For years there was just one rule for generative AI: there were no rules. Companies experimented freely, tools sprang up everywhere and nobody asked the hard questions. That era is over. With the phased rollout of the European AI Act and regulators baring their teeth, responsibility is shifting firmly to the boardroom.
From freedom to accountability
The core of the new legislation is risk-based: the more impactful an AI application, the heavier the requirements. Systems that assess people — in hiring, lending or fraud detection — fall into the highest category, with obligations around transparency, documentation, human oversight and data quality. Unacceptable applications are simply banned.
The problem for many organisations: they don't even know which AI is being used inside their walls. Employees connect random tools to company data, marketing runs on an AI suite, customer service is testing a chatbot. Without oversight there is no control — and without control, no compliance.
What the boardroom must arrange now
- Inventory all AI use — including the 'shadow AI' that crept in outside of IT.
- Establish governance and policy — who may do what, with which data, and who is accountable.
- Classify by risk — map which obligations apply per application.
- Safeguard data and privacy — AI and GDPR are inseparable; data leaks via AI are a real risk.
- Assign responsibility — make AI a standing item at board level.
SMEs are not exempt either
Don't assume this only applies to big tech. Anyone who buys AI tools or sits in a supply chain as a supplier will have the requirements passed down — just as NIS2 does with cybersecurity. Clients will demand demonstrable control. The organisations that get their AI house in order now will be ahead; those who wait will be chasing the facts.
The government is awake. The question is whether your boardroom is too.
Read also
Klaar om zorgeloos te draaien?
Plan een vrijblijvende kennismaking. We brengen uw IT en security in kaart en laten zien waar het verschil zit.
Plan een gesprek →