Every board needs to confront what artificial intelligence (AI) means for their company’s business model and their ability to create shareholder value. That urgency sets the tone for this episode, where host Skadden partner Ann Beth Stebbins moderates a discussion about how boards are overseeing their companies’ use of AI — and how they can use AI themselves in their oversight role.

For insights, Ann Beth sits down with Sumaiya Balbale, a director at Shake Shack, and Skadden colleague Don Vieira, who heads the firm’s tech policy practice and advises companies on AI governance.

Sumaiya says that directors should ask sophisticated, pointed questions about a company’s use of AI. She says that Shake Shack is employing AI in various aspects of its business, for example, to make better predictions about customer flows, inventories and orders, ultimately, to improve the customer experience. She encourages directors to use AI tools themselves as an effective path to building comfort with, and understanding of, AI.

Don also encourages directors to develop AI literacy, becoming fluent in where and how AI is being used in the company. But companies need to facilitate AI use by directors in ways that don’t compromise confidential information, such as introducing such information into a public chatbot.

Audit committees at some companies are taking the lead on understanding AI risks, he says. And nomination and governance committees are increasingly focused on whether the board itself and management have adequate AI literacy, or whether they need to find people to help assess AI, both as an opportunity and as a risk.

“Because the technology is changing so quickly, the board has to have some broad stroke principles rather than hard and fast rules,” Sumaiya says. “You don’t want to have a framework that’s obsolete two months later when the latest model comes out.”

Companies “need to enable an environment where people feel like AI fluency is important and critical,” and make “sure that people feel empowered to understand this technology, to use it to find creative applications, to identify the risk, but also to grow in their own talent and capabilities,” Sumaiya says.

Don suggests tempering optimism about AI’s capabilities with an appreciation of its risks. As one example: Some companies have been accused of “AI-washing,” claiming that AI is building efficiencies when it is not. “It’s critically important that the board vet that and make sure it’s part of its oversight process,” he observes.

Tune in for a practical, candid discussion about how boards can navigate AI as both a strategic opportunity and a governance responsibility.

💡 Meet Your Host 💡

Name: Ann Beth Stebbins

Title: Partner at Skadden

Connect: LinkedIn

Featured Guests

Name: Sumaiya Balbale

Title: Board member, Shake Shack

Connect: LinkedIn

Name: Don Vieira

Title: Partner, Tech Policy, Skadden

Connect: LinkedIn

Connect with Skadden

☑️ Follow us on X & LinkedIn.

☑️ Subscribe to The Informed Board on Apple Podcasts, Spotify or your favorite podcast app.

☑️ Let us know what topics you would like to hear about on The Informed Board by reaching out to us at info@skadden.com.

The Informed Board is a podcast by Skadden, Arps, Slate, Meagher & Flom LLP, and Affiliates. This podcast is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.

From Skadden, you're listening to The Informed Board, a podcast for directors facing the rapidly evolving challenges of a global market. A compliment to our newsletter for directors, our aim with this podcast is to help flag potential problems that may not be fully appreciated, explain trends, share our observations, and give directors practical guidance without a lot of legal jargon. Join Skadden Partners who draw on years of frontline experience inside boardrooms to explore the complex issues facing directors today.

How are boards overseeing their company's use of AI and how are boards using AI in their own oversight roles? I'm Ann Beth Stebbins, a partner in Skadden's M&A practice and your host of The Informed Board. I'm joined today by Sumaiya Balbale. Sumaiya has served on the board of directors of Shake Shack since 2019. She has extensive experience in e-commerce and mobile and digital marketing.

I'm also joined by my Skadden partner, Don Vieira, who heads our tech policy practice and advises companies on issues in the technology space, including AI governance. Welcome, Sumaiya, and welcome Don to The Informed Board. So Sumaiya, can you talk about the attention that AI is getting in the boardrooms where you've either served as a director or participated as a member of management?

I think AI is the topic of the day and will be the topic of the day for many, many years. It's evolving very, very rapidly and its applications are increasingly becoming broader and broader. Every boardroom and every management team needs to confront what AI means for their business, their business models, and for their ability to continue to create value and survive in the future.

Do you receive regular presentations from management on AI and the use of AI in the business?

The way that we have approached AI on the Shake Shack board is that it is a tool across our broader strategy and our broader mandate to grow the business. It's infused across the variety of different topics that we'll address quarter to quarter. It's really about thinking through the pooling that allows us to more quickly adapt to fluctuations in market, in traffic, in demand to be better at overall delivering the customer experience we want in an efficient way. AI is actually changing how people are thinking about vulnerability, in which case, what are the things that we're doing to stay on top of security concerns like that?

