AI Governance KPIs and Metrics: What to Measure for the EU AI Act, and How to Report It to the Board
The AI governance KPIs that matter under the EU AI Act: inventory coverage, % classified, conformity status, incidents (Art 73), Art 4 literacy, FRIAs.
A board does not want to hear that your AI governance programme is "going well." It wants three or four numbers it can read in thirty seconds, compare to last quarter, and act on. The EU AI Act, Regulation (EU) 2024/1689, does not prescribe a single KPI — but the obligations it sets out map cleanly onto a small set of metrics that tell you whether you are actually compliant or just busy. This page sets out the ones that matter, what each one measures, and how to put them in front of a board.
A point of order first: AI governance KPIs are not a statutory concept. They are a practice — a management discipline you build on top of the legal obligations. Measure the right things and the underlying duties (inventory, classification, conformity, oversight, incident reporting) get done. Measure the wrong things and you produce a dashboard that looks healthy while a high-risk system ships unclassified.
The seven metrics that carry the programme
Most AI governance dashboards are too long. Seven metrics cover the EU AI Act obligations a board needs visibility into.
| Metric | What it measures | Anchored in |
|---|---|---|
| Inventory coverage | % of AI systems in the organisation that are recorded in your inventory | Foundational — you cannot classify what you have not listed |
| % of systems classified | Of inventoried systems, the share with a completed risk classification | Article 6 + Annex III logic |
| High-risk conformity status | Of high-risk systems, the share that have completed conformity assessment | Article 43 |
| Open serious incidents | Count of reportable serious incidents and their reporting status | Article 73 |
| AI literacy completion | % of relevant staff who have completed AI literacy training | Article 4 |
| FRIA coverage | Of systems that require one, the share with a completed FRIA | Article 27 |
| Time-to-classify | Median days from a system entering the inventory to a completed classification | Operational throughput metric |
Each of these answers a question a regulator or an auditor would ask. Walk through them.
Inventory coverage: the metric everything else depends on
Inventory coverage is the percentage of AI systems actually in use across the organisation that appear in your inventory. It is the foundation because every other obligation — classification, conformity, the FRIA, incident monitoring — presupposes that you know the system exists. A programme that reports "100% of systems classified" but has only ever inventoried half of them is reporting a flattering fraction of an unknown total.
There is no Article that says "maintain an inventory" in those words, but the duty is implicit throughout: you cannot meet the Article 26 deployer obligations or the Article 16 provider obligations for a system you have not identified. Track coverage as a trend, not a point. A figure that climbs from 60% to 95% over two quarters is a healthy programme; a flat 70% means systems are entering the business faster than governance catches them.
Percentage of systems classified
Of the systems in your inventory, how many have a completed risk classification under Article 6 — prohibited (Article 5), high-risk (Annex III or the Annex I product route), limited-risk (Article 50), or minimal? This is the single most diagnostic governance number. Until a system is classified you do not know which obligations apply, so an unclassified system is an open question mark on the risk register.
Report this as a fraction with the absolute counts behind it: "142 of 150 inventoried systems classified (95%); 8 pending, none suspected high-risk." The qualifier matters — eight unclassified minimal-risk tools is a different board conversation from one unclassified system that might be a high-risk recruitment screen.
High-risk conformity status
For every system classified as high-risk, has the Article 43 conformity assessment been completed, and is the documentation pack — the Article 11 / Annex IV technical documentation, the Article 47 Declaration of Conformity — in place? This is the metric with a deadline attached. Stand-alone high-risk Annex III obligations apply from 2 December 2027 under Regulation (EU) 2026/1744, the Digital Omnibus on AI (published in the Official Journal on 24 July 2026, in force since 27 July 2026; the original date was 2 August 2026); product-embedded high-risk AI under Annex I routes to 2 August 2028. Plan against those dates.
A board reads conformity status as a countdown. Pair the percentage with the nearest binding date: "3 high-risk systems; 1 conformity-complete, 2 in progress; deadline at 2 December 2027, under the adopted Digital Omnibus deferral."
