Boards were built for a vertical world. Risk has gone horizontal

Corporate boards were built for a world that moved in neat lines. Information climbed up, decisions came down, and the biggest risks usually stayed in their lane. That’s the model still running most governance today, even as the business world around it has stopped behaving that way.

The trouble is that many of the risks directors worry about now do not stay put. A cyber incident can start as a technical problem and end up as a legal, operational and reputational mess. AI cuts across product, compliance, employees and brand. Geopolitical shocks hit supply chains, regulation and market access at the same time. None of that respects reporting lines.

Boards have responded in familiar ways: more meetings, longer agendas, more outside advisers, more expertise in the room. Those moves are sensible. But they mostly add layers to an old structure instead of changing the structure itself. Meanwhile, the problems keep getting more connected, more external and faster-moving.

There is also a mismatch in where the risk sits. Governance still tends to assume the company is the main unit of analysis. In reality, many of the most serious exposures live in the systems a company depends on: cloud infrastructure, AI ecosystems, global supply chains and digital platforms. That matters whether the company makes software or sells groceries. If it uses those systems, it inherits their risk.

And then there is timing. Boards work on cycles: quarterly meetings, scheduled reviews, formal reports. Risk now moves continuously. Cyber vulnerabilities can appear overnight. AI systems change through iteration. Geopolitics can shift in weeks. That leaves directors trying to oversee a moving target through a periodic lens, with vertically aggregated reports that can flatten the very complexity they need to see.

The result is not that boards are failing so much as that they are being asked to govern systems with a tool built for organizations. Directors are expected to understand technology, AI, cyber risk, geopolitics and strategy all at once, and the article’s real point is that cognitive bandwidth may be turning into a hard limit. The board may not be obsolete. But the old idea that governance can be improved just by adding more of the same looks increasingly thin.