimensions that customers, employees, regulators, and shareholders increasingly care about — did the firm act responsibly, were humans meaningfully in the loop, were ethical considerations addressed — sit beyond compliance. Good governance addresses both.

How to recognise governance that exists on paper, not in practice

Before asking the affirmative question, Boards should run the diagnostic in reverse. Three warning signs that AI governance is theatre, not substance:

1. The policy is on a SharePoint site no-one references. It was written, approved by a committee, filed away, and never integrated into operational workflows. When the Board asks for the evidence trail, IT produces the document — not the audit log.
2. Accountability dissolves when pressed. Ask three different people who is accountable for AI risk in the firm and you get three different answers. The CTO points to the CRO. The CRO points to Compliance. Compliance points to operational sponsors. No-one owns it — which means everyone is exposed.
3. The review process is generic, not AI-specific. AI-generated errors look correct, read fluently, and cite specific authorities. They are not caught by training reviewers to 'check the work'. They are caught only by structured verification steps that match the ways AI fails.

If any of these three describe your firm, the gap is not theoretical. The conditions for an S&C-style failure exist now.

The cadence question — why annual is no longer enough

Most Board AI governance frameworks were built on annual or semi-annual review cycles. AI does not operate on those cycles. A new model release can change capability — and risk profile — in weeks. A new regulatory ruling can change obligations in days. A new vendor security disclosure can change exposure overnight. A Board reviewing AI governance once a year is reviewing a snapshot that has already moved.

The shift required is to quarterly Board review at minimum — informed by structured external meetings on regulatory developments, technology shifts, and competitive moves. This is not a research subscription. It is a Board-level intelligence rhythm. The firms that will weather the next eighteen months are the firms whose Boards see what is coming before the executive team has to manage it.

A self-diagnostic for your Board this quarter

Score the following five questions on a scale of 1 (not at all) to 5 (fully demonstrated and evidence-backed):

1. Operational enforcement — Could we produce, today, the audit trail and verification logs that prove our AI policy is being followed?
2. Clear accountability — If AI failed in our firm tomorrow, would there be a single, documented, named owner for the failure — or would it dissolve into shared ambiguity?
3. Tool visibility — Can we name every AI tool in use across the firm and the specific accountability for each? Or are we surprised by what we find when we look?
4. AI-specific review — Have our reviewers been trained to identify AI-generated errors specifically, or do we rely on generic quality controls that AI hallucinations evade?
5. Informed stewardship — Could we demonstrate to a regulator, auditor, or opposing counsel that our Board engages substantively with AI — not just delegates oversight to IT?

A Board scoring under 15 has a real exposure to manage. A Board scoring under 10 is in the position Sullivan & Cromwell was in three months ago.

The work StratEdge does for Boards facing this question

Lean, defensible AI governance — built into the structures the Board already runs, with the cadence AI demands, and the rigour the role now requires. Explore our work for Boards and for Executives to see how we partner with leadership teams already engaged with this question.