EU AI Act for the board
Two failure modes are equally expensive. Treating a €35M headline as your exposure when your systems sit in the €15M tier produces a programme out of proportion to the risk. Treating the 2027 deferral as breathing room ignores four obligation sets that are live and penalty-bearing today.
What lands on you, and what does not
Ownership boundaries are the most useful thing to settle early. Expert analysis: the Regulation names organisations, not job titles.
| Obligation | Yours? | Note |
|---|---|---|
| Risk appetite and residual risk acceptance | Yes | Art. 9(5) requires residual risk to be judged acceptable — by someone named |
| The Art. 17 accountability framework | Yes | Responsibilities of management and staff, in writing |
| Resourcing the programme | Yes | Proportionate to the correct exposure tier |
| Art. 4 AI literacy across the organisation | Yes | Applies at every risk tier, live since Feb 2025 |
| Deciding the Art. 5 position before Dec 2026 | Yes | If you ship generative features |
| Technical delivery | No | Do not confuse oversight with execution |
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
The wrong number produces the wrong programme
€35 million or 7% of global turnover is Article 99(3), and it applies to breaches of the Article 5 prohibitions only. High-risk non-compliance and transparency breaches fall under Article 99(4) at €15 million or 3%. Supplying misleading information to authorities is Article 99(5) at €7.5 million or 1%.
Most organisations have no Article 5 exposure at all. Presenting the 7% figure as the company’s exposure is the most common error in AI Act board papers, and it drives spend that is disproportionate in one direction while the actually-live obligations go unfunded.
The exception worth checking: if you ship image, video or multimodal generation, the two new Article 5 prohibitions applying 2 December 2026 put you in the 7% tier for the first time. That is a genuine board matter. Article 5 →
What is actually live, versus December 2027
| Live now | Deferred to Dec 2027 / Aug 2028 |
|---|---|
| Article 5 prohibitions | Chapter III Sections 1–3: risk management, data governance, technical documentation, logging, human oversight, accuracy, quality management, conformity assessment, post-market monitoring, incident reporting — for Annex III stand-alone systems (2 Dec 2027) and Annex I embedded systems (2 Aug 2028) |
| Article 4 AI literacy | |
| GPAI obligations (Arts. 51–55) | |
| Article 50 transparency · Article 49 registration · national enforcement powers |
Next date: 2 December 2026: two new Article 5 prohibitions, and Article 50(2) marking for generative systems already on the market. Four months.
Your first 30 days
- Ask for the exposure by tier, not the headline figure. If the paper says 7% for high-risk, send it back.
- Ask what is live today and whether it is done. Article 50 disclosure and Article 4 literacy are the test.
- Name the accountability framework owner under Article 17(1)(m).
- Decide the Article 5 position if the business ships generative features. Deadline 2 December 2026.
- Ask who accepts residual risk under Article 9(5), by name.
Questions worth asking
- What is our exposure by penalty tier, per system?
- Which obligations are live today, and are they met?
- Who signs the acceptance of residual risk?
- Do we have a complete AI inventory, and who maintains it?
- What is our documented position on the December 2026 prohibitions?
- If a serious incident happened on Friday, who reports it by Sunday?
- What have we told workers about AI systems that evaluate them?
- Which of our AI is built on someone else's model, and does that make us the provider?
Status labels on this page
Verified fact: Article references, dates and penalty tiers cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The ownership allocation, the failure modes, and the 30-day sequence — all our practice rather than the text.
Unsettled: Harmonised standards remain in development, and the Commission's Annex III guidelines are in draft. Both affect how these obligations will be evidenced.
Governance maturity is the durable asset
The deadline moved once and may move again. Customer due diligence, procurement questionnaires and enterprise trust requirements do not move, and they are answered by the same evidence.
Start with the inventory
Every role guide on this site converges on the same first step: a list of the AI systems, their intended purpose, their role and their tier.
Frequently asked
What is the maximum fine under the EU AI Act?
Up to 35 million euro or 7 percent of total worldwide annual turnover, whichever is higher, but only for breaches of the Article 5 prohibitions under Article 99(3). Breaches of other operator obligations, including the high-risk requirements and the Article 50 transparency obligations, carry up to 15 million euro or 3 percent under Article 99(4). Supplying incorrect or misleading information to authorities carries up to 7.5 million euro or 1 percent under Article 99(5). For SMEs and start-ups the lower of the fixed amount and the percentage applies.
Does the board have obligations under the EU AI Act?
The Regulation does not impose duties on directors as such, but Article 17(1)(m) requires the provider's quality management system to include an accountability framework setting out the responsibilities of management and other staff, and Article 9(5) requires residual risk to be judged acceptable, which is a decision requiring a named accountable person. Article 4 AI literacy applies across providers and deployers at every risk tier.
Did the EU AI Act delay mean we can pause?
No. The deferral covers Chapter III Sections 1 to 3 for high-risk systems. Article 5 prohibitions, Article 4 AI literacy, the general-purpose AI obligations, Article 50 transparency and Article 49 registration are all live and penalty-bearing, and two new Article 5 prohibitions apply from 2 December 2026.