Trailblazing Women: Governing AI, Data, and Digital Democracy
Archive
NACD Nashville
Contact Us
NACD Nashville
programs@nashville.nacdonline.org
About The Event
March 31, 2026 | Virtual + a Watch Party and Reception at the East Tennessee Historical Society and Museum in Knoxville
Tennessee Delivered the Vote. Boards Still Own the Data.
By Barbie Bigelow, NACD.DC and Ed Magee | NACD Nashville
View this article on LinkedIn; we encourage you to share with your networks!
“Women are not small men.”
When Donna F. Zarcone, NACD.DC made the above statement, she was not making a cultural observation. She was making a governance point with real consequences for boards.
She offered that point as a data-integrity argument with clinical, financial, and legal consequences that boards must map into their artificial intelligence (AI) oversight responsibilities.
On March 31, NACD Nashville, NACD Atlanta, and NACD Capital Area joined the Smithsonian American Women’s History Museum to convene more than 300 registrants for “Trailblazing Women: Governing AI, Data, and Digital Democracy.” The program was moderated by Dean Marianne Wanamaker of the Howard H. Baker Jr. School of Public Policy and Public Affairs at the University of Tennessee–Knoxville. Panelists Zarcone, Elizabeth Harmon, and Shubhi Rao brought board-level governance experience, archival expertise, and AI data science into a single room on the last day of Women’s History Month, in the state whose ratifying vote secured passage of the 19th Amendment.
That conversation produced a diagnostic: Boards are governing AI at the output layer. The risk lives in the data. The gap between those two layers is where institutional liability begins.
Three Industries. One Shared Data Problem.
To better understand the risk, the panel examined how the data problem shows up in three very different fields: clinical health, financial services, and historical archives.
Zarcone framed the clinical health gap first. For decades, women were systematically excluded from clinical trials for drugs, devices, and treatment protocols. The implicit assumption embedded in research design was that female patients could be treated as physiological variants of male patients.
They are not and cannot.
The consequences are documented and ongoing. Women metabolize certain compounds differently than men. Hormonal variation produces different biological responses. Heart-attack presentation is the clearest failure mode: fatigue, nausea, jaw pain, and shortness of breath (not the textbook crushing chest pressure) describe how the majority of women present coronary events, but medical literature still classifies those symptoms as atypical.
When AI systems are trained on historical clinical data that already reflects those biases, the technology does not correct the problem. Instead, it propagates it—at scale and at speed.
For directors who want to go deeper on the clinical record, “Women’s Heart Health: What We’re Missing and Why It Matters,” a roundtable produced by Women’s Health Access Matters, is required viewing.
Rao then brought the financial services sector into focus. In 2019, a software developer noticed that his wife—filing joint tax returns, living in a community-property state, holding a higher credit score than he did—received a credit limit roughly twenty times lower than her husband’s. When she questioned the decision, customer service said simply: “Well, it’s the algorithm.”
The New York Department of Financial Services (NYDFS) opened an investigation. The superintendent’s conclusion was unambiguous: Algorithms do not receive immunity from discrimination. Disparate impact is illegal, whether intent was present or not.
Rao’s analysis cut through the surface narrative. The algorithm had not read gender; it read the depth and independence of each applicant’s credit history—what the industry calls the thickness of the file. What the algorithm read was generations of structural inequality. Women who had spent decades as authorized users accumulated strong credit scores but thin independent credit histories. The algorithm encoded that historical artifact as a financial signal and replicated it at scale.
Harmon, digital curator of the Smithsonian American Women’s History Museum, showed how the same logic plays out in museum historical archives. When historians worked with data scientists to analyze collections, they found that some of naturalist and botanical artist Mary Vaux Walcott’s specimen collections had been systematically attributed to her husband, Charles D. Walcott. The mechanism was a digitization convention: Records listing her name as “Mrs. Charles D. Walcott” had the honorary title removed in transcription, causing the record to read as Charles D. Walcott. The specimens transferred attribution in the metadata.
AI ingests the metadata. AI does not reinterpret history; it reflects it, including its omissions.
The East Tennessee Historical Society's docent tour of the spaces
Boards Are Governing at the Output Layer. Risk Also Lives in Data.
Three industries. One root cause: Data that entered the historical record carrying the structural inequalities of its era was treated as complete and objective input. It is not objective. It never was.
