Portfolio Review Notes: AI Governance and Board Oversight
Two August 2026 governance publications raise practical questions for PE operators: who owns AI decisions, what evidence reaches the board, and which gaps need funding?
The Harvard Law School Forum on Corporate Governance's Weekly Roundup: August 21-27, 2026 is an index of the Forum's publications, not a cyber-threat bulletin. Two contributions in that index are useful preparation for a portfolio review: Wellington Management's guidance on AI governance for private companies and Glass Lewis's observations on board oversight.
Neither publication establishes that a particular portfolio company has an incident, an effective control or a quantified loss. Their value is in the questions they help an operating partner ask.
AI governance: assign an owner before expanding access
In AI Governance for Private Companies, published August 21, Wellington contributors discuss accountability, inventories of AI use, data access and monitoring. They distinguish errors in generated content from the risks of systems that can take actions. Their recommendations include reviewing permissions and maintaining approval and override mechanisms for consequential actions.
Our operating interpretation is to select one consequential workflow before asking for a portfolio-wide score. For example, if an assistant can reach customer files or initiate a business action, request its owner, purpose, connected systems and permission boundary. Ask which actions require human approval and what a test of that boundary actually showed. An inventory entry or a written policy is useful preparation; neither demonstrates that the restriction is enforced.
Board oversight: establish who receives the evidence
In 2026 Proxy Season Global Trends: Boards of Directors, published August 27, Glass Lewis describes widespread attribution of cybersecurity oversight among the large public companies it covers. Defined AI oversight is less established. Those observations concern disclosed governance arrangements in the covered populations, not measured control effectiveness at private portfolio companies.
For a PE operator, the practical question is whether the company's reporting chain is clear. Who reviews an unresolved access exception? Who can authorize the work? Which decision comes back to the board, and when? A named committee is not a substitute for a current evidence file and an accountable response.
Bring three requests to the next portfolio review
- A scoped evidence request. Name one business workflow, the source owner, the permissions or controls to inspect, and the collection date. Record what remains untested.
- A costed choice. Separate mandatory work from optional improvements. Ask for implementation cost, dependencies and the evidence needed to compare the alternatives. Do not manufacture a financial estimate from the number of open findings.
- An owned follow-through. Record the approver, execution owner, conditions and next review date. After a change, separate observed control state from any recomputed modeled loss.
The board decision template provides a place to record that choice. Use the 100-day plan to assign post-close evidence gaps and review dates. These are Valty's suggested applications of the publications, not recommendations or endorsements from their authors.
Keep the product and source boundaries clear
These publications do not establish Valty product capabilities or a result for any customer. A platform evaluation needs its own demonstration of the supported evidence, permission and action paths. Public commentary does not certify compliance, determine insurance terms or replace professional review.
Inspect the fictional sample decision memo, or request a platform demo to explore the supported workflow with illustrative data. The sample models annual gross loss before insurance, not an EBITDA adjustment or an observed customer outcome. Company scope, evidence handling, access and terms are agreed separately before evaluation.