Serious-incident counts (Article 73)
Article 73 requires providers of high-risk AI to report serious incidents to the relevant market-surveillance authority. As a metric, track the count of serious incidents, the count that met the reporting threshold, and the count reported within the statutory window. Zero incidents is a fine number to report — but report it as "zero reportable incidents this quarter," not silence, so the board knows the monitoring is running and finding nothing rather than not running at all.
AI literacy completion (Article 4)
Article 4 — AI literacy — has applied since 2 February 2025 and covers all AI, not just high-risk. Since 27 July 2026 the amended text requires providers and deployers to take measures to support the development of AI literacy among their staff, rather than guarantee a set level for each individual. The metric is the share of relevant staff (anyone who operates, oversees, or makes decisions with AI) who have completed appropriate literacy training — the most direct evidence that those measures were taken. Unlike the high-risk duties, this obligation is already live across the whole portfolio, so a low completion rate here is a present exposure, not a future one.
FRIA coverage (Article 27)
The Fundamental Rights Impact Assessment under Article 27 is mandatory for public-body and public-service deployers of high-risk AI, and for deployers of creditworthiness or life/health-insurance high-risk systems — not for most private employers. The metric is therefore conditional: of the systems that require a FRIA, what share have a completed one? Reporting "FRIA coverage: 100% (2 of 2 required)" is precise; reporting raw FRIA counts across a portfolio where most systems do not need one is noise.
Time-to-classify
The only pure operational metric in the set: the median number of days from a system entering the inventory to a completed classification. It tells the board whether governance is a bottleneck. A median of 3 days means the programme keeps pace with the business; a median of 40 days means systems are in production, unclassified, for over a month — which is where unmanaged high-risk exposure lives.
How to report it to the board
Boards do not read dashboards; they read exceptions and trends. Lead with a one-line verdict ("All high-risk systems on track for the planned deadline; one literacy gap to close"), then show the seven metrics as this-quarter-versus-last-quarter, then a short list of what needs a decision. Keep the statutory citations in a footnote, not the headline — the board cares about the number and the date, the auditor cares about the Article.
One discipline worth enforcing: never report a percentage without its denominator. "95% classified" is reassuring until you learn the denominator is 40% inventory coverage. The honest composite metric is coverage x classification x conformity — the share of all AI in the organisation that is inventoried, classified, and (where high-risk) conformity-complete. That single chain is the most truthful number you can give a board.
Worked example: Lindgren Analytics AS
Lindgren Analytics AS, a Stockholm-based data-services company with roughly 240 employees and about €31M turnover, builds its first AI governance dashboard. The inventory lists 58 AI systems; inventory coverage is estimated at 88% after a discovery sweep finds eight shadow tools. Of the 58, 54 are classified (93%): 49 minimal-risk, 4 limited-risk under Article 50, and one high-risk — a vendor-supplied CV-screening tool used in recruitment, which falls under Annex III point 4.
For that one high-risk system Lindgren is the deployer (Article 26), so conformity assessment is the vendor's duty, but Lindgren tracks its status anyway and confirms no FRIA is mandated (it is a private employer, not a public body or a creditworthiness/insurance case). Article 4 literacy completion sits at 72% — the board's action item this quarter. There are zero reportable serious incidents. Time-to-classify median is 6 days. The board hears one verdict: literacy is the gap, everything else is on track, and the high-risk recruitment tool is the system to watch.
How Confir helps
Confir maintains the AI inventory, classifies each system under Articles 5, 6 and 50 with Annex III logic, and computes the governance metrics directly from that data — inventory coverage, share classified, high-risk conformity status, FRIA coverage, and a board-ready Compliance Health Score — so the dashboard is a by-product of doing the work, not a separate spreadsheet. The classification engine is deterministic and rule-based: the same intake produces the same finding, and the rule that fired is human-readable, which is exactly what an auditor reviewing your metrics will want to see.
Related guides
- Reporting AI governance to the board
- The AI governance maturity model
- AI literacy under Article 4
- The FRIA under Article 27
- Serious incident reporting (Article 73)
- Building an AI risk register
- How to classify an AI system
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →