Regulation as Constraint: The AI Act, DORA, NIS 2, the GDPR, Company Law and Public Law

All courses / AI Leader / Module 5 / Chapter 24

Learning objectives

After the lesson the participant can:

• Classify a legal duty by its addressee: the organisation, the management body or a named person.
• Explain how the duties of the AI Act, DORA, NIS 2 and the GDPR reach the seven decision classes and where they lower a ceiling.
• Compare how liability attaches to Hansa Mutual's executive board and to Nordvik Region's elected representatives and officials in the chapter's illustration.
• Draft rows of a duty register with instrument and article, duty, addressee, holder, artefact and evidence age.

Key concepts

An article becomes a duty

An article is a duty only when four things are fixed: who is addressed, what the addressee must do, what the addressee must be able to show, and by when. Leaders most often get the addressee wrong, and the kind of addressee decides who may hold the duty.

Three kinds of addressee

The organisation, as the AI Act addresses providers and deployers and the GDPR the controller; the management body, as in DORA Article 5(2) and NIS 2 Article 20(1), which cannot hand its duties to a committee or a system; and the named person, under national company law and public law.

A duty of measures

Article 4 of the AI Act, as replaced by Regulation (EU) 2026/1744, requires measures to support AI literacy and does not require a guaranteed level for any individual. Its measure is effort, not outcome, so it is the weakest hook for evidencing competence.

Adequate information

Under section 93(1) of the Aktiengesetz a board member is not in breach if acting on adequate information for the good of the company, and under 93(2) bears the burden of proof. The book's own reading, not a court holding, is that AI-prepared material enters company law here.

Duty register

A legal annex to the decision-rights register, in version control, with one row per duty and six fields: instrument and article, the duty in the words of the text, the addressee, the holder and deputy, the evidencing artefact and the age limit of that evidence. Entries are re-read against the live text.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The register for Hansa Mutual lists the jurisdictions that are not mapped. Why is it better to record what has not been read than to leave the register silent?
2. A board that decides on a pack whose provenance it cannot show carries the burden of proof with the weakest evidence. How does that argument, which the book calls an argument and not a holding, change what your board should ask of its papers?
3. For Nordvik's regional director the exposure that matters most is a finding that the chain of delegation was unclear. Where is the chain of delegation unclear in your organisation once AI takes part?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. According to the chapter, which of the four things that turn an article into a duty do leaders get wrong most often?

   1. The date by which the duty applies
   2. The addressee of the duty
   3. The evidence that must be shown
   4. The act that must be performed
   Show the answer

   B. The addressee of the duty
   The instruments address three kinds of addressee, and the kind decides who may hold the duty. A duty addressed to the management body cannot be handed to a committee or a system.

2. Why does NIS 2 not govern Hansa Mutual's EU financial entities, in the chapter's reading?

   1. Because insurers have fewer than 50 employees per establishment
   2. Because the supervisory board has chosen to apply the Solvency II system of governance in its place
   3. Because the AI Act replaces NIS 2 for deployers of high-risk systems
   4. Because a sector-specific act of at least equivalent effect displaces NIS 2, and DORA is that act
   Show the answer

   D. Because a sector-specific act of at least equivalent effect displaces NIS 2, and DORA is that act
   NIS 2 Article 4(1) gives way to an equivalent sector-specific act, which DORA is for financial entities. Nordvik Region, by contrast, is an essential operator under the Swedish act used as the chapter's illustration.

3. What single clause does the chapter have Nordvik's council add to a delegation order that does not mention AI?

   1. That an automated decision function could be delegated under the statute, and the council decides that none exists
   2. That all needs-based assistance decisions are delegated to an automated function
   3. That the regional director may raise any ceiling without a council decision
   4. That the supplier decides which matters the triage system may settle
   Show the answer

   A. That an automated decision function could be delegated under the statute, and the council decides that none exists
   The Local Government Act would allow delegation to an automated decision function in some matters. Stating that none exists removes the ambiguity of a delegation order that is silent on AI.