Rao opened the technology discussion where many board conversations do not: with the data, not the model. Her framing was direct: Think of AI like a Michelin Guide for a restaurant. Before the menu, before the recipes, before the kitchen equipment, the most important question is where the ingredients come from, how they were sourced, and whether any are contaminated or mislabeled. A brilliant chef cannot fix a bad ingredient. Likewise, a sophisticated algorithm cannot correct biased input data—it magnifies it.
The distinction between foundational and vertical large language models (LLMs) is not a technology briefing topic—it is a governance prerequisite.
Foundational models, the tools most organizations deploy, are trained on massive volumes of internet data. Rao named the dominant sources specifically: Reddit Inc. and Wikipedia. Reddit because its question-and-answer architecture is ideal for training response behavior; Wikipedia because its hyperlink density makes it efficient to crawl. The model embedded in an organization’s workflow has absorbed crowd-sourced human opinion, historical exclusion, and demographic bias at scale. It did so before the organization wrote a single AI policy.
Vertical LLMs operate differently. They are trained on curated, domain-specific data sets mapped to a defined purpose. The use cases are mapped before training begins. Their sources, exclusions, and constraints can be explicitly documented.
The governance mistake is not choosing the wrong model type; it is overseeing both models at the wrong altitude without asking about the source data. As Rao put it: “If you skip that questioning, you are not governing AI. You are governing the output and hoping for the best.”
When board conversations about AI focus on the application layer—what the tool produces, what it costs, what it automates, what efficiencies it creates—directors miss important risks and opportunities. Those are necessary conversations, but they are not AI governance. Governance begins earlier.
Four Data‑Layer Questions Every Board Should Ask
Rao gave directors a precise governance instrument: four questions that constitute data-layer oversight. They are not technical; they are the governance equivalent of a standard audit inquiry, applied one level deeper than many boards have gone.
1. Where did the training data originate? Not the name of the vendor or the brand of the model, but who sourced the underlying data, when, from what populations, and under what selection criteria? Rao’s standard: If your vendor or internal team cannot answer that query, the model is not ready.
2. What was intentionally excluded, and why? Absence is not neutral. Every data set has boundaries. The governance question is whether those boundaries were deliberate and documented or simply unexamined. As Rao said, “Absence by definition is not neutral. Every data set does have boundaries, and the question is whether those boundaries were intentional and documented or they’re just missing.”
3. How old is the data, and how is it weighted? Age alone is insufficient analysis. Weighting decisions carry as much governance risk as sourcing decisions. The relevant question is if those weighting rationales are documented and defensible … and if anyone on the internal team can explain them.
4. Has the training data set been audited for disparate impact before deployment? Not the algorithm—the data. Before training begins, before any code runs, has anyone asked whether the input systematically underrepresents any population? If that audit has not happened, the model is not ready for deployment.
Zarcone mapped those questions to the board’s structural accountability. AI governance is a multi-committee responsibility:
· The audit committee owns compliance and risk.
· The technology or finance committee owns capital stewardship.
· The nominating committee owns skills and composition.
· The full board owns liability and strategy.
No single committee has the full picture. The governance architecture must connect them.
The regulatory environment will not wait for boards to reach that conclusion independently: State-level AI regulation is accelerating, and in regulated industries, supervisory inquiry into AI data integrity is already increasing. The precedent that algorithms do not get immunity from discrimination was set in 2019. Board attention has not kept pace.
NACD Nashville Program Ambassador Barbie Bigelow offers a few words for the reception attendees
What Governance Looks Like Before the Algorithm
Getting AI governance right at the data layer does not begin with a committee charter or a framework document. It begins with documentation that many organizations do not currently require.
Five behaviors separate boards that govern AI from boards that observe it.
1. Require data provenance documentation before any model deployment. Sourcing, inclusions, exclusions, age, and weighting rationale must be produced before the model goes live. If the internal team or external vendor cannot produce that documentation on demand, the model is not ready.
2. Mandate independent audits of training data sets for disparate impact before training begins. Not audits of the output—audits of the input. The distinction is the difference between catching a problem downstream and preventing one at the source.
