AI governance becomes a board mandate as operational reality lags