The EU AI Act: Mandate, Conformity and Board Liability

The EU AI Act Regulation (EU) 2024/1689 is the world's first horizontal law for artificial intelligence. It applies risk-based obligations to almost any organisation that places an AI system on the EU market, puts it into service, or whose outputs are used in the Union. For boards, three things matter: what the Act mandates, how conformity is demonstrated, and where liability lands when it is not.

This article sets out each in board-level terms, and explains how we help management bodies govern AI without slowing adoption.

The mandate: what the Act actually requires

The Act sorts AI systems by risk. Most carry light obligations; a small set are prohibited outright; and the category that drives almost all serious compliance work is high-risk. A system is high-risk if it is a safety component of a product covered by EU harmonisation law, or if it appears on the Act's explicit list covering areas such as recruitment, credit scoring, critical infrastructure, education, essential public services, law enforcement, migration and biometrics.

For high-risk systems, the Act mandates a set of obligations that read like a governance programme rather than a technical checklist. Providers must establish a risk-management system, ensure data governance and quality, maintain technical documentation, keep automatic logs, be transparent to deployers, allow human oversight, achieve appropriate accuracy, robustness and cybersecurity, and register the system in an EU database. Deployers the organisations actually using the system must operate it under human oversight, monitor its outputs, keep logs and conduct a fundamental rights impact assessment where applicable.

The mandate is broad on purpose. It captures not only the models an organisation builds, but also the high-risk AI embedded in the products and services it buys. Boards that think "we don't build AI, so this doesn't apply" are usually wrong.

Conformity: how compliance is demonstrated

Conformity is the Act's central enforcement mechanism. Before a high-risk AI system can be placed on the market, it must undergo a conformity assessment and bear a CE mark, with a declaration of conformity drawn up by the provider.

Most high-risk systems follow a self-assessment route: the provider assesses the system against the Act's requirements using harmonised standards where available, documents the result, and assumes responsibility. A narrower set certain biometric and critical-infrastructure systems requires third-party assessment by a notified body, and some need to consult the relevant market-surveillance authority before deployment.

For general-purpose AI models, a parallel regime applies: providers must publish documentation, comply with the EU copyright acquis, and, for models presenting systemic risk, model evaluations, adversarial testing, incident reporting and cybersecurity protections.

For boards, the operational question is not which clause applies but whether the organisation can evidence conformity: technical documentation that exists and is current, a named conformity-assessment route, a CE mark where required, and a register of which third-party systems the organisation deploys and who verified them. Conformity that cannot be evidenced is, for enforcement purposes, conformity that does not exist.

Board liability: where the accountability lands

The Act's most consequential feature for directors is not its technical rules but its accountability design. Obligations sit on clearly defined actors providers, deployers, importers, distributors and authorised representatives with administrative fines of up to €35 million or 7% of worldwide annual turnover for prohibited-system violations, and up to €15 million or 3% for other breaches, with lower ceilings for providing incorrect information. Fines scale to turnover, which means the largest organisations face the largest absolute exposure.

Liability reaches the management body in three ways. First, the organisation is directly liable for breaches, and that liability is borne by the directors who approved, oversaw or tolerated the non-compliant deployment. Second, member-state enforcement authorities can order corrective action, withdrawal or recall decisions a board will have to manage publicly. Third, the Act interacts with broader liability regimes: the EU AI Liability Directive and revised Product Liability Directive allow civil claims for damage caused by AI, so an incident can generate regulatory fines and private claims simultaneously.

The governance lesson is that AI risk can no longer be delegated entirely to the technology function. The board must know which AI systems the organisation provides or deploys, which are high-risk, who holds the conformity evidence, and what happens when a system fails. A board that cannot answer those questions is exposed to a liability it did not consciously accept.

How we help

We work with the management body, not the engineering bench, to make AI governance defensible:

• Mandate mapping. We identify which of the organisation's AI systems are in scope, which are high-risk, and which obligations attach to each role (provider, deployer, importer) turning the Act's text into a concrete inventory.
• Conformity readiness. We assess the technical documentation, risk-management process, data-governance posture, logging and human-oversight arrangements against the Act's requirements, and close gaps before a notified body or regulator asks.
• Board accountability. We set the AI risk appetite, document the oversight chain, and prepare the board to discharge its duties under the Act and related regimes such as the NIST AI RMF and ISO/IEC 42001.
• Agentic and third-party AI risk. We extend oversight to autonomous agents and vendor-supplied AI, where the risk is least visible and the liability most likely to bite.
• Incident and enforcement readiness. We prepare the organisation for serious-incident reporting and regulator engagement, and stand alongside the board if enforcement begins.

The Act rewards boards that treat AI as a governed risk rather than a procurement decision. With structured, independent advice through our AI governance advisory and a virtual cyber board advisor engagement conformity becomes a position of strength: documented, defensible and aligned to the organisation's risk appetite. To start that conversation, request a briefing or read our dedicated EU AI Act overview.