The Board’s Guide to AI Governance in 2026

The EU has given boards time, not a pass. The Digital Omnibus on AI entered into force on 27 July 2026 and moved the high-risk regime to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems ^[1]. It did not move the Act's general application date of 2 August 2026, and the ceiling for prohibited practices is still EUR 35 million or 7% of worldwide annual turnover, whichever is higher ^[2]. The exposure that matters most to directors was never on the EU calendar: oversight law asks whether a board built a reporting system and acted on what it saw.

Our thesis is that the board's real risk in 2026 is not a missed date but an inability to show, with documents, what it knew and what it did. Two measures from different populations are not one trend. The Conference Board tracks disclosure, not oversight: 83% of S&P 500 companies disclosed AI as a risk in 2025, up from 12% in 2023 ^[3]. NACD's 2025 public company board survey (n=146, self-reported) is about board practice: 62.33% of respondents reported full-board agenda time on AI, while 6.16% had established metrics for management reporting ^[4]. On that survey, attention runs ahead of instrumentation.

What the EU timeline looks like now, and what did not move

Already live. Prohibitions and the AI literacy provision have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most remaining rules, including Article 50 transparency, from 2 August 2026, when enforcement starts ^[5][6]. Two things follow on 2 December 2026: new prohibition paragraphs ^[6] and the end of the Article 50(2) marking grace period for systems already on the market ^[5]. An enterprise that uses an AI system under its authority is a deployer under Article 3(4), so buying a tool and using it in the business is enough ^[7]. Deployer breaches of Articles 26 and 50 sit in the middle fine tier, up to EUR 15 million or 3% ^[2]. Article 50 splits its duties by role: machine-readable marking of generated outputs (Article 50(2)) falls on providers of generating systems, while deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest, with exceptions ^[8].

Literacy (Article 4) is softer than it was. Providers and deployers must now "take measures to support the development of AI literacy" and need not guarantee any specific level ^[9]. The Commission adds that Article 4 does not oblige anyone to measure staff knowledge ^[10].

Newly dated. High-risk duties moved: Annex III uses from 2 December 2027, Annex I from 2 August 2028 ^[6]. Deployers of high-risk systems must assign human oversight to people with competence, training and authority, keep logs for at least six months and, as employers, inform workers before use ^[11]; a fundamental rights impact assessment applies only to some deployers ^[12]. The Omnibus was mostly a delay, but it also softened Article 4 and added a lower fine cap for small mid-caps ^[2][9]. Parliament approved it on 16 June 2026 ^[13].

Still unsettled. The Commission's Article 6 guidelines on classifying high-risk systems were published on 19 May 2026 as a draft ^[14]; we found no final version, which is an absence of evidence from our searches, not a Commission statement. Harmonised standards give a presumption of conformity only once cited in the Official Journal ^[15]. CEN and CENELEC approved the first, EN 18286 on quality management systems for AI Act purposes, in June (the news item is dated 29 July 2026 and gives no year), and the Commission was expected to publish its reference in the Official Journal later in 2026 ^[16]. We found no sign of that citation by 13 October 2026, so no presumption of conformity yet applies; in March the Commission said the remaining standards were still in development ^[15]. Borderline cases matter: a provider that considers an Annex III system not high-risk must document that assessment, and profiling of people is always high-risk ^[17].

What should a board do with each date? Before 2 December 2026, confirm that someone owns the new prohibitions and the Article 50 duties that fit the company's role (marking for providers of generating systems, deepfake and text disclosure for deployers) ^[8]; before 2 December 2027, have the inventory show which uses may be Annex III; and track the draft classification guidelines and the Official Journal citation of EN 18286 until then.

Four reference points, four different jobs

Boards often treat a law, a standard, a framework and a set of principles as interchangeable. They are not.

