Every private-company board has some version of the same conversation.
“We don’t use AI.”
On August 2, that statement became harder to defend. California’s AI Transparency Act became operative, while key transparency obligations under the EU AI Act began to apply. Neither law is a general requirement that every private company label every internal use of AI. But, together, they make one expectation unmistakable:
AI involvement is increasingly expected to be identifiable, disclosed, and traceable.
Usually, “we don’t use AI” is not a statement about what is happening inside the company. It is a statement about what the board has not been shown.
The enterprise software platform may have added an AI feature six months ago. HR may be using automated screening. Sales may be asking a vendor’s embedded assistant to summarize customer calls. Finance may be using generative tools to draft analysis. An employee may be pasting information into a consumer chatbot after hours because it gets the work done faster.
All of that means the company is using AI. And if management cannot see those uses, it cannot reliably assess data exposure, decision risk, vendor terms, operational dependency, or the regulatory obligations that may attach to them.
That is the AI regulation paradox: regulators are increasingly requiring AI to be identifiable, disclosed, and documented, while many companies still cannot see all the AI operating inside their own business.
Why This Lands on a Private Board’s Desk
If you sit on a private-company board, AI regulation can still look like a public-company problem or a frontier-lab problem. It is neither.
Board oversight. Directors need reasonable systems for receiving information about material risks that warrant board attention. But a board cannot oversee an AI risk it has never surfaced. If AI is influencing hiring, pricing, underwriting, performance management, or financial reporting without visibility at the board or management level, the first problem is not whether the use is prohibited. It is whether anyone responsible for oversight knows it is happening.
Deal friction. Undocumented AI integration can become a diligence issue. It can surface in representations and warranties, indemnity negotiations, insurance questionnaires, and other areas where a buyer or counterparty wants to understand how the business actually operates. Increasingly, the questions are straightforward: What AI systems are being used? What data do they touch? What decisions do they influence? What controls surround them?
Vendor exposure runs both ways. Mid-market companies run on third-party software. A vendor may quietly add an embedded AI feature to a product the company already uses. The customer may activate it without legal review; a department may rely on it without informing IT; the vendor may retain or process sensitive data under terms no one has revisited. Nothing was technically “purchased,” so nobody thinks to go back and ask whether the risk changed. The contract does not eliminate exposure for either party. It defines only part of the fight.
The Clock Is Already Running
California’s employment-discrimination regulations took effect on October 1, 2025. They require covered employers and other covered entities to retain relevant employment records for at least four years, including automated-decision-system data. That includes data used in or resulting from an automated decision system, as well as data used to develop or customize a system for a particular employer.
The definition matters. An automated decision system is broadly defined as a computational process that makes a decision - or facilitates human decision-making - about an employment benefit. The regulations specifically contemplate activities such as screening resumes, evaluating or recommending applicants, conducting computer-based assessments, analyzing online interviews, and analyzing applicant or employee data obtained from third parties.
That reaches tools companies may already consider ordinary:
Resume screening
Candidate ranking
Skills assessments
Video-interview analysis
Promotion recommendations
Performance-management scoring
When tools like these influence employment outcomes, the company may need the underlying records to investigate a challenge, assess whether the system produced discriminatory effects, and defend the process. California's regulations expressly make evidence of anti-bias testing - or the absence of it - relevant to certain discrimination claims involving automated systems.
For companies outside California, the relevant question is not headquarters location. It is operational reach. If the company recruits, employs, or uses contractor platforms that touch California applicants or employees, California rules can reach the hiring pipeline.
This is not a records problem; it is a visibility problem.
You cannot retain, test, explain, or defend an AI system you do not know is there.
What Transparency Actually Means
Two transparency regimes reached important milestones on August 2. They are often blurred together, but they address different problems.
California’s regime is principally about synthetic-media provenance. The Act’s initial requirements apply to certain large generative-AI providers and include detection tools and provenance disclosures for AI-generated or altered image, video, and audio content. Beginning in 2027, additional requirements extend to certain large online platforms and GenAI hosting platforms.
