Reporting AI Act Compliance to the Board: A Practical Template
What the board needs on EU AI Act compliance: the AI inventory, high-risk exposure, the deadlines, incidents and penalty exposure — on a cadence.
Directors are increasingly accountable for AI risk, and "we're looking into the AI Act" is not a board update. The EU AI Act, Regulation (EU) 2024/1689, does not prescribe board reporting, but the penalties (up to €35 million or 7% of turnover) and the operational exposure make it a governance topic. This page sets out what a useful board report contains.
What the board actually needs
Five things, kept short and current:
1. The AI inventory at a glance. How many AI uses the organisation runs, and how they split across tiers — prohibited (should be zero), high-risk, limited, minimal. A number the board can track quarter on quarter.
2. High-risk exposure. Which systems are high-risk (or would be), the Annex III categories involved, and whether the organisation is provider or deployer for each — because that decides the obligation weight.
3. The deadline position. Where the organisation stands against the live dates: Article 5 prohibitions and Article 4 literacy (in force since 2 February 2025); GPAI (2 August 2025); Article 50 transparency (2 August 2026, content-marking 2 December 2026); high-risk Annex III (2 December 2027, set by the Digital Omnibus adopted in June 2026; product-embedded Annex I systems 2 August 2028). What is done, what is in flight, what is at risk.
4. Incidents and issues. Any serious incidents (Article 73), prohibited-use near-misses, or classification disputes — and how they were handled.
5. Penalty and reputational exposure. A plain read of the worst-case exposure given the systems in scope, and the residual risk after current controls.
Cadence and ownership
Report on a cadence — quarterly is a sensible default, monthly during the 2026 regulatory window — with a named owner (commonly the CISO, Head of Compliance, or a cross-functional AI governance lead). The report should connect to the Article 9 risk-management records and the AI use case register, so it is grounded in the operational reality rather than assembled from memory each time.
What to avoid
Two failure modes. Over-claiming ("we're fully compliant") when high-risk obligations are not even live yet — better to show the runway and the plan. And AI-washing the numbers — counting tools instead of uses, which hides the high-risk exposure. The board should see uses and tiers, not a licence count.
How Confir helps
Confir produces the inputs a board report needs as a by-product of the work: the inventory by tier, the high-risk exposure with Annex III categories and roles, the deadline position per obligation, and the audit log behind it — each finding cited and reproducible because the engine is deterministic and rule-based. The quarterly update assembles from live data rather than a manual scramble.
Frequently asked questions
Does the EU AI Act require board reporting?
No, it does not prescribe board reporting. But because penalties reach €35 million or 7% of turnover and AI risk is increasingly a director-level responsibility, AI Act compliance is a governance topic that boards should see on a cadence. The report is good governance, not a statutory form.
What should an AI Act board report contain?
The AI inventory by risk tier, the high-risk exposure with Annex III categories and provider/deployer roles, the position against the live deadlines, any serious incidents or classification disputes, and a plain read of penalty and reputational exposure with residual risk after controls.
How often should we report?
Quarterly is a sensible default, moving to monthly during the active 2026 regulatory window when dates and the Digital Omnibus status are shifting. A named owner — often the CISO or Head of Compliance — should own the cadence.
What is the most common mistake?
Counting tools instead of uses. One tool can host several uses at different tiers, so a licence count hides the high-risk exposure. Boards should see uses and tiers. The other mistake is claiming full compliance before high-risk obligations are even live.
How does this link to the rest of our compliance?
It should draw directly from the Article 9 risk-management records and the AI use case register, so the board view is grounded in the same data the operational team works from rather than a separate narrative.
Related guides
- The AI use case register
- AI governance operating model
- The CISO's EU AI Act guide
- Serious incident report template
- EU AI Act penalties
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →