Executive accountability and the EU AI Act: what must the board decide?

Start with the role and the system

Inventory systems being used or placed on the market, their intended purposes, users and impacts. Determine with competent functions whether the organization is a provider, deployer or another actor. A purchased product may need further analysis if it is substantially modified or repurposed.

Regulatory classification cannot be inferred from project budget or the presence of a generative model. Document prohibited-practice checks, transparency requirements and any applicable high-risk obligations in the deployment context.

Make four responsibilities explicit

1. Qualification: legal or compliance validates the applicable scope and timetable.
2. Execution: the sponsor funds necessary data work, documentation, oversight and technical measures.
3. Control: a function with suitable independence reviews evidence and residual risk.
4. Escalation: incidents, changed uses and suspension thresholds reach the designated decision forum.

Which timetable belongs in the 2027 budget?

Application is progressive. Initial prohibited-practice and AI literacy provisions have applied since February 2025; the Commission also describes milestones for governance, general-purpose AI and transparency. High-risk implementation dates have evolved. Check the Commission’s current timetable and the applicable legal text for each system before committing to a deadline.

The Board Kit structures a mandate discussion; it does not establish compliance. Any personal liability of directors also depends on national law and the facts, rather than a diagnostic score.

Sources and limitations

• NIST AI Risk Management Framework
• European Commission: AI Act and implementation
• ISO/IEC 42001:2023

These frameworks inform governance and risk analysis. They do not validate ApexTransform scores or financial coefficients. Methods and examples are ApexTransform analysis, without endorsement by these organizations.

FAQ