Article 50 is broader. It requires providers in specified circumstances to make AI-generated or manipulated content machine-readable and detectable, and to inform people when they are directly interacting with certain AI systems. It also imposes disclosure obligations on deployers for deepfakes, emotion-recognition and biometric-categorization systems, and certain AI-generated public-interest text. Those transparency obligations began applying on August 2, 2026.
Neither regime means every employee must label every AI-assisted document.
But both point to the same governance reality: AI use is becoming more visible to the outside world, while many organizations still lack equivalent visibility inside their own walls.
Providers are already operationalizing that shift. Anthropic says new Claude models support embedded watermarks in generated text and signed provenance metadata for supported files, with those markings applying worldwide wherever the supported models are offered. ElevenLabs, meanwhile, has begun adding Google DeepMind’s SynthID watermarks to generated audio, starting with text-to-speech and expanding coverage.
That is what regulatory pressure looks like when it becomes product architecture.
A provenance marker is a clue, not a complete history. Its absence proves nothing. The enterprise problem is broader: Can management trace a consequential decision back to the system, data, vendor, human owner, and process that produced it?
The Marker Is Not the Map
“The goal isn’t to tell people what to believe. It’s to give them better information so they can decide for themselves who and what to trust.”
— California State Senator Josh Becker
Senator Becker was describing California’s new AI transparency rules.
Think about the principle in a more familiar setting. Suppose you pay to see your favorite singer in concert and discover afterward that the entire performance was lip-synced. Would you feel differently about what you bought?
Maybe. Maybe not.
But what if you had known before you bought the ticket? Now the choice is yours. You may decide it does not matter and buy the ticket anyway. Or you may decide that what you were paying for was a live performance.
Transparency gives you information, not judgment.
The same principle applies inside an enterprise. Before a company can explain an AI-assisted decision to an employee, customer, regulator, buyer, or plaintiff, it first has to know that AI was involved.
California’s new AI transparency rules offer a useful illustration of the broader problem. The law is aimed principally at synthetic media, not private-company AI governance. But its premise is important: transparency cannot rest on a label alone.
It requires a record.
One emerging mechanism is C2PA, an open, industry-developed standard for content provenance-a record of where digital content came from and how it was created or altered. Its Content Credentials can create a cryptographically verifiable record containing information about where digital content came from, how it was created or modified, and the tools or processes recorded along the way. California does not mandate C2PA by name, but its requirements for provenance disclosures and detection tools make standards like it increasingly relevant.
C2PA cannot establish that content is true, harmless, consensual, or lawful. That is not what provenance is designed to do. It provides something more modest: receipts.
And that is the lesson for private boards.
You cannot produce receipts for AI use inside the enterprise until you know where the AI is.
Why Europe Matters to a California Board
The EU AI Act does not apply to every California private company simply because it exists. But its reach does not stop at Europe’s borders. It can apply to U.S. companies that place AI systems or general-purpose AI models on the EU market, and in certain circumstances to companies outside the EU when the output of an AI system is used in the EU.
Even where the Act does not apply directly, Europe matters because the pressure may arrive through the commercial ecosystem first. A customer asks for AI disclosures. A buyer asks for an inventory. A European subsidiary asks whether an HR or customer-service tool can be used. A vendor contract adds audit rights, data restrictions, and compliance representations.
Europe’s recent timing decision makes the sequence especially interesting. The EU deferred many of the most demanding requirements for high-risk AI systems - including requirements around risk management, technical documentation, logging, and conformity assessment. Annex III high-risk rules now begin applying December 2, 2027, while rules for high-risk systems embedded in regulated products generally begin August 2, 2028. But the Article 50 transparency obligations remained on the August 2, 2026 timeline.
That is a signal about sequence. Before anyone gets to the more complicated question of whether an AI system satisfied every technical requirement, there are simpler questions to answer:
Was AI involved? What did it do? Who was affected? Who owned the decision? Can you show what happened?
Those are not European questions. They are board questions.
