Tech Mandates on the Supervisory Board: NIS2, the EU AI Act, and the Skills Gap

20.05.2026

9 min read

At the latest results press conference of one DAX group, a person with an explicit AI mandate sat on the supervisory board. At thirteen others, none did. This is the governance reality. Anyone talking about NIS2 liability, the EU AI Act and supply chain resilience in May 2026 is talking about topics that currently rarely have a responsible seat on the supervisory board.

The essentials at a glance

A tech mandate on the supervisory board is a must-have in 2026: NIS2 management liability, the EU AI Act with its sanction framework from February 2026 and the ongoing CSRD data pipeline tie supervisory bodies into technical detail questions for which many boards lack the personnel setup.
The skill gap is measurably real: In a DSW analysis of DAX and MDAX supervisory boards, less than one fifth of members stated in a self-assessment that they could decide AI-related risk questions responsibly without external advice.
Audit and risk committees carry the main pressure: Anyone assigning tech mandates without structurally equipping the audit committee with tech competence pushes the risk to a place that cannot audit it. The result is draft resolutions that executive management and the supervisory board formally rubber-stamp while nobody validates the content independently.

What has shifted

Ten years ago, the usual argument against a tech mandate on the supervisory board was that operational topics belonged with executive management and that the supervisory board should concentrate on strategy, finances and personnel matters. That argument has run its course. The regulatory situation has pulled the supervisory board into technical responsibilities, whether it wanted that or not.

Three shifts carry this. First: NIS2 makes executive management personally liable for cybersecurity failures, which forces the supervisory board to monitor this duty. Second: the EU AI Act requires risk management, data governance and conformity assessments for high-risk systems that the supervisory board as a monitoring body cannot delegate without failing its own duty of care. Third: CSRD reporting forces supervisory boards to review data quality, which cannot work credibly without IT understanding.

Anyone experiencing three structural shifts at once and failing to respond in the supervisory board’s personnel planning has a gap that will find mention in auditor reports over the coming quarters.

What a tech mandate looks like in practice

A tech mandate is more than an additional supervisory board position with a vague task description. It is a responsibility anchored in the rules of procedure that comprises at least four elements.

Four elements of a robust tech mandate

Risk mandate: lead role in the risk committee for IT security, AI systems and data processing, with a duty to submit draft resolutions to the full supervisory board
Audit mandate: participation in the audit committee in reviewing the CSRD data pipeline and the internal controls for AI-supported reporting processes
Investment mandate: a statement on IT and AI investments above a threshold defined in the articles of association, with a business case review that goes beyond pure profitability
Escalation mandate: a direct reporting channel from the CISO and CIO to the tech mandate on the supervisory board, without executive management sitting in between as a filter

The escalation mandate in particular is the uncomfortable part. It creates a direct line between the tech leadership and the supervisory board that many companies historically avoided because it undermines the reporting hierarchy. In 2026 it remains the only clean way to meet NIS2 requirements on supervisory body knowledge.

The profiles that are missing now

The honest observation from the exploratory talks that executive recruiters have held over the past quarters for supervisory board appointments: classic CIO profiles are available, but they often fail to fit the requirement profile. What is being sought is a mix of operational tech responsibility, regulatory experience and the ability to argue in the boardroom without PowerPoint.

What does not hold up

Former group CIO with no experience of EU regulation
Tech investor with a fund background and no operations experience
Academic profile with an AI chair and no executive board experience
Consultant profile from the Big Four with no line responsibility of their own
Former security authority representative with no entrepreneurial role

What holds up

Former CIO or CISO with experience in regulated industries
Managing director of a tech subsidiary holding a supervisory board mandate within a group structure
CDO with their own responsibility for AI governance in an international group
Auditor with an IT audit focus and supervisory board experience
COO of a tech company with demonstrable executive board responsibility for cybersecurity

What stands out is that most of these profiles are underrepresented in recruiter pools. In absolute numbers they are reasonably common; they simply approach firms less often on their own and need to be addressed proactively. This lengthens time-to-fill and pushes initial appointments toward external advisory mandates, which make sense as a transitional solution yet become expensive as a permanent one.

