Choosing who briefs your board on the EU AI Act is itself a governance decision, and getting it wrong carries its own risk. Pick the wrong person and you will be given a great deal of depth in whichever part of the Act happens to be their speciality, because that is their strongest point, and far too little on the areas that actually expose you. You walk away over-prepared in one corner and legally and financially exposed everywhere else. What a board needs is balanced advice from someone with genuine depth across all of it. The timing matters too: the Norwegian government now expects to put a proposition for a KI-lov to the Storting in spring 2027 rather than this year, so a briefing built purely on an imminent deadline is already out of date.
The person you are actually looking for
The right person is someone who has rolled up their sleeves and actually implemented AI. Not studied it. Implemented it, and along the way failed, underestimated it, corrected the strategy, and rebuilt on a real understanding of what AI can and cannot do.
That history is precisely what makes their advice worth having. When they tell you what will work for your company, they are drawing on what they have seen work and fail in practice, weighed against your scale, your people, what you have already tried, and your organisation’s ability to ask the right questions. That kind of judgement is only earned on the other side of getting it wrong.
Why the obvious choices are each incomplete
A lawyer knows the text of the Act but has usually never deployed AI or sat in the room as an operator, so the advice is accurate and unusable. A management consultant has the presentation but not the lived practice. An internal IT leader knows your systems but not the governance, and not what personal liability now means for each director. Each is strong in one area, which is exactly the trap: strength in one area, on this subject, is a liability. That gap is common, not rare: 74% of organisations have no designated internal owner or governance body for AI compliance at all, according to Vision Compliance’s 2026 EU AI Act Readiness Analysis, based on assessments across eight industries.
There is a tell that only an experienced practitioner will catch. Sometimes the way a company frames an internal AI question quietly reveals how unprepared it actually is. Recognising that, and gently correcting it, comes only from someone who has made the mistakes themselves and matured into knowing the right way to work with AI.
They must hold the legal side too, properly
The same person, or their pairing, has to understand the legal risks of getting this wrong and every criterion around AI training, because this is where boards are quietly failing. Compliance here is not a spreadsheet showing each employee sat through fifteen hours of training. That moves nothing.
Real AI literacy is individual. It is about understanding what drives each person and, increasingly, having AI build a training path suited to that individual, then documenting it. Most companies buy a single two-hour session from an external provider, run an entire group through it, tick the box, and get no return for the cost. Training that ignores the person changes nothing about how they actually work. An adviser who has lived this will tell you so.
What a board should expect from the briefing
Not a lecture on regulation. A board should leave knowing what it is now personally accountable for and what to do about it. The right person gives you the full and honest picture across every dimension that matters: legal, governance, policy, strategy, liability, implementation, education and culture. The briefing that only covers the law, and leaves you with nothing to do, has failed you.
That combination, deep practical experience across all of it rather than mastery of one slice, is a rare talent. Find that person and you have found a genuinely valuable future for your company with AI.
Frequently asked questions
Who should brief a board on the EU AI Act?
Someone who has actually implemented AI and understands its practical limits, paired with genuine legal grounding in the Act. A pure lawyer knows the text but not the practice, a consultant has slides but not lived experience, and internal IT knows the systems but not the board-level liability. The Act touches legal, governance, strategy and culture at once, so narrow expertise leaves a board exposed.
Why not just use our law firm for the EU AI Act?
A law firm can explain what the Act says, but rarely what to do, because that requires having deployed AI in practice. The risk in using a single-speciality adviser is over-weighting their strongest area and under-covering the rest, which is where liability actually sits.
What should a board expect from an EU AI Act briefing?
Not a lecture on the regulation, but a clear account of what the board is personally accountable for and the concrete actions to take. It should span legal, governance, policy, strategy, liability, implementation, education and culture rather than a single dimension.
Does AI literacy training have to be documented for the EU AI Act?
Yes, but hours logged are not the point. Effective, compliant training is individual: understanding what each person needs, increasingly using AI to shape a path for them, and documenting it. A single group session run for cost-efficiency satisfies nobody and changes nothing.
For more on this, see Strategic AI Advisor and the EU AI Act, part of the Strategic AI Advisor guide.
Thomas Anglero is a Strategic AI Advisor, keynote speaker and author of Intro to Artificial Intelligence. He has delivered over 450 keynotes across 30 countries for organisations including IBM, the WHO, the World Government Summit and the European Commission. He founded the IBM Watson AI Lab for Cancer at the Oslo Cancer Cluster and closed over $500 million in enterprise transformation deals as CTO and Chief Innovation Officer at Cognizant.
If you are leading your organisation through this, I work with a limited number of senior leaders each quarter. Get in touch at Anglero.com.