Two cautions follow. First, in the AI Index's reproduction of a survey it ran with McKinsey, organisations cited GDPR most often as a regulatory influence on their responsible-AI practices (60%), then ISO/IEC 42001 (36%), the NIST AI RMF (33%) and the OECD AI Principles (16%) ^[23]. ISO and NIST were new entries in 2025, so the figures show interest, not maturity, and they measure influence rather than adoption ^[23]. Second, neither ISO/IEC 42001 nor the NIST framework is the standard that earns an AI Act presumption of conformity; that route depends on harmonised standards cited in the Official Journal ^[15]. NIST is candid on the point that matters to boards: the framework "alone will not lead to these changes", and effective risk management requires "organizational commitment at senior levels" ^[20]. AI RMF 1.0 remains current; NIST says it is being revised, and we found no public revised draft by 13 October 2026 ^[24]. Ask management which instruments it has adopted for which job, and treat any certificate as evidence of a system, not as protection.

Where directors' personal exposure comes from

Exposure comes from being unable to show that the board built a system and responded to what it saw. Fines under the Act fall on the company; a director's personal exposure comes from oversight law. In Delaware the Caremark doctrine has two prongs: failing to implement a reasonable reporting system, or consciously failing to monitor or respond to red flags, and it turns on bad faith. Matera argues that AI does not change that standard but changes the evidence of good faith ^[25]. We did not identify any AI-specific Delaware ruling in the sources we opened. This is Delaware law, relevant to US-incorporated companies; EU and other national director duties are outside this guide.

The same source notes that Delaware protects good-faith reliance on competent experts, not blind reliance ^[25]. ICGN, an investor body, states that the board is accountable for overseeing responsible development and use of AI ^[26]. Debevoise, a law firm, argues that every director needs baseline AI literacy, that only a very small share of companies need a dedicated AI expert on the board, and that companies should not be dissuaded from adding one where suitable candidates exist ^[27]. No source we opened shows that an AI-expert director improves outcomes. For context, Conference Board data show disclosure of AI expertise among S&P 500 directors growing from 1.5% in 2021 to 2.7% in 2025 ^[3]; the press release does not define the denominator, so read it as a disclosure trend, not a count of qualified directors. In a Conference Board survey of 130 executives, largely from US public companies, 21% said they plan to add directors with dedicated AI or technology expertise ^[3].

Investors are filling the gap. These figures are source-attributed analysis republished by the Harvard Law School Forum, not primary data. In Glass Lewis's policy survey (2024, per the post's footnotes), 65% of US investors wanted clear disclosure of board oversight of AI, and 49% said it should be codified in a committee charter or governing documents ^[28]. Among S&P 100 proxies in 2025, 54% disclosed board-level oversight and only 28% disclosed both oversight and an AI policy; of the 54%, 63% gave the oversight to a specific committee and 37% kept it with the full board ^[28].

The attention-to-plumbing gap

The NACD table is the clearest picture of how far boards have come and where they stop.

Other sources point the same way, with different populations, so the numbers should not be merged. Deloitte surveyed 695 board members (84%) and C-suite executives (16%) in 56 countries in January and February 2025. It found 31% saying AI is not on the board agenda (45% a year earlier) and 66% saying their boards have limited to no knowledge or experience ^[29]. This is a survey of respondents Deloitte reached, not a random sample (our reading), so treat it as indicative. Boards discuss AI most with the CIO or CTO (72%) and over half with the CEO, and only 12% with the CISO and 12% with the CRO ^[29]. Our reading: boards hear mostly from the people who build AI and less from those who challenge it.

Ownership is also unsettled below the board. In the 2025 survey the AI Index ran with McKinsey, information security was the most common primary owner of AI governance at 21%, and 5% of organisations had no designated owner ^[23]. The same source records 362 documented AI incidents in 2025, up from 233, and a fall from 28% to 18% in organisations rating their incident response as excellent ^[23]. The first is public reporting; the second is self-assessment.

