Reserved decisions and bounded delegation
Board-Level AI Governance: What Saudi Directors Must Approve
Map applicable board duties to a practical AI approval schedule, with materiality triggers and enforceable conditions.
What a Saudi board must approve depends on the company's legal form, listing status, sector, constitutional documents and valid delegation arrangements. There is no single approval checklist that can be applied to every AI tool in every organisation. A board should first establish its applicable duties, then make clear which AI-related decisions it reserves and which management may take within limits.
This guide provides a proposed approval framework for directors, company secretaries and executive sponsors. The framework is an operating design to adapt with the company's legal and governance advisers. It does not turn every suggested board review into a statutory requirement or transfer management's responsibilities to a technology supplier.
Separate legal applicability from the internal approval schedule
The CMA Corporate Governance Regulations distinguish Main Market and Parallel Market applicability in Article 2. Articles 20–21 address board responsibility and key functions; delegation does not remove the board's responsibility, and open-ended delegation is not permitted within the relevant framework. Check the applicable provisions and company context rather than describing all Saudi boards as having identical obligations.
The Ministry of Commerce's Companies Law implementation explanation also identifies duties of care and loyalty. These existing governance foundations matter when considering AI, but they are not a universal AI-specific list of technologies requiring board approval. Company counsel and the secretary should map the relevant obligations, reserved matters and committee authorities before the schedule is adopted.
Record the result in two parts: what the applicable framework already requires, and what the company chooses to reserve because of its own strategy, risk and operating model. Keeping those parts visible prevents both under-escalation and the unnecessary referral of every low-impact tool to the board.
Decisions a board can reserve under an agreed AI policy
| Decision class | Board-level question | What management can prepare |
|---|---|---|
| Strategic direction and material funding | Does this commitment fit the business strategy and investment capacity? | Options, assumptions, staged funding and outcomes |
| Risk appetite and prohibited uses | Which consequences and activities will the organisation accept or exclude? | Risk assessment, affected stakeholders and proposed boundaries |
| Material expansion of agent authority | Does allowing a new class of action change exposure enough to require a reserved decision? | Action map, controls, evaluation and recovery evidence |
| Accountability and oversight | Who owns outcomes, risk, independent challenge and reporting? | Operating roles, committee mandates and escalation routes |
| Material exceptions | Is a proposed departure within the organisation's powers and risk limits? | Justification, alternatives, duration and compensating measures |
| Continuation or exit of a material programme | Does the evidence justify the next commitment? | Results, remaining uncertainty, cost to continue and exit consequences |
The table is a proposed policy structure, not a claim that each row always needs a board resolution under Saudi law. Align it with existing financial, technology, risk and procurement delegations. Avoid creating a second AI approval system that contradicts the authority already established for the same business consequence.
Define materiality in terms the company can apply
Financial thresholds are one input, but they are not sufficient by themselves. A low-cost tool may gain access to sensitive information or affect a consequential customer decision. A large investment may involve a well-understood internal capability with limited action authority. Consider the type of consequence, scale, reversibility, affected stakeholders and concentration of dependency alongside spend.
Use concrete escalation triggers: a new class of externally consequential action, a change in who can override a decision, a material expansion in users or data, a significant supplier dependency or a departure from an approved condition. Set the company's actual thresholds with the appropriate owners. Do not copy an example monetary cap from a guide and treat it as a regulatory safe harbour.
Distinguish approval of a boundary from approval of every transaction
A board can establish a policy and reserve material changes while management runs the permitted activity. For example, the board may consider whether a class of agent actions belongs within the organisation's approved risk appetite. Management then implements access, testing, operational review and individual approvals under that boundary. The committee setup guide explains how to document the supporting mandate.
Do not assume that adding a steering committee removes the need for clear executive ownership. Equally, requiring directors to approve routine operational actions can blur oversight and management. The schedule should identify who recommends, challenges, decides and executes, with a route for issues that exceed a person's authority.
Illustrative resolution for a bounded procurement experiment
Assume a company has classified a proposed expansion of automated purchasing authority as a reserved matter under its own approved schedule. Management proposes an experiment in which an agent may prepare commitments within a defined supplier list. Any permission to issue those commitments would be a separate, explicitly described part of the proposal.
