AI your board, procurement and data protection can sign off

A large organisation has the people and the budget for this work, and still it stalls. Each department holds one piece and no one holds the whole. Procurement has the contracts. The data office has a list of models. Security knows the settings, and the data protection officer knows which decisions touch people. Pedro Machado of the Supervisory Board of the European Central Bank described the ownership of artificial intelligence at banks in February 2026 as fragmented across information technology, data science, business lines and control functions. A law firm with many practice groups shows the same pattern in smaller rooms, each group with tools it chose and will defend. At a Dutch employer the works council must consent, under Article 27 of the Wet op de ondernemingsraden, the Dutch works councils act, to arrangements on staff appraisal and on facilities suited to observing behaviour or performance, and that consent can take longer than the purchase.

The usual finding is two registers that do not join. Since 17 January 2025 the Digital Operational Resilience Act has required every financial entity to keep a register of information on all its contracts for information and communication technology services. The data office keeps a second list, the inventory of artificial intelligence applications. Different departments built them for different rules. Laid side by side at a large bank, the register shows a cloud tenancy, a document processing vendor, a customer service platform and a coding assistant as four unrelated suppliers, and the inventory shows that all four reach the same small group of model makers. That is concentration risk, which Article 29 of the Act tells the bank to assess before it contracts for a critical or important function. De Nederlandsche Bank, the Dutch central bank and prudential supervisor, reports that many banks have not completed implementation in full and that the quality of the register has to rise. The same holds outside finance. The Algemene Rekenkamer, the Dutch court of audit, found in 2024 that only a small share of the artificial intelligence systems at central government stood in the public register. Expect the first joined list to be wrong.

Each party at the table needs something different on paper. The board needs a short file: the joined list, the decision per type of work on which route the data may take (an online interface under contract, a private deployment or the organisation's own premises), and the name of the one executive who owns both. Under Article 5 of the Digital Operational Resilience Act the management body bears the ultimate responsibility for technology risk, so directors have to be able to read what they approve. Procurement needs a supplier file for each supplier: where the data is processed, which subcontractors sit behind the product down to the model maker, what is retained, and which rights of audit the contract gives. Technology needs the route decision in writing and the task of checking it against the real configuration. Microsoft's documentation of 18 May 2026 states that a sample of prompts in a private cloud deployment may by default be stored for abuse monitoring and reviewed by the provider's staff unless an exemption was applied for, and that a deployment labelled Global may process in any geography. The data protection officer needs, for each system, the point at which a person reviews the outcome. Article 22 of the General Data Protection Regulation gives people the right not to be subject to a decision based solely on automated processing, and on 21 August 2026 the Autoriteit Persoonsgegevens, the Dutch data protection authority, fined Uber 824,990,000 euros because software deactivated drivers' accounts without human review. Uber has announced an objection, so that fine is not final.

The exposure of a large organisation is a percentage of worldwide turnover. Article 99 of the Artificial Intelligence Act sets a ceiling of 15,000,000 euros or 3 percent of total worldwide annual turnover, whichever is higher, for breaches of a list of duties, and of 35,000,000 euros or 7 percent for a prohibited practice. Those amounts are maximums. The obligations for high risk systems behind the first ceiling apply from 2 December 2027 for the uses in Annex III and from 2 August 2028 for regulated products. From those dates Article 25 also turns an organisation into the provider of a high risk system when it puts its own name on one, modifies it substantially or changes its intended purpose. A model on the organisation's own premises changes where the data goes. It does not make the organisation compliant, and the same governance sits over all three routes.

By next month the accountable board member should have four things in hand. One joined list in which every application is matched to its contract and to the model maker at the end of the chain. A route decision per type of work, with the reasons written out. A supplier file for the suppliers behind the most critical functions. And the name of the executive who owns the list. The AI Guys offers a free briefing as a first step: you answer five questions and receive one signed page within two working days that says what each of the board, procurement, technology and the data protection officer should receive.