AI Ethics Board: What an AI Governance Committee Does Under the EU AI Act
An AI ethics board is a governance practice, not a statutory body: how a committee screens Article 5 uses and signs off high-risk Annex III deployments.
Start with the honest framing: an AI ethics board is a practice, not a statutory requirement. The EU AI Act, Regulation (EU) 2024/1689, does not mention an "ethics board," an "AI governance committee," or any mandatory oversight body. What the Act does require — a risk-management system, human oversight, named accountability — is more reliably delivered when one group owns the decisions. The committee is the mechanism many organisations choose; the duties it discharges are the law.
So the right question is not "do we need an ethics board?" but "where do the Act's obligations actually need a human decision-maker, and who is it?" The board is the answer to the second half.
What the committee actually decides
A working AI governance committee is not a debating society. It owns a short list of decisions that otherwise fall through the cracks between legal, engineering and the business:
- Screening for Article 5. Before any AI use ships, someone must confirm it is not a prohibited practice — social scoring (Article 5(1)(c)), manipulative or vulnerability-exploiting systems (5(1)(a)–(b)), or workplace/education emotion recognition (5(1)(f), which is prohibited, not merely high-risk). This is a hard gate, not a preference.
- Sign-off on high-risk and Annex III deployments. Where a use sits in Annex III (recruitment, credit scoring, biometric ID, essential-service eligibility and the rest), the committee approves it into production and confirms the obligation stack is in place.
- Setting risk appetite. The board decides which AI uses the organisation is willing to run at all — a genuine business judgment that no checklist makes for you.
- Escalation. Edge cases — a tool whose classification is contested, a serious-incident report under Article 73 — land here.
A short, well-run agenda beats an elaborate charter nobody reads.
How the board ties to the Act's machinery
The committee earns its place by connecting to three things the Act either requires or strongly implies.
| Board function | What it connects to | Statutory anchor |
|---|---|---|
| Approves and reviews high-risk uses | The risk-management system (a continuous, documented process) | Art 9 |
| Maintains the AI use-case register | The classification + registration duties | Art 6, Art 49 |
| Confirms a human can override the system | Human oversight measures | Art 14 |
| Assigns a named accountable owner per system | Provider / deployer obligations | Art 16, Art 26 |
The Article 9 risk-management system is the load-bearing link. It is not a one-off assessment but an iterative process running across a high-risk system's lifecycle; a committee that meets, reviews and records decisions is a practical way to evidence that the process is alive rather than a binder on a shelf. The AI use-case register — every system, its classification, its role, its owner — is the board's standing input. And every system on that register should have a named accountable owner, not a committee-as-owner: the board governs, an individual answers for each system.
Provider or deployer: the board's remit shifts
What the committee signs off depends on which role the organisation holds for a given system. As a deployer (Article 26), the board confirms the system is used per the provider's instructions, that the Article 14 human-oversight step is staffed, and that a FRIA (Article 27) is done where it applies. As a provider (Article 16) — including where Article 25 flips you into that role by branding or substantially modifying a system — the board's sign-off covers the heavier stack: risk management, technical documentation, conformity assessment. Many organisations are both, depending on the system, so the register should record the role alongside the classification. See provider versus deployer roles.
The deadline the board plans against
The high-risk obligations the committee signs off now apply from 2 December 2027 for stand-alone Annex III systems (and 2 August 2028 for Annex I product-embedded systems), under the Digital Omnibus deferral, which is formally adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026, with only Official Journal publication remaining, expected before 2 August 2026. Two things the board should already be enforcing, regardless of that date: Article 5 prohibited-use screening and Article 4 AI literacy, both in force since 2 February 2025.
Worked example: an SME committee
Meridian Insurance Services Ltd, a ~160-employee broker in Dublin with roughly EUR 40M turnover, stands up a four-person AI governance committee: the Head of Compliance (chair), the CTO, a senior underwriter, and the DPO. It meets monthly against a one-page register. Its decisions in a quarter: it blocks a proposed "sentiment scoring" of call-centre staff as a prohibited Article 5(1)(f) emotion-recognition use; it approves a third-party risk-pricing model — an Annex III point 5 high-risk use — only after confirming the provider's Declaration of Conformity, staffing the Article 14 human-oversight review, and commissioning an Article 27 FRIA (insurance risk-and-pricing deployers fall in FRIA scope); and it assigns the underwriter as the named accountable owner of that system. No statute compelled the committee to exist — but it is how Meridian evidences a living Article 9 process and a clean Article 5 gate.
How Confir helps
Confir gives the committee its standing input: a register of every AI system with its classification under Articles 5 and 6, the derived role (provider/deployer), and a named owner — produced by a deterministic, rule-based engine, so the same intake always yields the same finding. It flags prohibited Article 5 uses before sign-off, routes high-risk systems to the Article 9 risk records and the Annex IV documentation, and surfaces where an Article 27 FRIA applies — turning a monthly meeting into a decision over evidence rather than opinion.
Frequently asked questions
Does the EU AI Act require an AI ethics board?
No. The Act does not mention an ethics board, governance committee or any mandatory oversight body. It requires outcomes — a risk-management system (Article 9), human oversight (Article 14), named provider/deployer accountability (Articles 16, 26) — that a committee is a practical way to deliver. The board is a governance practice; the obligations it discharges are the statute.
What does an AI governance committee decide?
Typically four things: screening each use against the Article 5 prohibitions before launch; signing off high-risk and Annex III deployments into production; setting the organisation's risk appetite for AI; and handling escalations such as contested classifications or serious-incident reports under Article 73. The aim is a single owner for decisions that otherwise fall between legal, engineering and the business.
How does the board connect to the Article 9 risk-management system?
Article 9 requires a continuous, documented risk-management process across a high-risk system's lifecycle — not a one-off assessment. A committee that meets, reviews high-risk uses and records its decisions is a practical way to evidence that the process is alive. The board's standing input is the AI use-case register; its standing output is documented sign-off and review.
Who should sit on an AI governance committee?
There is no statutory composition. In practice it pairs compliance/legal (often the chair), a senior technical leader, a business owner from the affected function, and the DPO where personal data is involved. Keep it small enough to decide. Each AI system should also have a single named accountable owner — the committee governs, an individual answers for each system.
Should each AI system have a named owner?
Yes — as a practice. The Act assigns obligations to the provider (Article 16) or deployer (Article 26), which are organisational roles, but accountability works best when each system on the register has one named individual answerable for it. A committee-as-owner diffuses responsibility; a named owner per system keeps it concrete.
When do the high-risk sign-offs become mandatory?
The high-risk obligations now apply from 2 December 2027 for stand-alone Annex III systems (2 August 2028 for product-embedded ones) under the Digital Omnibus deferral, which is formally adopted — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026, pending only Official Journal publication, expected before 2 August 2026. The Article 5 screening and Article 4 literacy the board enforces are already in force.
Related guides
- Article 9: the risk-management system
- Article 14: human oversight
- Provider versus deployer roles
- Article 5: prohibited AI practices
- An AI governance RACI model
- Board reporting for AI governance
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →