All courses / AI Leader / Module 3 / Chapter 13
Learning objectives
After the lesson the participant can:
- Identify the duties that DORA Article 5, NIS 2 Article 20 and Solvency II Articles 41 and 42 place on the management body, as organisational implications.
- Explain which decisions a board cannot delegate to a committee, an executive, a system or a supplier.
- Specify a board AI report with provenance, age, dissent, independent sources and a stop path.
- Distinguish evidence of board competence from a record of attendance.
Key concepts
- What a board cannot delegate
- Decisions that law assigns to the body, such as approving risk-management measures or setting the ICT risk tolerance, and the decision on its own assistant's mandate, budget, oversight and stop path. An assistant may prepare the paper; Level 4 is never used for the decision.
- Strategy, appetite and oversight
- The three things a board does with AI that no other body does. It does not review use cases; it reviews the tier policy and the exceptions the policy routes to it. A board that reads every use case becomes a bottleneck without becoming better informed.
- Provenance, age and dissent
- The three mandatory fields on every claim that reaches a decision: where the claim comes from, who prepared and checked it and at which level; the date of its data; and the dissent, which the assistant may extract when written but may not write.
- Independent sources for a board
- Sources that do not pass through the assistant: the internal audit extract, a sample check by the second line, direct access for the audit and risk committee to the heads of control functions, and a standing right to ask any owner a question.
- Competence by what members can do
- A training register shows that sessions took place. Competence is evidenced by what members can do, tested against the organisation's own inventory and packs, for example in a seeded-error test, and recorded with an expiry.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Sort
What the board's assistant may and may not do
Sort each action by what the board AI report BRD-HM-001 says about the board-pack assistant at Hansa Mutual.
Interactive exercise 2 · Match
Instruments and what they ask of the top
Match each instrument or text to what the chapter reports it says about the people at the top.
Teaching plan
| 20 min | Lecture on the four instruments that place duties at the top, the EIOPA Opinion of 6 August 2025 on AI governance, and the Swedish Local Government Act as the illustration for a council. |
| 15 min | The teacher presents the evidence on machine-prepared summaries and derives the three mandatory fields; participants check one page of a real or sample pack for provenance, age and dissent. |
| 10 min | Role play: one participant is a supervisor asking the book's questions to a board; two answer as chair and chief risk officer of Hansa Mutual. |
| 35 min | Exercise: specify a board AI report modelled on BRD-HM-001. |
| 10 min | Quiz and discussion of how the tests Name, Explain and Reach apply to a body that decides collectively. |
Discussion
- The phrase 'the board decided' loses the person. How does your board record who proposed, who dissented and who is the named rapporteur for an AI decision?
- EIOPA's Opinion allows undertakings to outsource oversight functions but not the responsibility. What would a supervisor look for to see that the responsibility stayed with the body?
- What did your board or council see in the last quarter that did not come through management's own summary, and who chose it?
Written exercise
Exercise · 35 minutes
Specify a board AI report
Using BRD-HM-001 as the model, specify the AI report for a board, council committee or audit committee you know, or for Nordvik Region's executive committee after AIDR-1013. State the owner, the secretary of record and the cycle; what the assistant may do and may not do, including that it does not write dissent, set the agenda, release the pack or change its own mandate; the fields each claim carries, namely provenance, age and dissent; the independent sources and who signs the list; who holds the stop path for the assistant and how the pack is produced without it; how members' competence is tested and recorded; and the review date.
Deliverable: A board AI report specification of one to two pages with may and may-not lists, claim fields, independent sources, stop path and review date.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
Which three fields does the chapter make mandatory on every claim in a board pack that reaches a decision?
Show the answer
A. Provenance, age and dissent
The chapter's own conclusion from the evidence on summaries and reliance: a claim must show where it comes from and who checked it, how old its data is and what dissent the source carried.Why does DORA Article 5 reach AI although it does not mention AI?
Show the answer
C. Because an AI system is an ICT asset and, in most cases, a third-party service
The management body defines, approves, oversees and is responsible for the ICT risk-management arrangements, including the policy on third-party ICT services. AI systems fall under those arrangements as ICT assets and services.What did Nordvik Region's executive committee adopt as AIDR-1013 after the briefing incident?
Show the answer
D. A rule that each summarised paper carries a link to the passage, the checker's name and the date of decision figures
The rule applies the part of the board AI report that fits a public body at Level 1: link to the passage summarised, the named person who checked it against the source, and the date of the data behind a decision figure.