AI governance for boards: what the EU AI Act asks directors to oversee
The company uses AI in customer service, recruitment and internal analysis. Each team has chosen a tool, and management reports that the suppliers are handling compliance.
The board needs a fuller answer. The EU AI Act allocates obligations according to the organisation's role and the particular system or use. A supplier's responsibilities do not automatically cover the company deploying its product.
The Act does not create one universal checklist addressed to every board. Directors need management to establish what applies to their business and demonstrate how it is being addressed.
Know the uses and the company's role
Ask for a proportionate inventory showing what the system does, who uses it, whose interests it affects and who owns the process. Include AI embedded in purchased software.
Establish whether the company is a provider, deployer or another actor under the Act. Changes to a system or its intended purpose may change the assessment. Obtain appropriate specialist advice rather than relying on a product's marketing label.
Recruitment and other sensitive uses can fall within the high-risk rules, subject to the legal classification and relevant exceptions. Assess the actual use.
Separate current duties from preparation
As checked on 17 October 2026, the prohibitions and AI-literacy provisions have applied since 2 February 2025. General-purpose AI obligations began applying in August 2025, with transitional arrangements for some models. Relevant transparency duties under Article 50 apply from 2 August 2026, with specific exceptions and transitional provisions.
Following the 2026 amendments, the principal high-risk requirements for Annex III systems apply from 2 December 2027; those for regulated-product systems under Article 6(1) apply from 2 August 2028. Specific transitional rules can affect individual systems.
Ask management to maintain the applicable timetable with legal advice. A future deadline for one category does not suspend obligations already in force.
Make oversight workable
For high-risk systems, prepare for the applicable duties on use, monitoring, records and human oversight. Article 26 calls for oversight by people with the necessary competence, training, authority and support.
Test that arrangement on a disputed result. Who can question it, obtain the relevant information and intervene? A person nominally reviewing outputs may lack time or authority to act.
AI-literacy measures should reflect people's roles and the context of use. The board should ask what staff need to understand and how management identifies gaps.
Connect compliance to business decisions
Give each material use an accountable owner, escalation route and reporting proportionate to its consequences. Reassess when the system, purpose or operating conditions change.
Directors should be able to see which uses are approved, which need further work and which should pause. Compliance evidence and business judgement need to meet in the same decision.
Sources, checked 17 October 2026: European Commission AI Act overview; consolidated AI Act; Article 50 guidance.
See our technology, AI and cyber oversight service for help structuring the board discussion.