What belongs on the awareness calendar

Timeline: tech mandate maturity in 12 months

Month 1-2: self-assessment of the existing supervisory board competence for AI, cybersecurity and data architecture
Month 3-4: rules of procedure adjustment, definition of the mandate areas, resolution by the full board
Month 5-7: candidate search, sounding out existing members for internal solutions, external search in parallel
Month 8-10: onboarding, setting up the escalation channel, first session papers with tech mandate responsibility
Month 11-12: first regular report to the general meeting with a tech mandate statement

Anyone who fails to take up the rules of procedure adjustment in month 3 or 4 delays the entire path by at least one supervisory board cycle. Changes to the rules of procedure are rare resolutions that cannot simply be pushed through mid-cycle.

Liability shadows and silent risks

An observation that keeps coming up in board coaching. Supervisory board members ask about D&O insurance, about exclusion clauses, about personal risks. What they ask about less often is how an insurance policy can respond in an AI incident when the supervisory body members have formally signed off on a draft resolution whose technical substance they were unable to assess.

D&O policies contain clauses on the required duty of care in most recent versions. Anyone who fills the duty of care through external advice is covered as long as the advice is documented and the supervisory board can demonstrably show it informed itself. Anyone who delegates the duty of care solely to executive management, with no assessment capacity of their own, has a blind spot in the insurance cover.

A tech mandate closes precisely this blind spot. The question therefore goes beyond governance hygiene and touches the insurance protection of the supervisory body members themselves.

What looks different after twelve months

In the few group structures where a tech mandate has been institutionalised for 18 months or longer, three changes emerge that are operationally measurable. First: draft resolutions on IT and AI investments get revised earlier. The share of papers sent back by the supervisory board on the first pass drops noticeably because executive management already factors in the tech mandate perspective.

Second: the response time to cybersecurity incidents that must inform the supervisory body shortens from weeks to days. The escalation channel works as soon as it has been used once.

Third: in the auditor report on the governance assessment, notes on missing IT competence in the supervisory board disappear. The effect goes well beyond cosmetics. Supervisory body assessments in auditor annexes are increasingly read by institutional investors as a reputation signal.

Frequently asked questions

Is a tech mandate on the supervisory board required by the articles of association?

Indirectly, yes. NIS2 and the EU AI Act require supervisory competence that is practically impossible to demonstrate without a corresponding person on the board. Anchoring the mandate in the rules of procedure is cleaner than the informal reference to external advice because it is documented in a verifiable way in the auditor annex.

Who qualifies as a tech mandate holder?

Former CIOs or CISOs from regulated industries, COOs or CDOs with their own AI governance responsibility in international groups, as well as auditors with an IT audit focus and supervisory board experience. Pure consulting profiles with no operational line responsibility cannot carry the mandate in practice.

How much effort does a tech mandate involve alongside classic supervisory board duties?

Realistically 30 to 50 percent more time than a classic mandate, especially in the first 12 months after it is set up. The extra effort comes from special sessions on incidents, from getting to know the company’s specific tech landscape and from building up the escalation channel.

What remuneration is usual for a tech mandate?

In the DAX environment the premium over a standard supervisory board mandate is 30 to 60 percent, in the MDAX 20 to 40 percent. In the Mittelstand a flat fee for special sessions is common because the main session remuneration rarely covers the extra effort.

How does D&O respond in an AI incident without a tech mandate?

With limitations. More recent D&O policies require a traceable duty of care. Anyone who signs off on tech topics with no documented assessment capacity and then experiences a major incident can end up in a situation where the insurer invokes contributory negligence. External advice with a documented protocol provides formal protection, yet costs more than an institutionalised tech mandate.