In ASIC v Bekier [2026] FCA 196 the Federal Court of Australia ruled that directors may use AI to process board information, but cannot delegate their personal duty of care. An AI summary does not replace careful reading and critical questioning; anyone who relies on a model without their own judgement remains liable.
On 5 March 2026 the Federal Court of Australia published its liability judgment in ASIC v Bekier. The court discussed AI use by directors in relation to their personal duties of care and judgement. That makes the ruling relevant well beyond Australia: a notable example of a court addressing how a director’s personal responsibility relates to technology that summarises or organises board material.
What exactly did the Federal Court of Australia decide in ASIC v Bekier about AI use by directors?
The judgment indicates that AI use by a director is not necessarily impermissible: AI may assist with navigating and summarising board information, provided its use is principled, transparent and does not replace the director’s own reading, questioning and judgement. But the court emphasised that a summary may not replace the careful reading and critical questioning of the underlying material, that the ethical weighing and judgement remain with the director, and that AI use must be auditable and transparent.
The ruling supports the editorial conclusion that formal, recorded policy is preferable to informal shadow use of AI tools. A director who quietly turns a chatbot loose on board papers without this being regulated anywhere stands in a weaker position than a director who works within an agreed framework. The ruling supports this observation about controlled and transparent use; the broader translation below is our editorial analysis.
Why is prior approval of an AI system not enough for the duty of care?
Because the duty of care continues after a system is in use. That an AI tool was once approved, or that a supplier has provided a statement, says nothing about the quality of the summary a director sees today. The fourth survey by the Bank of England and the Financial Conduct Authority on AI in the UK financial sector shows that organisations are already deploying AI agents, third-party systems and external model providers at scale, while ongoing monitoring, reassessment and insight into external systems lag behind the controls before deployment.
In our assessment, that is the core of the tension ASIC v Bekier exposes: liability is personal and permanent, but practice organises its control chiefly beforehand. In our analysis, prior approval of an AI system or a supplier statement is therefore not enough as a control during use: anyone who relies on it cannot afterwards demonstrate that critical review still took place during use. We develop that point further in our analysis of the growth of third-party AI and provider concentration according to the Bank of England and FCA.
What does this ruling mean for directors, lawyers and CISOs who use AI in decision-making?
Our analysis is that, because the court places the duty of care personally with the director, a director should not expect to rely on a model output as a substitute for their own judgement if a decision is later challenged; the legal consequences will remain fact-dependent. Therefore we recommend that every board now records which board papers directors must read themselves in the source text before an AI summary may serve as an aid. Because the ruling favours formal policy over informal shadow use, directors who turn AI loose on confidential papers without recorded agreements run, in our analysis, a greater governance and evidence risk; therefore we recommend that the lawyer or company secretary draws up a board policy before the next meeting cycle that names permitted uses, prohibited data, model and supplier choice, mandatory human approval and escalation routes. Because the Bank of England and the FCA find that monitoring and reassessment lag behind the controls beforehand, pre-deployment approval is, in our assessment, no longer a defence when a system drifts over time; therefore we advise the CISO to set up ongoing monitoring, alert thresholds and reassessment on changes, and to link the logging of this to the decisions that rely on it. Because the ruling emphasises the importance of auditable and transparent AI use, a plausible-sounding output is, in our analysis, not enough as evidence that a human assessment took place; therefore we recommend that the board can show, per sensitive decision, which source, which human assessment and which release decision underpinned it, as we describe in why a plausible AI explanation is not yet proof of the decision.
Which controls must a director put in place to demonstrably meet the duty of care?
A director can better substantiate compliance with the duty of care by setting clear boundaries beforehand and retaining evidence afterwards of their operation and observance. The AI Risk Management Framework of the National Institute of Standards and Technology offers good practice for this, not binding rules: the framework describes voluntary measures that we, as an editorial translation, can reasonably relate to the board's duty of care. Our translation to the situation from ASIC v Bekier, in order of execution:
- Take stock of which AI systems process board information or can carry out actions autonomously, including third-party systems.
- Limit the powers of those systems to what is strictly necessary and record auditable limits on autonomous decision-making.
- Record for each application who the human responsible party is and which decisions require mandatory human approval.
- Set up ongoing monitoring and alert thresholds, and plan reassessment on every change of model, supplier or application.
- Ensure a stop mechanism and an incident playbook in case a system acts outside its limits.
- Retain linkable evidence of source, summary, human assessment, alerts and release decision for each sensitive decision; see concrete examples of audit evidence and how to document them.
This list is deliberately arranged around the difference the ruling sharpens: not only whether AI is permitted, but also whether the director can show that human assessment and responsibility actually steered the use and the decision. Anyone who records that separation in the broader AI governance and board responsibility reduces, in our analysis, the risk that a court later rules that the personal duty of care was outsourced to a summary.
Sources and references
Sources: The article draws on the ruling ASIC v Bekier [2026] FCA 196 of the Federal Court of Australia, the AI survey by the Bank of England and the FCA, and the AI Risk Management Framework of NIST.