9 min read

At the latest financial report press conference of a DAX-listed company, one person with an explicit AI mandate sat on the board of directors. Of the remaining thirteen, none did. This is not a statistic; it is a governance reality. Those discussing NIS2 liability, EU AI Act, and supply chain resilience in May 2026 are addressing topics that are rarely addressed with accountability in boardrooms.

Key Takeaways

• Tech mandate in the boardroom is not a nice-to-have in 2026: NIS2 business leadership liability, EU AI Act with a sanctions framework from February 2026, and the ongoing CSRD data pipeline will bind supervisory bodies to technical details for which many boards are not staffed.
• Skill gap is measurable, not felt: In a DSW analysis of DAX and MDAX supervisory boards, fewer than one in five members reported being able to make responsible decisions on AI-related risks without external consultation.
• Audit and risk committees bear the primary responsibility: Those granting tech mandates without structurally equipping the audit committee with tech expertise are shifting the risk to a body that cannot verify it. The result is decision templates that the management and board formally approve without independent validation.

RelatedAI in the Board: Who Decides, Who is Liable?  /  SaaS Portfolios Need an Exit Strategy

What Has Shifted

Ten years ago, the common argument against a tech mandate in the boardroom was that operational topics belonged in management and the board should focus on strategy, finance, and personnel issues. This argument has lost its validity. The regulatory landscape has pulled the board into technical responsibilities, whether it wanted to or not.

Three shifts are responsible for this. First: NIS2 makes the management personally liable for cybersecurity failures, compelling the board to monitor these obligations. Second: The EU AI Act requires risk management, data governance, and conformity assessments for high-risk systems, which the board cannot delegate as a supervisory body without incurring its own duty of care. Third: CSRD reporting mandates boards to conduct data quality checks that cannot be conducted seriously without IT understanding.

Those experiencing three structural shifts simultaneously and not reacting in the board’s personnel planning will have a gap that will be noted in auditors’ reports in the coming quarters.

What a Tech Mandate Looks Like

A tech mandate is not an additional board position with a vague job description. It is a responsibility embedded in the company’s bylaws, encompassing at least four key elements.

In particular, the escalation mandate is the uncomfortable part. It establishes a direct line between the tech leadership and the board, which has historically not been desired in many companies because it bypasses the traditional reporting hierarchy. Nevertheless, it is the only way to meet NIS2 compliance requirements by 2026.

The Missing Profiles

The honest observation from the exploratory discussions that executive search consultants have led in the past quarters for board appointments: While classic CIO profiles are available, they often do not align with the required skill set. What is sought is a blend of operational tech responsibility, regulatory experience, and the ability to argue effectively in a board setting without relying on PowerPoint presentations.

It is notable that most of these profiles are underrepresented in executive search pools. They are not uncommon in absolute numbers but rarely come forward on their own and must be actively pursued. This prolongs the appointment process and drives the initial search towards external consulting mandates, which may be a transitional solution but is costly as a long-term strategy.

What Should Be in Your Perception Calendar

Those who do not adopt the bylaws adjustment in Month 3 or 4 will delay the entire process by at least one Supervisory Board cycle. Bylaw changes are rare decisions that are not easily postponed.

Liability Shadows and Silent Risks

An observation that frequently arises in Board Coaching sessions. Board members inquire about D&O insurance, liability exclusion clauses, personal risks. What they ask less about is how insurance can respond in a KI incident if the Board members have formally rejected a proposal whose technical substance they could not evaluate.

D&O contracts in most recent versions contain clauses for due diligence. Those who fulfill the due diligence through external consulting are protected, provided the consulting is documented and the Board can demonstrate having been informed. Those who delegate the due diligence exclusively to the management without their own evaluation capabilities have a blind spot in their insurance coverage.

This exact blind spot is covered by a Tech-Mandate. It is not just a matter of governance hygiene but also of insuring the Board members themselves.

What Looks Different After 12 Months

In the few corporate structures where a Tech-Mandate has been institutionalized for 18 months or longer, three operationally measurable changes become apparent. First: Templates for IT and AI investments are reviewed earlier. The percentage of templates that are initially rejected by the Board decreases significantly, as the management already incorporates the Tech-Mandate perspective.

Second: The response time to cybersecurity incidents that need to be reported to the Board shortens from weeks to days. The escalation channel functions once it has been used.

Third: In the Auditor’s report on governance evaluation, references to IT incompetence in the Board disappear. This is not a cosmetic effect. Board evaluations in Auditor’s appendices are increasingly read by institutional investors as a reputational signal.

Frequently Asked Questions