So Don, as the lawyer in the room, what do you tell boards about the risks and how to oversee the risks?

This is an area of real concern and focus. You've seen audit committees take the lead on understanding risks and building that into their work as a committee. And the nomination of governance committees, you have an increasing focus on whether the board itself has adequate AI literacy or whether they need to find people to help assess AI, both as an opportunity and as a risk. Whether the people they're considering for senior positions in the company have used AI before, how they're going to use that in the underlying operations.

It's important for the board to develop literacy around it and understanding of it. I tell directors, learn more about it. Don't be shy. Don't be afraid to ask for expert advice, whether that's through the management of the company to come in and brief the board on how it works generally or whether it's specific applications that are being used by the company.

It's understanding where AI is being used in the company, how it's being used. Understanding what areas of use are regulated and how the company is treating the applications in terms of that regulation. AI is not regulated, but if you're a regulated business, anything you do is regulated. Understanding how the management is using it to engage in the operational activities of the business.

Boiling it down, it's the board oversight role. In order to be an effective director and effectively exercise your board oversight role, you have to have a basic understanding of what you're overseeing. In the scenario we're discussing, how is the company using AI in its business and what are the opportunities and risks associated with the company's use of AI?

You can't be afraid of it. It's here to approach it from a posture of fear. It's inherently getting off on the wrong foot. It has to come from a place of understanding what is the technology, what's actually being able to be applied today, what's on the horizon for the next six months. This is actually, for a board member, a natural place to use the AI tools yourself to understand the progress that AI is making. You don't have to watch hours of YouTube videos on the topic or read white papers, but you can very quickly use the tools themselves to synthesize what the front line is of AI technology and then actually use the tools to try to help understand how might this be influencing my business? What should I be thinking about?

There's almost an interlocutor in the AI itself, board member to use to get smart on what it is, and it's a really helpful way to just start putting your toe in the water, so to speak, to get familiar with the tools and how they work, where they excel and where they don't, and then it creates comfort. Because once you start using it as a board member, you start understanding what the fuss is about.

I think given the composition of most boards skewing older, skewing more towards operational finance backgrounds, there isn't a whole lot of comfort among board members with AI and how quickly it's evolving. Are you seeing boards have a formal training program for their directors so that they can understand better what the company is doing and how they individually can use AI in their board function? Don, let me direct that one to you.

It really is company specific. There are boards that have decided to just bring in experts and to teach them how to use the tools or how the tools work generically even at sort of a high level, and then there are other directors who really want to know and understand the specific tools being used by the company.

That's what I think is so important in the board oversight role. How do you oversee what the company is doing if you don't understand the technology? You need to understand what it does and what the opportunities and risks are associated with its use.

I do think that's right, and as Sumaiya notes, this is only going in one direction, which is for more and more adoption of AI.

It's moving very quickly.

I think there's going to be an expectation that you, A, understand how they work at a very basic level. And B, you have a really strong understanding of how the company's using it, what risks are entailed in their use, how those risks have been mitigated by management. You need to have an organizational structure at the board level that takes responsibility for those risks as you would on any other risks. And to Sumaiya's point, there's no better way to understand the power of these tools than to use them.

Now that said, you want to use them carefully. A really critical caveat here, and it is to the extent you're a board member and you're getting sensitive data from management about the company's operations. That's the kind of stuff that you shouldn't be plugging into ChatGPT or Claude or Gemini. It's really critical that confidential information remains confidential, but there's so many things you can do with these tools that don't require you to put in company confidential information. You increasingly see board members using it as a way to gather public information, whether that's understanding what's going on in the industry, the news, events that might be relevant to the business.

Because the technology is changing so quickly, the board has to have some broad stroke principles rather than hard and fast rules, because the pace of the change is so quick. You don't want to have a framework that's obsolete two months later when the latest model comes out. The idea of having principles like the one Don just mentioned, sensitive proprietary data should never enter into an open AI use case. That feels like a good broad general principle.

That means taking a board presentation and uploading it into ChatGPT and saying, "ChatGPT, summarize this for me." That's a no, right?

That's a no, but there are ways to create secure sandbox experiences with these tools which protect your data, and then there's open experiences where that data is not protected. You have to be extra cautious about how you are actually putting information in because it's not safe in that sense. It's proprietary information that you're making public unintentionally.

Talking about these private proprietary networks, do many companies and boards have this available to them?

Not from the Shake Shack perspective, but from other companies that I've worked with, we had our own used versions of ChatGPT where the data was protected. More and more companies have enterprise applications where you can actually create some level of sandbox around your data to protect it, and so those are things that companies should be exploring.

Don, have you seen boards using those closed environments, so companies making those tools available to their boards?

