AI Literacy in the Boardroom: Why India's Independent Directors Must Understand Generative AI

In January 2025, the Reserve Bank of India released a discussion paper on the responsible use of artificial intelligence in the financial sector — a document that landed quietly in regulatory inboxes but should have been required reading for every independent director on the board of an Indian bank, NBFC, or insurance company. The paper acknowledged that AI was already being used for credit underwriting, fraud detection, customer service automation, and algorithmic trading across India's financial system — and that the risks associated with these applications required board-level oversight, not merely management-level monitoring.

This RBI signal reflects a broader global reality: generative AI has moved from a technology department curiosity to a boardroom governance imperative in the span of approximately twenty-four months. ChatGPT's public release in November 2022, the subsequent launches of Google Gemini, Anthropic Claude, and Meta's Llama series, and India's own initiatives through the IndiaAI Mission have created a technology landscape that is evolving faster than most board evaluation frameworks are designed to assess.

The question for India's independent directors is uncomfortable but necessary: do you understand this technology well enough to govern its use in your company?

What "AI Literacy" Actually Means for a Board Director

AI literacy for a board director does not mean coding proficiency, data science training, or the ability to fine-tune a large language model. It means something more focused and more demanding in its own right: the capacity to ask the right questions, evaluate the risk disclosures management presents, assess whether the company's AI governance framework is adequate, and recognise when AI-related risks are being understated or misunderstood.

At its core, AI literacy for a NED requires understanding six domains:

How large language models and generative AI systems work — not in technical detail, but well enough to understand why they hallucinate, why they can reflect historical bias, why their outputs are probabilistic rather than deterministic, and why human oversight of AI-generated decisions remains essential.

Data governance and data quality — AI systems are only as reliable as the data they are trained on. For a bank's credit scoring model, biased or incomplete training data can produce discriminatory lending outcomes. For a pharmaceutical company's clinical trial analysis AI, poor data governance can produce false signals. Independent directors on audit committees must be able to probe management on data governance standards.

Cybersecurity risks specific to AI — generative AI introduces novel attack vectors: prompt injection attacks (where malicious inputs manipulate AI outputs), model extraction attacks, and adversarial examples designed to fool AI classifiers. India's Computer Emergency Response Team (CERT-In) has flagged AI-related cybersecurity risks in multiple advisories since 2023.

Regulatory and liability exposure — India does not yet have a comprehensive AI regulatory framework, but the Digital Personal Data Protection Act 2023 (DPDPA) creates obligations around automated decision-making that affect AI systems using personal data. Globally, the EU AI Act (effective 2024–2026) will apply to Indian companies doing business in Europe. Independent directors must understand the regulatory trajectory.

Ethical and reputational risk — AI systems that produce biased outcomes (in hiring, lending, insurance pricing, or content moderation) create reputational and legal exposure that can be significant and fast-moving. The audit committee and the board's risk committee must have frameworks for evaluating AI ethics risks.

Strategic opportunity and competitive advantage — independent directors must be able to engage with management's AI strategy not just as risk-mitigators but as strategic challengers. Is the company's AI investment appropriately ambitious? Is it behind competitors? Is management's roadmap credible?

"We spend forty minutes in audit committee reviewing a ₹50 crore IT capital expenditure line item. We spent seven minutes on the company's entire AI strategy. That imbalance has to change." — Independent director at a BSE 200 financial services company, speaking candidly at a closed-door governance forum, 2024.

The Indian Regulatory Environment: RBI, SEBI, and the DPDPA

India's financial regulators are moving with increasing urgency on AI governance. The RBI's 2025 discussion paper on responsible AI in finance is part of a larger regulatory trend. In 2024, RBI issued guidelines on model risk management for banks — a framework that requires boards to approve the institution's model risk management policy and ensures that risk committees review significant model deployments, including AI-driven credit models.

SEBI, for its part, has been alert to AI risks in capital markets. Algorithmic trading — which accounts for approximately 50–55% of NSE equity cash market turnover — has been regulated since 2012, but the emergence of AI-driven algo strategies has prompted SEBI to revisit its framework. SEBI's 2024 consultation paper on AI use by market intermediaries proposed disclosure requirements and board-level accountability for AI systems used in trading, research, and client advisory.

The Digital Personal Data Protection Act 2023, India's first comprehensive data protection legislation, creates obligations that directly affect AI governance. Section 12 of the DPDPA addresses automated decision-making: where a significant decision affecting a data principal is made solely by automated means, the data principal has the right to seek human review. For banks using AI-driven loan rejection systems, insurance companies using AI for claims denial, and employers using AI for hiring, this provision requires board-level attention to how AI decisions are documented, explained, and reviewable.

Global Frameworks That Indian Boards Are Watching

The EU AI Act, which entered into force in August 2024 with a phased implementation timeline through 2026, is the world's most comprehensive AI regulation. It creates a tiered risk framework: prohibited AI practices (certain biometric surveillance, social scoring), high-risk AI systems (credit scoring, employment, critical infrastructure) that require conformity assessments and human oversight, and lower-risk systems with lighter disclosure requirements. Indian companies with EU operations or EU customers must comply.

The OECD AI Principles, endorsed by India as an OECD associate, establish human-centred values that are increasingly referenced by Indian regulators. The US Executive Order on AI (October 2023) and subsequent NIST AI Risk Management Framework have influenced how large US multinationals — several of which have India-based subsidiaries with Indian independent directors — approach AI governance globally.

NIST's AI RMF is particularly instructive for Indian independent directors because it provides a practical, structured approach to AI risk management that audit and risk committees can use as a reference framework. It covers four core functions: Govern (organisational accountability and culture), Map (identify AI risks and impacts), Measure (assess and analyse AI risks), and Manage (prioritise and treat AI risks). These functions map well onto the oversight responsibilities of audit and risk committees on Indian boards.

The Talent Implication: AI Expertise Is Now a Board Skill Requirement

The consequence of this environment for board composition is direct and significant. Boards that lack any director with meaningful AI or technology expertise are operating with a structural oversight gap. The nomination and remuneration committee's skills matrix — which SEBI requires listed companies to maintain and disclose — should now include AI/technology literacy as an explicit competency.

Based on Gladwin International's board search work, we observe that demand for independent directors with genuine technology and AI backgrounds has grown sharply. The profiles in demand include: former CTOs or CIOs of major Indian or global companies; senior executives from AI/ML-focused technology firms; former regulators or senior officials from bodies such as the National Cyber Security Council or CERT-In; and academics with applied AI expertise who combine domain knowledge with board temperament.

The challenge is that the supply of such candidates who are also board-ready — with the governance fluency, interpersonal skills, and boardroom presence that effective independent directorship requires — is genuinely constrained. Gladwin International's board practice regularly engages with companies frustrated by the mismatch between the AI expertise they need and the governance experience they require simultaneously.

The solution, in many cases, is to invest in developing board readiness in strong AI and technology executives through structured board preparation programmes — IICA's Board Leadership Programme, the National Association of Corporate Directors' education modules, and bespoke governance coaching — while simultaneously investing in AI literacy training for existing boards through expert facilitated sessions. Several leading Indian banks have brought in AI researchers from IIT and IISc to conduct half-day board education sessions on foundation models, AI risk, and the regulatory landscape. These sessions consistently produce the same outcome: independent directors who emerge asking fundamentally better questions of management.