How Boards Can Govern AI Risk

1. Three Levels of AI Value: Dave frames AI value creation in three levels. The first is individual productivity, where employees bring tools such as ChatGPT or Perplexity to generate documents and complete tasks. The second is functional transformation, including contract analysis, legal document management, content creation, and media buying. The third and most strategically significant level changes how a company competes. At that level, AI assembles scattered information, exposes insights customers could not previously access, and creates a new value proposition. Boards that focus only on employee tools and efficiency can miss the larger threat: another company may use connected data and multiple AI models to insert itself between the business and its customers.

2. Verusen and MRO Disintermediation: Verusen illustrates how AI can disrupt an established distribution layer in maintenance, repair, and operations, a market Dave values at $900 billion. The platform brings together inventory information across factories and warehouses, scrapes supplier websites, and incorporates public signals about disruptions and material availability. Managers can then view holdings, consumption, stockout risk, prices, and reorder options on a single pane of glass before feeding decisions into systems such as Ariba. Dave says Verusen reached $6 million quickly and, after four years, had 600% CAGR momentum. Its significance is not one algorithm but an integrated stack that can disintermediate industrial distributors.

3. Sysco’s Compounding Data Advantage: Sysco demonstrates data-driven customer lock-in. When a restaurant buyer opens its app, the system responds within 300 milliseconds using identity, location, purchase history, spot-versus-bulk behavior, menu, price point, nearby warehouse stock, and product perishability. It can discount inventory that needs to move and suggest menu ideas that use those products. Buyers interviewed for Dave’s book described ordering through the app as a “no-brainer.” Dave reports that Sysco is outgrowing competitors at a rate 50% higher than theirs. Every interaction and offer test gives Sysco more information, increasing personalization and convenience while making competing suppliers harder to justify.

4. Testing Turns Data Into Learning: Collecting data does not create an advantage unless a company can activate it rapidly. Dave points to OfferFit as a tool for AI-enabled multivariate testing and cites Shopify’s effort to convert free trials into paid subscriptions. With roughly 500 possible message combinations, Shopify used continuous testing to learn which offers worked for different people and contexts. Over 12 weeks, it achieved a reported 400% improvement in ROI. The governance implication is that boards should ask not only whether management has data and models, but how many controlled tests the company runs, how quickly results reach the market, and whether learning is being captured for future decisions.

5. Marriott’s Ecosystem Strategy: Marriott’s roughly 30 brands are becoming a foundation for a wider travel ecosystem. Through Bonvoy, Marriott combines first-party booking and interaction data with zero-party data gathered through direct questions such as preferred welcome gifts or desired vacation destinations. Dave describes plans for conversational itinerary creation, including a family trip to Spain for two teenagers with a defined budget and maximum use of points. Marriott can orchestrate hotels, restaurants, and tours through shared data standards while also building a media network for advertisers. Boards must decide whether to lead, join, or risk exclusion from such ecosystems and negotiate who controls data, customer access, and economic value.

6. Search Becomes Answer-Engine Discovery: AI answer engines are changing discovery from a list of links into a synthesized response. Dave warns that companies dependent on search engine optimization and search engine marketing must rethink acquisition as customers increasingly use ChatGPT, Perplexity, and similar tools. He cites BrandLight as an early tool that submits hundreds of category prompts, measures whether a brand appears, analyzes sentiment, traces the sources influencing the answer, and recommends priorities. For boards, this is a strategic distribution issue rather than a narrow marketing metric. Management should quantify traffic and revenue exposed to conventional search and develop a plan for visibility and authority within LLM-generated answers.

7. AI Changes Team Design: AI will automate specialized execution while increasing demand for people who can set direction and coordinate work. Dave uses marketing as an example: separate specialists for paid search, social buying, and social content emerged partly because each platform required detailed operational knowledge. As AI absorbs more execution, organizations will need generalists who decide what the company should do and how channels should work together. This creates changes in skills, team structures, and management practices. JPMorgan Chase’s five-year, $350 million AI reskilling initiative shows the scale of the response. Boards should treat workforce redesign as a strategic investment, not simply a head-count exercise.

8. AI Strengthens the Adversary: Chris explains that AI improves both the realism and speed of cyberattacks. Attackers can automate reconnaissance to identify vulnerable employees, assets, and suppliers; create hyper-realistic communications; evade defenses; and exfiltrate valuable data more efficiently. He says attack preparation that once took weeks or months can now take days. Social engineering becomes especially dangerous when criminals target a CFO, controller, CEO, or supply-chain employee authorized to move tens of millions of dollars. Boards should therefore connect AI adoption with identity controls, transaction verification, supplier monitoring, employee training, and incident response rather than assuming existing cybersecurity investments automatically cover AI-enhanced threats.

9. Translate Cyber Into Economic Exposure: Chris argues that fragmented technical reporting prevents boards from comparing cyber risk with other enterprise risks. A stronger approach translates scenarios into financial and operational consequences: lost revenue during 24-hour, 48-hour, or week-long outages; ransom and extortion; rebuilding systems; new cloud and software licenses; emergency security spending; lawsuits; regulatory action; and stolen intellectual property. He cites Clorox, MGM, and healthcare incidents as examples of disruption capable of producing tens or hundreds of millions of dollars in costs. Annual loss expectancy analysis and industry benchmarks can help boards prioritize limited capital against scenarios most likely to cause material harm.