AI in Practice, Governance on the Agenda
Artificial intelligence (AI) is no longer a distant or experimental concept — it is now embedded in everyday corporate decision‑making. Algorithms already play a role in strategic decisions and shape policies, investments, market communications, and more. The key issue, therefore, is no longer whether AI will be used, but how it will be incorporated into corporate decision‑making processes and, crucially, who is accountable for its outcomes.
Although Brazilian law does not yet provide a specific corporate framework for AI, the existing corporate legislation, Law 6.404/1976, already sets a clear baseline for decision-making by officers and directors. It imposes duties of care and loyalty and requires informed decisions aligned with the company's best interests and grounded in an appropriate assessment of risks. Embedding artificial intelligence into corporate decision-making does not dilute those duties. On the contrary, it heightens management's accountability. As technological complexity increases, officers and directors are expected not only to understand how the technology functions, but also to oversee its application and, ultimately, answer for its outcomes, including AI, ensuring that their outputs remain consistent, controllable, and aligned with the company's strategy and values.
Recent enforcement actions by the U.S. Securities and Exchange Commission reinforce this understanding and serve as a warning to the market. Since 2024, the SEC has repeatedly sanctioned companies that portrayed artificial intelligence as a central feature of their products or services when, in reality, the technology either did not exist, did not operate as described, or relied materially on human intervention. In these cases, the core issue was not the misuse of AI in decision-making, but misleading disclosures about the existence or level of autonomy of the technology. This practice, which has come to be known as AI washing, was treated as a serious failure of disclosure, internal controls, and governance, with direct impacts on investor confidence.
These precedents show that the way management understands, structures, and communicates the use of artificial intelligence goes well beyond a purely technological dimension, taking on legal, regulatory, and reputational implications as well. It is not enough to adopt innovative solutions; their use must be properly structured, documented, and subject to effective oversight.
In Brazil, although there are still no equivalent decisions from the Brazilian securities and exchange commission (CVM – Comissão de Valores Mobiliários), the landscape is similar. Publicly-traded companies are already using (or presenting themselves as using) AI tools in sensitive areas, often in the absence of specific regulatory parameters to guide management's actions.
In this context, corporate governance can (and should) move ahead of regulation. Establishing dedicated structures to oversee the use of AI, adopting and implementing an internal policy governing its use, ensuring the topic appears regularly on the agenda of management bodies, defining criteria for the validation, monitoring, and review of automated systems, and integrating these measures into compliance and risk management programs are no longer merely best practices: they have become strategic guidelines.
On the regulatory front, this context reinforces the case for the CVM to adopt a specific rule governing the use of new technologies by companies' management. Such a framework could establish baseline guidelines for governance, transparency, internal controls, and accountability in the use of AI, helping to reduce information asymmetries, align market expectations, and provide greater legal certainty for both officers and directors and investors.
In the end, the question is not whether AI can make decisions, but whether corporate governance is prepared to answer for potential failures.
>>> This content is part of BMA Review #90. Click here for more.
