EU AI Act for Boards: Timeline and Board Responsibilities

The European Union's Artificial Intelligence Act is not primarily a technology regulation. It is a governance regulation. While it establishes technical requirements for AI systems, the obligations it creates, including risk classification, human oversight, documentation, and accountability, fall squarely on the organizations that deploy those systems.

For directors of companies operating in or serving European markets, EU AI Act compliance is no longer a future consideration. Several compliance deadlines have already passed, and others are approaching. Understanding the Act’s governance and oversight implications is now a core board responsibility, not a discretionary best practice.

The EU AI Act is the world’s first comprehensive legal framework governing artificial intelligence, adopted in 2024 and entering phased application beginning in 2025.

It establishes a risk-based structure that classifies AI systems into four tiers:

• Unacceptable risk (prohibited)
• High risk (heavily regulated)
• Limited risk (transparency obligations)
• Minimal risk (largely unregulated)

The Act applies to any organization deploying, developing, or using AI systems in the EU market, regardless of where it is headquartered.

For boards, understanding AI Act compliance begins with the risk classification framework.

High-risk AI systems are those used in contexts where incorrect outputs could significantly harm individuals or society, including:

• Recruitment and employment decisions
• Credit scoring
• Critical infrastructure
• Biometric identification
• Education and public services

Organizations deploying high-risk systems must comply with requirements such as:

• Conformity assessments
• Technical documentation
• Audit logging
• Post-market monitoring
• Human oversight

For boards, the critical point is that compliance is ongoing. It is not a one-time certification but a continuous governance responsibility requiring periodic review and documented oversight.

The Act does not frequently reference boards explicitly, but its accountability structure makes board-level oversight difficult to avoid.

Boards should ensure:

• AI systems are accurately classified
• Oversight mechanisms are implemented
• Documentation and audit structures are in place

Boards should also confirm that:

• A full AI system inventory exists
• Clear ownership of compliance is assigned
• Escalation and accountability structures are effective

Evolution of Fiduciary Duties

Duty of AI Care

The EU AI Act increases the need for boards to apply existing governance and risk oversight duties to artificial intelligence.

Directors should treat AI risk with the same rigor applied to financial, legal, and operational risks.

Non-Delegable Responsibility

Boards may delegate operational work, but not accountability.

The Act’s enforcement structure makes the urgency clear. Under Article 99:

• The most serious violations (e.g., prohibited practices) can result in fines of up to €35 million or 7% of global turnover
• Other violations are subject to lower penalty tiers

Boards that rely solely on management assurances without independent oversight are not meeting the implied governance standard.

Mission-Critical Risk

AI risk intersects with existing regulatory frameworks.

For example:

• Credit decisioning systems may be subject to AI Act + financial regulations + data protection

Boards should ensure governance frameworks address these overlaps holistically.

Strategic Board Oversight Roles

Board Secretary as Steward

The board secretary can play a critical role in ensuring that board-level AI oversight is structured, documented, and sustained over time. This includes ensuring that AI governance is a standing agenda item at appropriate board and committee meetings, that relevant management reports are structured to give directors the information they need to exercise meaningful oversight, and that board education on AI risk and regulatory developments is provided on a regular cadence. The board secretary is also responsible for maintaining records of board deliberations on AI matters, which may become relevant in enforcement proceedings.

General Counsel as Gatekeeper

General counsel teams bear primary responsibility for translating EU AI regulation governance requirements into organizational policy and ensuring that legal exposure is assessed and managed across the phased compliance timeline. This includes advising the board on the scope of high-risk AI system obligations, managing the relationship with external legal counsel on cross-jurisdictional questions, and ensuring that procurement, vendor management, and partnership agreements reflect the Act's requirements for third-party AI deployments. General counsel should also be the primary escalation point for potential violations and the interface with regulatory authorities as enforcement develops.

Internal Audit as Partner

Internal audit provides the independent assurance function that boards need to verify management's compliance representations. For EU AI Act implementation, internal audit should be involved in validating the organization's AI system inventory, assessing the adequacy of risk classification decisions, testing the operational effectiveness of human oversight mechanisms, and evaluating documentation practices against Act requirements. Internal audit findings should be reported directly to the audit committee, ensuring that boards receive an independent view of compliance status rather than relying exclusively on management's self-assessment.

Data Governance

High-risk AI systems under the Act must be trained, validated, and tested on data sets that meet specific quality requirements, including relevance, representativeness, and freedom from bias. High-risk AI systems compliance requires organizations to document their data governance practices, demonstrate that training data meets the Act's standards, and maintain those records for post-market monitoring purposes. Boards should ensure that data governance for AI systems is integrated into the organization's broader data governance framework and is subject to the same rigor applied to other regulated data assets.

Human Oversight

The Act requires that high-risk AI systems be designed and deployed in ways that allow human operators to understand, monitor, and intervene in their operation. Human oversight is not satisfied by nominal review processes. It requires that the humans responsible for oversight have the authority, information, and practical ability to override system outputs when necessary. For boards, this means ensuring that management's human oversight structures are genuine rather than procedural, and that escalation paths from AI system outputs to human decision-makers are functional and documented.

