AI has moved from an innovation topic to the organizing theme of the private-company board agenda. NACD's Q2 2026 private-company survey found that 74% of respondents cited artificial intelligence as a top business issue for Q3 2026, up from 70% in the prior quarter. Directors connected AI to cybersecurity exposure, workforce planning, capital allocation, supply-chain pressure, and uncertainty around economic conditions.
The two problems boards must solve now
In the same NACD survey, private-company boards also cited shifting economic conditions (47%), cybersecurity threats (39%), competition for talent (38%), inflation (29%), geopolitical volatility (28%), and supply-chain disruptions (21%). Those concerns are not separate from AI governance: they determine which AI initiatives deserve capital, what controls must be in place, and where automation can safely operate.
Capital control
Boards must determine which AI investments to fund, how much capital to commit, and what evidence should justify continued spending. The label “AI” often combines five distinct investment categories: productivity tools, process automation, revenue enhancement, product integration, and enterprise transformation. Each has different economics, implementation requirements, and risk profiles.
Operational governance
Boards must govern how AI operates across the enterprise, including model accuracy, privacy, cybersecurity, intellectual property, regulatory compliance, data quality, reputational risk, and autonomous-agent oversight. NACD reported that private-company directors view AI as a risk multiplier for cybersecurity and a source of uncertainty in workforce planning, capital allocation, and policy response. The issue is no longer whether the company has an AI strategy, but whether AI is deployed under effective controls, with credible economics and clear accountability.
Why the problems are connected
The NACD results show AI sitting alongside macroeconomic pressure, cyber risk, talent constraints, inflation, geopolitics, and supply-chain disruption. That is why AI governance cannot be reduced to model policy alone: boards need an operating view that connects capital decisions to business exposure and control evidence.
Capital control and operational governance depend on the same operational understanding of the business. Boards cannot make sound investment decisions without knowing where AI is being used, what work it performs, what it costs, what outcomes it produces, and what risks it creates.
Similarly, a company cannot automate work responsibly without understanding the underlying workflow, the data involved, the actions the system may take, and where human judgment remains necessary. The same operational data supports both responsibilities: capital control determines where investment should be made, while runtime governance determines how approved capabilities operate in production.
Illustration: Gymshark
Gymshark is a globally recognized fitness-apparel brand operating on Shopify Plus. Its scale, international reach, product-launch intensity, and high-volume customer interactions make it a useful illustration of how AI capital control and runtime governance connect in a larger enterprise setting.
Customer-service and commerce work
Customer-service and commerce operations may include answering product availability, sizing, delivery, and return questions; summarizing customer, order, and interaction histories; drafting responses across email, chat, and social channels; interpreting promotion, returns, warranty, and regional policies; checking inventory, fulfillment, fraud, and sourcing records; and preparing approved updates in Shopify and connected systems.
Employees may initially use large language models to assist with these tasks, sometimes transferring data from Shopify, email, customer-service platforms, or internal records into a model. These activities do not represent a single AI investment. Some are productivity tools, some may develop into process automation, and others may support revenue growth, customer retention, or customer-facing capabilities.
The capital view: TLACap
TLACap provides the capital-allocation view. It uses usage, identity, workflow, cost, and outcome data to classify each AI activity by investment type, attribute model, software, integration, and labor costs, measure business impact and adoption, determine whether the activity improves productivity, revenue, margin, working capital, or risk, and identify AI consumption that is not producing sufficient value.
The same workflow evidence helps determine which activities are ready for production deployment. Routine order-status enquiries, approved address changes, standard return-eligibility checks, and policy-grounded product guidance may become sufficiently repeatable for controlled automation. Questions involving suspected fraud, disputed charges, exceptional refunds, safety issues, influencer or athlete relationships, or material reputational risk may remain human-assisted or require explicit approval.
The runtime view: milli.run
A runtime such as milli.run implements only the portions of the workflow that are ready for production. It can govern access to Shopify and connected enterprise systems, enforce business rules and regional policies, restrict permitted actions and transaction values, require human approval at defined decision points, escalate exceptions and ambiguous cases, and record each model decision, system action, and human intervention.
The runtime then produces operational metrics, including workflow volume, completion rates, escalations, exceptions, latency, model usage, customer outcomes, and financial impact. TLACap uses those same metrics to assess cost, productivity, margin, capital deployment, and whether additional investment is justified.