The board AI paper for the second half of 2026 is different from the paper that has dominated the past twelve months. Three things have shifted. Here is what the H2 paper should cover, and what should fall off it.
TL;DR. The H2 2026 board AI paper should be about evidence and exposure, not strategy framing. Move the high-risk conformity work to programmed status, surface the Article 4 literacy posture, name the AI Office of Ireland contact, refresh the inventory, and read the shadow AI exposure.
The board AI paper for the second half of 2026 is materially different from the one that has dominated most Irish boards over the past twelve months. Three things have shifted since the spring board cycle. The Digital Omnibus deal extended the high-risk conformity deadlines to December 2027 and August 2028. The AI Office of Ireland is roughly ten weeks from opening. Article 4 literacy supervision begins on schedule on 2 August. The combination changes which questions the board should be reading about and which questions have moved off the immediate agenda.
This piece sets out what should be on the H2 board paper, what should fall off, and what the chair and the company secretary should be looking for in management's presentation.
What moves off the immediate agenda
The August 2026 high-risk conformity deadline as an immediate question. For organisations with genuine high-risk AI exposure, the conformity work has moved to 2027 and 2028. This is not a reason to disengage from the work; it is a reason to shift it from urgent to programmed. The board paper should reference the extended deadlines as the new working dates and note that the conformity work continues on a programmed basis. The board does not need a monthly update on conformity progress until late 2027.
Generalised AI strategy statements. The board AI paper has, in many Irish organisations, become a vehicle for high-level strategy framing — competitive positioning, sector-wide observations, long-horizon capability questions. These belong in the annual strategy paper, not the H2 governance paper. The H2 paper should be about evidence and exposure, not framing.
Vendor selection conversations. Whether to standardise on Microsoft Copilot or Claude or an alternative is an operational question, not a board question. The board paper should reference the standardisation decision if material, but should not relitigate it.
What should be on the H2 paper
The Article 4 literacy posture, evidenced and role-mapped. The single most immediate compliance question for the broad population of Irish organisations is whether the organisation has a defensible literacy posture in place for 2 August. The board paper should evidence: the AI inventory, the role mapping, the training delivered, the refresh cadence, and the named single point of contact for any competent authority engagement.
The AI Office of Ireland engagement posture. The Office opens on 1 August. The first ninety days will be heavily signalled — guidance, registrations, sectoral statements, identification of priority sectors. The board paper should identify the named single point of contact for the Office and the competent authority, the escalation path for any information request, and the engagement disposition (engaged early, responsive, or passive). The board does not need to read the Office's guidance directly. It needs to be assured that someone is reading it and responding to it.
The AI inventory and risk classification, refreshed. The inventory work that many organisations completed in the spring should be re-evidenced as current. Risk classifications under Annex III should be revisited where material organisational change has occurred. The inventory is the foundation document of every other AI governance conversation; the board paper should evidence that it is current.
The shadow AI exposure. Where an organisation has conducted a shadow AI audit (or should), the board paper should summarise what was found and what is being done. Where an audit has not been conducted, the paper should set the timing. The shadow AI question is the highest-probability discovery question a competent authority engagement will land on; the board should not be reading about it for the first time at that point.
The financial commitments. The Microsoft 365 price increase landing in July, the Copilot renewal posture, the AI-related spend across functions including any third-party advisory engagement, and the trajectory of these costs over the next twelve months. The board does not need a line-item budget; it needs the directional picture and the rationalisation posture.
The risk register entries. AI-specific entries on the corporate risk register should be reviewed in the H2 paper, with explicit reference to: prohibited practices (in force since February 2025), Article 4 (supervision starts 2 August), high-risk conformity (programmed to 2027/2028), data protection alignment, and the systemic operational risk of AI tools embedded in load-bearing organisational workflows. The risk register language should be specific. "AI poses regulatory and operational risks" is not a useful entry.
What the chair should be looking for in management's presentation
The H2 paper should be presented by an identifiable owner — typically the Head of Risk, the General Counsel, the COO, or a designated AI governance lead — not by a rotation of contributors. The chair should be able to ask any of the five board-level questions below and receive a substantive answer in the room.
- Where is our AI inventory, and when was it last refreshed?
- What is our Article 4 literacy posture, by role, and what evidence do we have of it?
- Who is our single point of contact with the AI Office and the relevant competent authority?
- What did our last shadow AI exposure check find, and what are we doing about it?
- What is our combined AI-related spend, and what is the rationalisation posture?
A management team that cannot answer these in the room is not in a position to engage with the Office or the competent authority when an information request lands. The H2 board paper should de-risk that conversation by surfacing it now.
The thing the board does not need to do
The board does not need to read the EU AI Act, the Digital Omnibus regulation, or the General-Purpose AI Code of Practice in text. It needs assurance that someone in the organisation has read them and is acting on them. The board paper should signal that engagement clearly. A two-line statement of the form "Our AI governance lead reviews the Office's published guidance monthly and reports material developments to the Risk Committee" is sufficient, provided it is true.
Boards that have spent the past twelve months reading sector commentary about the EU AI Act are well-prepared on context but often under-evidenced on their own organisation's posture. The H2 paper is the moment to rebalance.
Acuity AI Advisory provides board-level AI advisory for Irish boards approaching the supervision phase of the EU AI Act. Vendor-neutral, fixed-fee, calibrated to the audit committee or risk committee where the work belongs.