Record Keeping

The Act mandates automatic logging of events for high-risk AI systems, with records retained for periods sufficient to support conformity assessments and regulatory review. A functional European AI governance framework requires that these logs be accessible to competent authorities upon request. Boards should confirm that technical logging requirements are met and that records management policies for AI systems are aligned with both the Act's requirements and any applicable sector-specific retention obligations.

Conformity Assessments

Before a high-risk AI system can be deployed, it must undergo a conformity assessment demonstrating that it meets the Act's requirements. Some systems may self-certify; others require third-party assessment. Boards should understand which systems in the organization require what type of assessment, ensure those assessments are completed on the required timelines, and confirm that post-market monitoring is in place to detect changes that might affect a previously issued conformity determination.

The EU AI Act phased timeline is not a distant regulatory horizon. Several deadlines have already passed, and the most demanding obligations are arriving in 2025 and 2026. Understanding the associated AI Act enforcement penalties fines of up to 35 million euros or seven percent of global annual turnover for the most serious violations under Article 99 of the EU AI Act (2024) makes the urgency clear. Boards that have not yet received a compliance status briefing from management should request one immediately.

• February 2025 (in effect): Prohibitionsof banned AI practices are now enforceable. AI systems in unacceptable risk categories including social scoring by public authorities, real-time biometric surveillance in public spaces with limited exceptions, and manipulation of vulnerable populations must be discontinued.
• August 2025 (in effect): Governance and conformity assessment rules apply. Organizations must have AI governance structures in place, including designated responsible parties, risk management systems, and the technical documentation requirements that apply to high-risk systems.
• August 2026: Full application of high-risk AI system requirements. All obligations for high-risk AI systems, including conformity assessments, human oversight mechanisms, data governance standards, and logging requirements, are fully enforceable.
• August 2027: Extended timeline for certain AI systems embedded in regulated products, including medical devices and machinery. These systems benefit from an additional transition period, but board oversight of the roadmap toward compliance remains a current obligation.

Board action: Ensure management has a compliance roadmap aligned with each deadline. Boards should not be receiving this roadmap for the first time at the August 2026 deadline. The governance structures required by August 2025 are the foundation on which high-risk system compliance is built.

A functional European AI governance framework at the board level requires four things: clarity about which AI systems are in scope and how they are classified; defined accountability within management for compliance ownership and escalation; independent assurance mechanisms, typically through internal audit, that give directors confidence in management's representations; and a regular reporting cadence that keeps the board informed as compliance posture evolves. Organizations with these four elements in place can demonstrate genuine board engagement with EU AI Act board responsibilities when regulators require it.

As boards take on expanded oversight responsibilities across AI governance, entity management, and evolving regulatory requirements, the tools available to support that work matter. Nasdaq Governance Solutions provides board management software and governance technology designed to help boards and their support functions manage the administrative, documentary, and communication demands of effective oversight.

Governance technology does not address regulatory compliance directly, but it supports the conditions under which compliance is achievable: structured board workflows, organized documentation, reliable communication between directors and management, and the administrative infrastructure that makes governance processes auditable. For boards navigating the documentation and oversight requirements of the EU AI Act alongside their existing governance obligations, purpose-built board technology can reduce friction and improve the quality of the governance record.

Nasdaq has published resources on AI-enhanced board collaboration, the corporate governance benefits of structured governance processes, and global entity management for organizations managing compliance across multiple jurisdictions. These resources are available on the Nasdaq Governance Solutions website for boards seeking to strengthen their governance infrastructure. Request a consultation to explore how governance technology can support your board's oversight responsibilities.

The Governance Imperative

The EU AI Act is arriving on a fixed schedule, and the organizations that treat it as a technology project rather than a governance imperative are already behind. The Act does not require boards to become AI experts; it requires informed, documented oversight of material risk.
Artificial intelligence has become a material risk category for virtually every organization operating at scale. Boards that establish AI governance, assurance, and reporting processes now will be better positioned to demonstrate EU AI Act governance compliance as enforcement accelerates.

Where can boards find an EU AI Act compliance checklist?

The European Commission and EU member state regulators have published guidance and tools, including an EU AI Act compliance checker at artificialintelligenceact.eu. Organizations should supplement public resources with legal counsel experienced in AI Act risk classification.
 
Does the EU AI Act apply to companies outside Europe?

Yes. The EU AI Act applies to any organization that places AI systems on the EU market or whose AI systems affect individuals located in the EU, regardless of where the organization is headquartered.

What is the difference between the AI Act proposal and the final version?

The EU AI Act was first proposed in April 2021 and adopted in 2024 after extensive revisions. The final version expanded obligations related to foundation models, transparency, and systemic risk. Organizations should ensure that EU AI Act compliance assessments, internal governance frameworks, and board-level oversight processes reference the adopted text of the regulation, not earlier proposal versions. Reliance on outdated drafts risks misinterpreting risk classifications, underestimating governance obligations, and overlooking requirements that now carry direct enforcement consequences under the final Act.