What you see is the companies may have those tools available and then through those tools they'll make information available to the board members for purposes of the board's role of carrying out oversight. You don't see a lot of, for example, allowing board members to have sort of carte blanche access to all the proprietary information in those tools, but you do see cabinets within those tools being developed for board members to access, which is working with AI to prove tools consistent with company standards for security, and then there's just stuff that's just generally permitted, which is doing some public searches for information that's already in the public domain that might be relevant to your role as a board director.

Which is kind of like Googling.

Exactly. It's just like Googling, but having somebody summarize it for you and that's somebody is the tool itself. It's really just three categories of use, and that's a framework that I think should govern the board use of data in a way that's very simple to explain.

We talked earlier about a principle-based approach to governing AI usage by a board because the technology is changing so rapidly. How have you seen the evolution of AI usage at the company and in the boardroom and where do you see it going?

The rate at which AI technology is advancing is remarkable, and I think that is the key headline. Where we were a few years ago when ChatGPT first emerged and everyone became aware of the term generative AI to where we are now is just astonishing in terms of how quickly things have moved. I mean, just as recently as a week or so ago when Claude introduced its latest model, it knocked out incredible amounts of public market value in companies that investors saw as now suddenly at risk because suddenly everyone's eyes opened and said, "Wait a minute, applications of this are even broader than we expected."

The pace and the rate of change is the constant in this. In that context, what are the frameworks and principles we need to use both as management teams and as board members to navigate that? I think the first one is be aware of how this can be an opportunity to create value for your companies. How can this create more shareholder value? Where do we deploy these things in a way that's relevant to our businesses that helps us grow revenue, that helps us manage margin, that makes us more effective and competitive in market?

Then there's the other side of it, which is the risk side of it. What is happening in our industry or in industries adjacent to us that we need to be paying attention to such that suddenly we're going to be blindsided if we weren't paying attention? Where's that risk? Some of them can be internal risks like cybersecurity and threats like that. Others can be new disruptive models that are emerging in an industry that suddenly does things completely differently.

Employee issues, labor structure.

Exactly. All these issues, and then I think the third one ties to that, which is, okay, there's opportunity, there's risk, but then there's also adaptability. You need to enable an environment where people feel like AI fluency is important and critical, and I think companies are responsible for helping to upscale their labor and making sure that people feel empowered to understand this technology, to use it to find creative applications, to identify the risk, but also to grow in their own talent and capabilities. Because at the end of the day, it's people that drive companies and people that drive growth.

The more literate and the more effective your workforce is in winning in this constantly evolving game, the better chances and the better odds that you have of succeeding in the long-term rather than just getting a strategy right in one moment. Talent succession planning is often a big topic for boards. This idea of asking the questions around AI literacy and comfort to be more future prepared, because the more adaptable your teams are, the more adaptable you're going to be in the environment as it emerges.

Don, do you ever see boards standing in the way of the possibilities and potential of AI because they don't understand it, they're just afraid of what they don't know?

It's really incumbent on management to ensure that they're keeping the board up to speed on what this technology can do and how much it can impact the business, but it's also incumbent on directors to understand that we're in a different paradigm. To Sumaiya's point, technology is evolving so quickly. Its impact on industries is so profound and diverse in all sorts of areas you just can't anticipate. But if you're in a biotech company's board, for example, what this is going to do to medical research, to the capacity to engage in things that used to be very labor-intensive and how that's going to impact the whole business model, I think you need to understand that, and that's just one example there of many.

And so I do think that boards that push back on the adoption of this technology are going to be seen negatively, ultimately not by shareholders because there's just tremendous value in the adoption of this technology. That said, if it's done right is a key caveat as well. Not to throw out the caveats today, but so making sure that when you're adopting technology internally for operational purposes, you're really thinking through all the risks associated with that comprehensively, carefully, and as a board member.

As a board member, this is true before AI, and it's true now with AI. There's always this tension between wanting to ensure that the company is thinking a few steps ahead and helping the management team stay focused on what they need to do to execute and to deliver shareholder value quarter to quarter, and in the longterm.

I think AI falls into that natural dynamic between a board and a management team. The board needs to expect that a management team is aware of all the AI evolution and opportunities and risks that we have been talking about. But at the same time, the board needs to trust the management team to be able to make the right decisions and focus in the right ways to drive that business forward.

And sometimes AI can feel like the shiny penny where it's like, "Ooh, that's cool, that's interesting. We should be spending time on it." But it is actually more of a distraction given where a company is in its development. And there's other places where the applications of it today make a ton of sense. And so I think that as a board and management team dynamic goes, I think first of all, to understand is it something that actually can move the business. And then there's that level of trust that you just naturally have to have between an award and a management team where you trust that the management team has heard the opportunities and the concerns and is applying what they need to apply both in the near term and the long term for the success of the company.