3. Evolve the nominating committee’s skills matrix to include lived experience with diverse user populations, not as a diversity credential but as a governance capability. Rao named this precisely: The question for every board candidate is no longer just what function they ran or what industry they came from. The question is whether representation ever directly mattered to the decisions they were making. A director who has never built for, marketed to, or led a workforce that reflected demographic complexity does not have the instinct to know where AI blind spots hide. That is not an integrity question; it is a capability deficit.
4. Govern the role of human judgment in the AI workflow. As AI output becomes more pervasive, the cognitive burden on the humans operating alongside them shifts. The skills required are different: understanding context, articulating the process, applying judgment to a machine-generated result. Rao was direct: Organizations cannot automate their way past the need for human validation. The board’s governance role includes asking whether the workforce has been trained for that workflow, not just if the tool has been deployed. The Q&A discussion added precise clarity. Human judgment is required in the governance of guidelines, processes, and controls. That is the board’s job.
5. Require documented data-protection policies for every AI deployment. When organizations submit internal data to foundation models, that data may be used to retrain the model—effectively moving proprietary information outside the organization’s control. Some platforms offer opt-out provisions; others do not. In practice, the only reliable way to prevent internal data from being absorbed into public models is through private or on‑premises deployments, an option that is costly and often not reflected in current budgets.
The board’s responsibility here is not whether the AI tool is useful; it is to determine if the organization can clearly trace where its data goes once it enters the system, if that data flow is documented and governed, and if the resulting risk is understood and acceptable.
Harmon offered the Smithsonian’s work as a structural template: bring collections experts, historians, technologists, and community partners into the same process. The Discoverability Lab at the Smithsonian American Women’s History Museum is using machine learning to surface women’s contributions buried by the conventions of their era: transcription practices, metadata standards, institutional titling norms. The same principle applies to corporate data governance. Discoverability is not only a historical problem; it is a governance problem. Data that cannot be traced, audited, or corrected cannot be governed. The work of correction requires the same multi-disciplinary architecture that boards need to govern AI.
A board that has not built that architecture has not governed AI—it has observed it.
The Core Reframe
The 2019 New York case did not arise because an algorithm was biased. It became a regulatory matter because an institution deployed a model trained on historically biased data and treated it as objective truth.
The algorithm was doing exactly what it was designed to do.; it was the data that was the problem. And no one in the governance structure had asked about the data.
That is not a technology failure. It is a governance failure—and boards own it.
Boards that wait for the output to surface the problem have already failed at the governance task. By the time disparate impact is visible in the output, the regulatory exposure is established, the reputational consequence is in motion, and the remediation cost are already in motion. Effective boards intervene earlier, at the data layer, where prevention is still possible.
The institution is always accountable. The question is if the board knew or if it was governing at the wrong layer and calling that oversight.
That is the work.
The Burn Memorial at the East Tennessee Historical Society space in Knoxville
Acknowledgments
Warren Dockter, Kay Lyons, and the entire team at the East Tennessee Historical Society provided extraordinary hospitality for the Knoxville watch party. Their museum is a must-see institution that brought fitting historical depth to a conversation about who gets recorded and who gets erased.
Christie Senft’s two-year commitment to building the Smithsonian American Women’s History Museum’s partnership with NACD Nashville made this program possible; her presence in Knoxville reflected what sustained collaboration actually looks like.
Marianne Wanamaker brought the intellectual architecture and the moderator’s discipline that this conversation required. The Baker School’s nonpartisan, evidence-first approach set exactly the right tone.
Donna F. Zarcone, Elizabeth Harmon, and Shubhi Rao gave the room something rare: precision vocabulary for a governance problem many boards are living without language for.
NACD Atlanta and NACD Capital Area copresented this program and extended the reach of a conversation that deserves a national audience.
Virtual Program Speakers
Elizabeth Harmon
Shubhi Rao
Donna Zarcone, NACD.DC
Marianne Wanamaker (Moderator)
NACD Nashville
Contact Us
NACD Nashville
programs@nashville.nacdonline.org
By registering for an NACD or NACD Chapter Network event, you agree to the following Code of Conduct.
| NACD and the NACD Chapter Network organizations (NACD) are non-partisan, nonprofit organizations dedicated to providing directors with the opportunity to discuss timely governance oversight practices. The views of the speakers and audience are their own and do not necessarily reflect the views of NACD. |