AI board report template: quarterly management briefing on the EU AI Act and GDPR

Who is this template for?

• Executive, board of directors or supervisory boardTakes the decisions requested (chapter 3) and accepts residual risks (chapter 4); as controller, the organisation must be able to demonstrate compliance with the GDPR (Article 5(2) and Article 24(1) GDPR)
• AI governance owner or compliance officerPrepares the report from the AI register and records the role for each application: provider or deployer (Article 3(3) and (4) and Article 25(1) AI Act)
• Data protection officer (DPO)Reports directly to the highest management level (Article 38(3) GDPR) and advises on the DPIA (Article 35(2) GDPR); this report supplements that reporting
• HR and employee representativesMeasures for AI literacy (Article 4), informing workers about high-risk AI in the workplace (Article 26(7), from 2 December 2027) and any national rights of the works council, such as consent in the Netherlands (Article 27(1) WOR)
• Procurement and contract managementData processing agreements (Article 28(3) GDPR) and the information you need from suppliers for Article 26 and Article 50

What is inside

How to use the template

1. Record the counting rules in section 1.1 once, and collect the figures at the reference date from the AI register, the breach register, the incident overview, the DPIAs and the contracts.
2. Fill in the dashboard and give each line a status; for amber and red, state the action, the owner and the date.
3. Update the legal dates in chapter 2 and indicate for each date whether it applies to your organisation; add the national implementing rules of your Member State.
4. Formulate no more than three decisions with options and a recommendation, and update the risk acceptance log.
5. Send the report a few working days before the meeting and afterwards record the decisions with the date of the minutes.

Common mistakes

• Reading green as ‘meets the law’. Green only means the organisation is on schedule according to its own plan.
• Accepting a legal obligation as a risk. A prohibited practice (Article 5), a missing Article 50 disclosure, continuing where Article 26(5) requires suspension, or not notifying a notifiable personal data breach cannot be accepted by the board.
• Counting differently every quarter, for example per licence instead of per application. Quarters then cannot be compared, and AI features that suppliers switch on through an update go unnoticed.
• Reporting Article 50 as a future obligation. It has applied since 2 August 2026; only the machine-readable marking in paragraph 2 has a transitional period until 2 December 2026, for systems placed on the market before 2 August 2026.
• Requiring a fundamental rights impact assessment for every high-risk application. From 2 December 2027, Article 27 only covers the deployers listed in Article 27(1), such as bodies governed by public law and deployers that assess creditworthiness.

Frequently asked questions