NKK's Five Lenses: ten questions a board can answer with a document

The question sets that exist are good but long. Deloitte lists inventory, risk appetite, accountability, committee structure and metrics ^[29]; NACD recommends integrating AI into enterprise risk management and mapping tools in use, their data access and their governance ^[30]; ICGN lists ten investor questions ^[26]; the Australian Institute of Company Directors names eight elements ^[31]. NIST GOVERN asks for an inventory of AI systems and for executive leadership to take responsibility for AI risk decisions ^[20]. We compress this into five lenses, each answered by a document rather than an opinion. The documents are an inventory with owner, tier and role; a named executive and charter wording; a board-approved tolerance statement; a recurring report with outside testing; and written escalation triggers. Prior-art anchors sit in the dashboard below. Outside EU scope, read "Exposure" against local regulatory classes.

To apply it, ask management for the five documents before the next meeting and score the gaps. We map Exposure, Ownership, Appetite and Evidence to the reporting-system prong of oversight law, and Escalation, together with the board's follow-up on what Evidence shows, to the red-flag prong. That mapping is NKK's reading of commentary ^[25], not a court holding. The framework is a question set, not a control standard, it does not replace NIST, ISO/IEC 42001 or legal advice, and it is untested with real boards. The rest of this guide uses the same five lenses: the scorecard scores them and the dashboard feeds them.

From attention to assurance: a scorecard and a dashboard

The NACD figures show the gap to close: 62.33% give agenda time, 27.40% have charters and 6.16% have metrics ^[4]. The NKK scorecard asks a board what it can evidence on each lens, not what it discusses.

Use it by scoring each lens against a document and taking the lowest-scoring lens to the next agenda. It breaks when scores are self-assigned without an evidence link or averaged into one number. Cyber oversight shows where a mature topic ends up: 78% of companies in EY's Fortune 100 review assign it to the audit committee and 73% align with an external framework (the post's text says only "companies"; "Fortune 100" comes from chart headings; no sample size is given) ^[33]. The same EY work shows AI moving quickly in disclosure: 48% cite AI risk in board oversight, against 16% a year earlier ^[33].

The dashboard gives the Evidence lens something to read. No standard board AI dashboard exists in any source we opened; the one below is an NKK design, each row serves one lens, and every threshold belongs to the board.

Use it by setting each threshold before the quarter and asking management to report exceptions first. It breaks when indicators lack agreed definitions or thresholds are copied from peers.

What to do next

1. Commission an AI inventory with risk tiers and the company's role (provider or deployer) for each use. Without it, none of the other steps has a base. Owner: the CEO with the head of AI; first version before the next board meeting.
2. Name one accountable executive and one committee, and write AI into that committee's charter. Owner: the board chair; within one quarter.
3. Set risk appetite and escalation triggers in writing, then rehearse one incident through to the chair. Owner: the named executive, approved by the committee; within one quarter.
4. Put five metrics on the agenda, one per lens: inventory coverage, receipt of the quarterly report by the committee, spend and exceptions against appetite, high-risk uses with named overseers, and incidents and time to notify. Owner: the named executive; from the first meeting after the inventory exists.
5. Plan for 2 December 2026 and 2 December 2027: the new prohibitions and the Article 50 duties that fit the company's role (marking for providers, deepfake and text disclosure for deployers) first, deployer duties for Annex III uses next, with the draft classification guidelines and the Official Journal citation of EN 18286 tracked. Owner: general counsel with the named executive; plan before the end of the year.
6. Document reliance on advisors, including who advised, on what, and what the board did with the advice. Owner: general counsel; start now.

Conclusion

The Omnibus moved dates; it did not move the question. Boards that use the reprieve to build an inventory, assign ownership, write down appetite and see a few numbers will be able to show what they knew and what they did. Boards that treat the delay as a pass may arrive at December 2027 with the same agenda time and no evidence. The evidence base is still thin, and some of it is self-reported; the case for acting now rests on the low cost of the documents relative to being unable to show what the board did, not on proof that they prevent harm.