What AI risks should boards know about?

The five AI risks boards must understand

A board needs to distinguish the organisation's legal role from day-to-day ownership of a process. The EU AI Act does not automatically make every director personally liable for every AI error, nor does it allocate all civil liability to the deployer. Liability depends on the relevant law, contracts and facts. Compliance reporting should identify the actual obligation and date. Financial exposure should be tied to a particular infringement rather than presenting the highest statutory penalty as the consequence of any governance gap.

The board governance questions for each risk

Ask management which AI uses can affect customers or employees materially, what evidence supports their reliability and who can intervene. Review access to confidential data and the process for checking important outputs. Establish how incidents are reported and whether a fallback has been tested. For regulated uses, request a timetable that distinguishes obligations already applicable from the phased high-risk rules. Record the board's decisions and any actions assigned to management.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.