What is the board's role in AI governance?

Board oversight vs management operation; the governance distinction

The distinction between board oversight and management operation is fundamental to AI governance. The board does not select AI tools, manage AI vendors, or review individual AI outputs. It governs AI at the strategic level: by setting the organisation's AI risk appetite (what types and levels of AI risk the organisation will accept), by ensuring that management has established adequate governance structures, by receiving regular reporting on AI use and AI risk, and by challenging management's proposals when the risk picture is unclear or the governance arrangements are insufficient. This is not passive; good board oversight of AI means directors are prepared to ask hard questions, demand evidence, and push back on AI initiatives that lack adequate governance.

EU AI Act director obligations

Article 4 concerns measures supporting literacy among people operating or using AI on the organisation's behalf, considered in context. The amended provision does not require any specific level of AI literacy of any individual or prescribe a board certificate. Directors' broader duties depend on company law and applicable sectoral requirements. A practical board briefing should relate AI to the organisation's decisions, risk appetite and evidence gaps, with legal advice for any specific question of personal liability.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.