An illustrative decision record could authorise management to proceed only after specified evidence is accepted, with an individual commitment cap of SAR 10,000, an aggregate monthly cap of SAR 100,000, no supplier-bank-detail changes and a review after 30 days. These are invented example limits, not recommended universal thresholds. The record must say whether commitments require a person's approval and who can suspend the experiment.
The board is deciding a bounded proposal, not certifying the agent as safe for all purchasing. If the business later asks to add suppliers, increase authority or remove a review step, management should assess whether that change crosses the reserved boundary. An approval should be interpretable by the team implementing it without relying on what participants vaguely remember from the meeting.
Evidence directors should receive before deciding
Ask for the business objective and alternatives, the proposed actions, the relevant requirements assessment, the risk position, the evaluation evidence, operating ownership and the conditions for stopping. Separate facts from forecasts and unresolved assumptions. A missing material piece of evidence should be visible in the recommendation rather than buried in an appendix after a request for unconditional approval.
The risk register template can connect scenarios to accountable owners and controls. The assurance guide helps directors ask what a review actually establishes. A certificate, vendor statement or clean test sample should be considered within its scope; none should automatically be treated as evidence for every intended use.
Make conditional approval enforceable
Every condition needs an owner, evidence requirement, verifier and consequence if it is unmet. State whether the condition must be satisfied before work begins, before production use or before expansion. Define who confirms completion and whether the matter returns to the board or can be closed by a properly authorised committee or executive.
A phrase such as subject to compliance is too broad to operate on its own. Name the outstanding determination or control and the responsible function. If a condition cannot be met, management should not reinterpret silence as approval; it should use the agreed escalation or stop route. The business governance guide connects those decisions to an ongoing process.
Record challenge and monitor what changed
The decision record should preserve the proposal version, relevant conflicts, questions raised, evidence limitations, resolution, delegated authorities and review date. It should also identify the measures directors will receive later. Track material changes in authority, exposure, outcomes and unresolved exceptions, rather than reporting only the number of AI initiatives.
A family-controlled company may also need to separate family, ownership and company forums. The family-business board guide addresses that distinction. For director education, use the agentic AI briefing; for a decision-ready management pack, use the board presentation template.
Agentic AI consulting can help structure the operating questions around an existing governance framework. Discuss a board AI approval framework with the current reserved-matters schedule, committee mandates and a redacted proposal. The practical goal is an authority boundary that directors, management and delivery teams can apply consistently.
FAQ
Your questions, answered.
Must a Saudi board approve every employee AI tool?
The answer depends on the applicable legal and governance framework, the company’s reserved matters and the tool’s consequences. Avoid assuming a universal AI-specific approval requirement. Establish which decisions management can make within policy and which material changes require escalation. Company counsel and the secretary should confirm the applicable authority rather than relying on the product’s label.
Can an existing board committee oversee AI instead of creating a new one?
An existing committee may be appropriate if its mandate, expertise, information and workload support the assigned role. Map its authority against the board’s reserved matters and management responsibilities. The choice should improve accountable decision making, not merely add an AI title. Record escalation and reporting so that issues outside the committee’s powers reach the correct decision maker.
What should trigger a board review of increased agent autonomy?
Use the company’s agreed materiality and delegation rules. Possible triggers include a new class of consequential action, wider data access, removal of a review step or a significant change in exposure. Assess the actual consequence rather than the vendor’s autonomy label. The schedule should make clear who evaluates the change and when a reserved decision is required.
How should a board record conditional approval for an AI programme?
Name each condition, the evidence required, its owner, who verifies completion and the point before which it must be satisfied. Specify the approved scope, limits, review date and suspension route. A general phrase such as subject to compliance is not enough to guide the people who must implement the decision.
Who should accept residual AI risk after a board discussion?
The organisation should identify the authorised decision maker under its applicable governance and delegation arrangements. That person or body needs a clear account of the risk, proposed controls, remaining uncertainty and alternatives. Attendance at a meeting or a supplier’s recommendation does not by itself establish authority to accept the risk on the company’s behalf.
What AI information should directors receive after initial approval?
Report material changes in authority, exposure, outcomes, cost and unresolved exceptions against the approved conditions. Identify decisions now required and whether previous conditions remain satisfied. Avoid relying solely on counts of tools, users or pilots. The reporting should allow directors to see when the original investment or risk judgement needs to be revisited.