Another area is just the use of AI by the company management to prepare information for the board, so all the financial data, all of the underlying stuff that goes into board presentations. Increasingly, companies are using tools that facilitate the gathering and the presentation.

And the curation, which is very important to board members to have things presented in a more succinct and direct way.

What you see there, it's well received in the sense that the material's great and it's well presented, but there's concerns from board members about if you've taken too many humans out of the process, how accurate is this? I think having a conversation between management and the board about what processes are in place to ensure accuracy is I also think very important.

On the other hand, it's a boon for both the directors and the management because there, you really want your CEO, CFO, and others to be able to focus more on the operations of the business to provide their judgment about the underlying stuff, but as we all know, preparing for board meetings is a huge part of their job and laborious gathering of huge amounts of data to try to present it in a very effective and efficient way. So these tools allow the management to provide what they're great at, which is their judgment, their experience, their knowledge, and lets the tools do the underlying work. But again, it's imperative to understand what processes they have in place to ensure accuracy.

So last question. Are shareholders focused on the use of AI in the business and are shareholders focused on board oversight of AI?

I think it is category dependent. Depending on the company and the category that you're operating in, there's a different level of scrutiny from shareholders around AI adoption and usage.

Are you getting questions at investor days?

Shareholders always have questions around how is this going to impact your business. Generally what they're trying to suss out is, are you prepared? Do they reveal your posture towards AI? Is it defensive? Is it offensive? Is it completely in the dark? What they're trying to tease out is fluency and preparedness with AI in general.

And not being a step behind, looking at you, relative to your peers and how they're using AI.

Exactly. Are you positioned to win at the end of the day? Again, depending on the business that you're operating in, if you're working in a software business or a heavily data oriented business, then the level of questions are a lot more sophisticated and a lot more pointed. But if you're sort of in businesses like Shake Shack, retail, hospitality, I think the question is a little bit more about, are you thinking about it? How are you thinking about it? Where's the opportunity?

And I think it creates opportunities actually for businesses like Shake Shack to lean forward and say, "Here's all the ways in which we are adopting and utilizing this technology in order to deliver great customer and guest experience to uplift our employees and to ensure that we're going to be one of the winners at the end of this." It can become a point of differentiation. If you're able to craft both, not just the narrative, the actuality of, "Hey, I've harnessed this stuff, this is how we're using it." I actually think you end up being a couple steps ahead.

Yeah, using it for good.

Using it for good.

Versus where AI is really disrupting. Obviously, AI is a real disruptor in the software space versus Shake Shack where it's really going to help you drive your business, be more efficient, be more productive, and potentially more profitable for investors.

Absolutely. To be able to predict customer demand based on what's happening with weather and traffic patterns, to ensure that you're open when you need to be open, that you have the right amount of supply available so people can get the shake that they're looking for. That all of these factors that otherwise create lost revenue opportunity or erode margin because you forecast it incorrectly, suddenly you're able to unlock a better guest experience and you're able to do it more efficiently if you embrace tools in the way that the company has embraced those tools, and I think that can be really empowering and exciting to be a part of.

And Don, I hate to end on doom and gloom, but shareholders focused on the downside. Are you seeing more by way of disclosure and risk factors, for example? And how do boards think about that?

Boards are struggling with that to be candid, right? How do you disclose AI as a risk is key question for all companies right now. There's so much optimism, I think, particularly in management, oftentimes about the capabilities that AI brings and the efficiencies it can bring, but there's also a concern that sometimes you want to use AI to justify certain management activities that may have a variety of reasons, for example, layoffs.

You've seen companies, for example, be accused of AI washing, which is to say like, "Hey, we're able to reduce our workforce by these huge numbers because we're using AI now and there's some concern by regulators that maybe that's not true." It's giving company management the opportunity to claim that AI is building efficiencies for them that they're not. It's critically important that the board vet that and make sure it's part of its oversight process that it's valid, but I do think that's a place where regulators are going to give a second look and a third look, and they've signaled that pretty clearly at the SEC.

Great. Well, Sumaiya and Don, thank you so much. It's been a great discussion, and thanks for being on The Informed Board.

Thanks for having me. This was such a fun conversation.

Thank you for joining us for today's episode of The Informed Board. If you like what you're hearing, be sure to subscribe in your favorite podcast app so you don't miss any future conversations. Additional information about Skadden can be found at skadden.com. The Informed Board is a podcast by Skadden, Arps, Slate, Meagher & Flom LLP and Affiliates. This podcast is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.