Documentation Without Visibility
Years in audit taught me a lesson I have never been able to unlearn:
Evidence that a control was performed is not evidence that the control addressed the risk that mattered.
Anyone who lived through the early Sarbanes-Oxley years remembers the binders - signatures, screenshots, testing calendars, and rooms of paper. SOX strengthened accountability in the end, but the early years often produced mountains of documentation attached to a thin understanding of what anyone was actually trying to prevent.
AI governance is beginning to resemble its own SOX 404 moment.
A company can have a polished AI policy, a steering committee, and a folder of vendor assessments - and still be unable to answer where AI is actually operating inside the business today.
That is not governance.
That is documentation without visibility.
California Is the Live Test Case
The relevant timeline is not a single law approaching from the distance. It is a layered framework arriving in waves.
California is becoming a live test case for what AI regulation looks like in practice. The obligations are not arriving all at once or from a single source. They are building over time across employment, transparency, privacy, platform accountability, and provenance.
That matters because each new layer assumes something many companies still lack: that management already knows where AI is operating, what it is doing, and which decisions it affects.
The Board’s First Deliverable
Legal and IT cannot map what nobody can see.
Most boards are shown some version of the IT-approved software list. What they are far less likely to see are the embedded AI features inside existing platforms, department-level tools, AI-enabled spreadsheet workflows, shadow processes, and employees quietly running sensitive material through consumer chatbots because it gets the work done faster.
That is why the Elemental AI Governance Navigator starts with operational reality rather than a compliance checklist. First map what is running. Then connect it to oversight, decision rights, accountability, and risk.
A checklist without a map is an illusion.
Before approving another AI policy, ask management for one deliverable this quarter: a board-ready inventory and risk map of actual AI use.
For every operating unit, require answers to five questions:
The inventory: Does our map include embedded vendor features and department-level tools, or only the software procurement has approved?
Consequential decisions: Which tools influence hiring, pricing, credit, performance review, underwriting, customer eligibility, or financial reporting?
The data pipeline: Where is proprietary, employee, applicant, customer, or regulated data flowing, and what contractual and technical controls govern that use?
Human ownership: When a tool produces a recommendation, is human review meaningful and auditable - or a rubber stamp with a timestamp?
The removal cost: If a regulator, vendor failure, or material incident forced us to pause a workflow tomorrow, what breaks, and what would it cost to revert to manual operations?
The fifth question changes the temperature in the room because it forces a distinction between adoption and dependency. A company may spend very little on an AI capability and still be deeply dependent on it if that capability sits in the middle of a critical workflow.
The question turns an abstract conversation about AI principles into a concrete conversation about business continuity: what breaks if the AI goes away?
Let’s Get Elemental
Until management can produce that picture, passing an AI policy does not create governance. It creates the appearance of governance.
The next era of AI regulation will not be defined by whether companies use AI. That question is rapidly becoming irrelevant. It will be defined by whether directors and executives can see it, trace it, explain it, and own it.
Somewhere, a board will first discover a consequential AI use not from management, but from a plaintiff’s notice, a regulator’s inquiry, or a buyer’s diligence request.
Do not be that board.
About Fayeron Morrison
Fayeron Morrison is the President of Elemental AI, a strategic advisory firm that helps boards and executives navigate the governance challenges of artificial intelligence. She is the creator of the Elemental AI Governance Navigator, a diagnostic tool built to bring clarity and accountability to AI oversight at the highest levels.
A graduate of the Stanford Graduate School of Business Executive Program in AI Leadership, Fayeron is also the author of Elemental AI, a weekly Substack publication focused on AI governance, risk, and boardroom readiness.
Beyond her AI work, Fayeron is a Certified Public Accountant (CPA) and Certified Fraud Examiner (CFE) with a long-standing career advising both public and private companies.
She lives in Newport Beach, California with her husband and their Bernese Mountain Dog, Oakley. She’s the proud mom of three grown sons and, when she’s not writing or advising, she’s likely on a hiking trail with Oakley - where she does some of her best thinking!
Get in touch to learn more about the Governance Navigator →