AI risk #97/99: 56% of CEOs are asking the wrong questions about AI

In August, PwC's governance team published a note for directors with a first line that most boards would nod at and few have acted on: govern AI like a transformation, not a tech initiative. The Harvard Law School governance forum re-ran it last week, and it deserves the second airing.

The numbers around it explain why the sentence needed writing. PwC's 29th Global CEO Survey asked 4,454 chief executives across 95 countries about AI. Only one in eight said it has delivered both cost and revenue benefits, and 56% said they have seen no significant financial benefit at all. 'Stuck' is the word PwC's note uses for that 56%. The same note previews PwC's forthcoming survey of directors, where seven in ten name AI as the board capability most in need of strengthening.

The agenda is familiar. AI arrives as an item. Someone presents the pilots, someone asks about the risks, the risk person says cyber and data, the item closes. Everything else on the agenda, the growth plan, the cost base, the supplier contracts, the hiring plan, the pricing review, gets discussed as if AI were not already inside it.

The question boards are asking, and the one they are not

The question in most boardrooms is "what is our AI strategy". It is a fair question and it produces a fair answer: a list of tools, a few pilots, a policy, a person accountable. What it does not produce is a view of what AI is doing to the strategy the company already has.

Those are different questions with different owners. The first belongs to the technology team. The second belongs to the plan itself. Does the margin assumption still hold when a competitor has automated its cost base? Does the plan to keep customers still hold when those customers now compare you with rivals built on AI? Do the payment approvals still protect the cash when a voice on a call can be faked? Does the supplier the plan depends on now run on AI you cannot see? None of that is an AI project. All of it is AI doing something to a line in the plan.

PwC gets close to this when it asks directors to push management to decide where the company will lead with AI, where it will keep pace, and where it will step back. That is a strategy question, and it cannot be answered by looking at the AI work alone. It can only be answered by looking at the objectives.

Stuck is what "not looking" looks like from outside

The number I cannot get past is 56%. More than half of 4,454 chief executives, a year or more into serious spending, with no significant financial benefit to show for it, on their own account. PwC's own analysis of the S&P 500 puts a price on the difference. Leaving aside the companies that build the models, those that spent more than half a percent of revenue on AI beat their sector's shareholder returns by 21% between 2022 and 2025. Those that spent less fell behind.

A study published on 15 September makes the mechanism plain. ADAPTOVATE asked 300 North American executives about scaling AI. Eight in ten said their job security now depends on it. Fewer than one in five have a company-wide plan to do it. Then the researchers asked the same question with the word AI removed, and 81% gave the same answer: their organisation is better at spotting opportunities than acting on them.

Which is the point. Stuck is not an AI problem. It is a plan problem that AI has made expensive, and another tool will not fix it. Bringing the plan into the room where AI is being discussed will, or better still, taking the AI discussion into every item where the plan already is.

The risks moved too, and the register did not notice

The same blind spot shows up on the risk side, and EY's survey of 15 September measured it. Almost every large company now has a formal AI policy. Nearly half admit they have gone round it to get something urgent out the door, and more than a third have already had an AI incident that did real damage. The policy exists. The plan ran past it.

That matters to a director because the risk register is where the plan's assumptions are supposed to live, scored and owned. Most registers still hold AI as one line, somewhere near cyber, with a technology owner. The honest picture is that AI has become the driver behind a good number of the other 99 rather than the hundredth risk on its own line: fraud, churn, margin, suppliers, hiring, mis-selling, the pace of regulation. Each of those lines was scored for a world where the driver was slower and human. The register question is not "have we added AI" but "which of these scores assumed AI did not exist".

Three questions for the next AI agenda item

If the AI item is going to stay on the agenda, it can at least do different work. Three questions turn it from a technology update into a plan review, and none of them needs a technologist to answer.

Which three objectives in our current plan are most exposed to AI, for better or worse, and who owns each of them? Not which projects use AI. Which objectives AI is acting on.

Which assumptions under those objectives were made before AI was a factor, and when were they last tested? Margin, customers, payment approvals, suppliers and hiring are the usual five.

Where have we decided to lead, to keep pace, or to step back, and does the risk register reflect that choice with an owner and a date?

I would rather a board spent its AI hour on that table than on a demo. The demo tells you what the tools can do. The table tells you what is happening to the business you are responsible for, which is the only thing the board is there to oversee.

If you want a first draft of that table without waiting for the next meeting, the AI Disruption Index builds one from your objectives in about ten minutes and costs nothing: which risks AI is driving hardest against each objective, ranked, with a safeguard drafted for each. It does not know your plan the way your board does. It will show you where AI is already acting on it.