Corporate governance and technological risk oversight

Corporate governance structures are struggling to keep pace with evolving technological and operational risks. Traditional oversight remains heavily focused on audit and financial reporting paradigms, with nearly 80% of S&P 500 companies assigning cybersecurity risk oversight to audit committees rather than dedicated risk committees. This approach often prioritizes quantifiable risks over proactive intelligence and fails to bridge the gap between high-level strategic reviews and technical execution.

This governance gap is further exacerbated by the rapid adoption of Agentic AI. While companies are increasingly integrating autonomous agents, organizational structures have not kept pace; nearly half of all companies have not clearly defined responsibility for managing these agents. In Germany, for example, while 27% of companies use Agentic AI to a moderate extent, only 19% possess mature governance frameworks.

As AI agents are increasingly viewed as ‘digital employees’ rather than mere software tools, executives face new challenges in defining accountability, measuring performance, and managing the cybersecurity risks associated with autonomous agents accessing sensitive data and making independent decisions.