AI Task Force Warns Boards Face Legal Liability for Ignoring Auditor Security Concerns

2 min read

On Monday’s broadcast of the Fox Business Network’s “Varney & Co.,” Scott Kupor, a member of the AI Task Force, warned that company boards have a fiduciary duty—and potentially personal liability—to address security concerns raised by outside auditors. Kupor emphasized that these obligations are not just moral but legally binding, underlining the importance of corporate accountability in the rapidly evolving AI landscape.

Legal and Regulatory Framework for AI Security

Kupor explained that companies that have signed agreements with outside auditors are subject to a legal framework where these auditors effectively review and assess the security policies of public companies. These auditors report directly to the board, and if an issue is identified, the board is legally obligated to respond. Kupor pointed out that this is akin to financial audits, where boards have clear legal responsibilities and potential consequences for failing to act.

“The issue is, when you have an outside auditor, which is what the accord is that those companies signed, and that outside auditor is effectively reviewing your security policies, as a public company, that auditor reports to the board,” Kupor said. “And if you are the board and you receive an issue, just like in a financial audit, you have a fiduciary duty, and potentially even personal liability if you don’t respond to those security concerns.”

Broader Implications of Non-Compliance

Kupor further noted that there are additional legal repercussions for companies that fail to address security concerns. He highlighted that the Federal Trade Commission (FTC) and the Department of Justice (DOJ) have existing legal tools that can be used to penalize non-compliance. These agencies can take action against companies that do not adhere to security standards, potentially leading to fines, regulatory scrutiny, or even criminal charges.

“And so, it actually has real legal teeth,” Kupor stated, emphasizing that the legal framework is robust and designed to enforce accountability. This underscores the growing regulatory focus on AI security, as companies are expected to not only innovate but also ensure the safety and integrity of their technologies.

Call for Corporate Responsibility

The remarks by Kupor come at a time when the demand for transparency and accountability in AI development is intensifying. As AI systems become more integrated into daily life, the need for robust security measures is paramount. Kupor’s comments serve as a reminder that corporate boards are not just responsible for financial oversight but also for safeguarding the security and privacy of users.

“It’s not just a moral commitment,” Kupor said, addressing a question from host Stuart Varney about the current moral obligation for AI companies to self-report. “It’s stronger than that. It’s a legal obligation.”