AI GOVERNANCE · BOARD & SUPERVISORY BOARD
As the use of AI increases, the discussion is shifting from individual tools to accountability. Who decides on its use? Who assesses risks? Who checks whether human oversight actually works? And who can explain to the board whether the organisation is using AI in an economically sensible and controllable way?
This makes AI governance a question of leadership and oversight. Not every company needs a new committee or a Chief AI Officer for this. But every company needs a traceable architecture of accountability.
The EU AI Act increases governance pressure
Since 2 August 2026, the European AI Office and the competent authorities of the member states have been responsible for the implementation, supervision and enforcement of the AI Act. For high-risk applications, the legal framework provides, among other things, for organisational and technical measures and for human oversight by persons with sufficient competence, training and authority.
The distinction is important: the AI Act does not prescribe a specific internal governance structure or an “AI officer” for companies. The operational form of organisation remains a management decision. Precisely for this reason, the company itself must define robustly how accountability, control and escalation work.
Seven questions a board should be able to answer
- Where is AI used? Not only officially approved systems, but also business-critical applications in functions and processes.
- Which applications are strategic? Where is it only about efficiency – and where does AI change product, price, sales or decision logic?
- Who is accountable for results? Technology ownership alone is not enough if the business case lies in sales, operations or finance.
- Who is accountable for risk? Data protection, information security, model risk, compliance and reputational risk need clear responsibilities.
- How does human oversight work? People must not only be formally named but must have competence and actual decision-making authority.
- How are models and vendors controlled? External platforms change continuously. Governance must therefore also cover procurement, contracts, data access and monitoring.
- Which competence is missing in the leadership system? Is the topic sufficiently anchored on the executive board, or is additional AI expertise needed on the advisory or supervisory board?
AI expertise on the board does not mean programming
A board-level AI expert does not have to be a chief data scientist. What matters is the ability to translate technological developments into strategic and economic consequences. This includes questions such as: which investments make sense? Which assumptions behind an AI business case are robust? Which dependencies arise from platform providers? Which changes does the operating model need?
AI expertise on the board is thus similar to other specialised areas of competence: it must be deep enough to critically question management’s assumptions without taking on operational responsibility.
When additional AI expertise on the supervisory or advisory board makes sense
- AI is changing significant parts of the business model or value creation.
- major investments in data, cloud or AI infrastructure are pending.
- the company uses AI in regulated or particularly sensitive areas.
- management itself does not yet have sufficient transformation experience.
- AI becomes part of the equity story, the transaction logic or succession planning.
Governance begins with role clarification
A viable structure can look very different: clear responsibility with the CEO, an expanded CIO/CTO mandate, a Chief AI Officer, a steering committee or additional expertise on the board. What matters is not the organisation chart but whether accountability, decision rights and escalation paths work.
When filling such roles, AI Leadership Search connects directly with Board Advisory. The central question is then not “who knows AI?” but “which competence does this leadership system need to steer AI responsibly and economically?”
Sources and further reading
- European Commission: AI Act – governance and enforcement
- EU AI Act Service Desk: internal AI governance
- EUR-Lex: EU AI Act, in particular obligations for high-risk systems
As of 6 October 2026. Not legal advice.