What are the most important governance questions boards should ask in 2026?

The most important governance questions boards should ask in 2026 centre on whether governance is genuinely operational across cybersecurity, AI, data privacy, and organisational accountability — not just documented. Boards that governed well in 2024 may already be falling behind, because regulatory frameworks like NIS2, the EU AI Act, and DORA have shifted expectations from periodic review to continuous governance. The questions below unpack exactly what boards need to ask — and what good answers look like. If you want to discuss your organisation’s current governance posture, feel free to get in touch with us directly.

What has changed in governance expectations for boards since 2024?

Since 2024, governance expectations for boards have shifted from oversight of compliance documentation to active accountability for operational resilience. Regulators across the EU now expect boards to demonstrate that governance is embedded in day-to-day operations, not confined to annual reviews or audit cycles. This shift applies directly to security, privacy, AI, and quality governance.

The most significant change is the move from reactive to continuous governance. NIS2 introduced direct board-level liability for cybersecurity failures. The EU AI Act created new oversight obligations for organisations deploying high-risk AI systems. DORA extended operational resilience requirements into financial sector supply chains. Taken together, these frameworks no longer accept governance as a back-office function.

For boards, this means the question is no longer “are we compliant?” but “is our governance system working right now?” That is a fundamentally different standard — one that demands structural capability rather than periodic documentation. Boards that have not updated their governance oversight model since 2023 are likely operating with a significant blind spot.

What specific questions should boards ask about cybersecurity and NIS2 compliance?

Boards should ask whether the organisation has assigned clear, named accountability for NIS2 compliance, whether incident detection and reporting processes meet the 24-hour notification requirement, and whether cybersecurity controls are tested regularly rather than assumed to be functioning. These questions test operational readiness, not just policy existence.

NIS2 is explicit that board members can be held personally liable for cybersecurity failures resulting from negligence. That means boards cannot delegate cybersecurity governance entirely to IT and consider the matter closed. The right oversight questions to ask include:

Who is accountable for our NIS2 obligations, and do they have the authority to act?
When did we last test our incident response process end-to-end?
What is our supply chain risk exposure, and how is it managed?
How are cybersecurity risks reported to the board, and how frequently?
Have we validated that our technical measures meet the requirements of Article 21?

The answers to these questions reveal whether cybersecurity governance is structural or superficial. A board that cannot get clear, evidence-based answers to these questions has a governance gap, regardless of what the policy documentation says.

How should boards oversee AI governance under the EU AI Act?

Boards should oversee AI governance under the EU AI Act by ensuring the organisation has a complete inventory of AI systems in use, has classified each system by risk level, and has assigned accountability for compliance with the applicable obligations. For organisations deploying high-risk AI systems, board-level awareness of those systems and their oversight mechanisms is now a regulatory expectation.

The EU AI Act introduces a tiered risk framework. Most organisations will have a mix of minimal-risk tools and, depending on their sector, some systems that qualify as high-risk. Boards do not need to understand the technical architecture of every AI tool — but they do need to ask the right structural questions:

Do we have a current inventory of all AI systems used across the organisation?
Have we assessed which systems fall under high-risk classifications?
Is there a named owner for AI governance compliance, and do they report to the board?
How are AI-related risks identified and escalated?
Are our AI procurement processes aligned with the Act’s requirements for deployers?

Boards should also be aware that AI governance does not sit in isolation. It intersects with data privacy, cybersecurity, and quality governance — which is precisely why organisations that manage these domains separately tend to develop blind spots. Integrated governance, where AI oversight is part of a unified system rather than a standalone workstream, is far more effective at catching cross-domain risks early.

What are the right governance questions to ask about data privacy and GDPR?

The right board-level governance questions on data privacy focus on whether data processing is lawful and documented, whether the organisation can respond to data subject rights requests within legal timeframes, and whether privacy risks are assessed before new projects or systems go live. GDPR compliance is not a one-time certification — it requires ongoing operational discipline.

Many organisations completed their initial GDPR implementation in 2018 and have not substantially reviewed their privacy governance since. In 2026, that is a significant risk. Data flows change as organisations grow, adopt new tools, and expand into new markets. Boards should ask:

Is our Record of Processing Activities current and accurate?
When did we last conduct a Data Protection Impact Assessment for a high-risk processing activity?
How are personal data breaches detected, and what is our response process?
Are our data processor agreements up to date, including with AI vendors?
Does our DPO or privacy lead have sufficient access to the board to raise concerns?

Privacy governance that has drifted since initial implementation is one of the most common vulnerabilities we see in mid-market organisations. The gap is rarely in intent — it is in the absence of a system that keeps privacy governance current as the organisation evolves.

How can boards tell if governance is working or just documented?

Boards can tell governance is genuinely working when it produces observable outcomes: incidents are detected and escalated, roles are exercised not just assigned, risks are updated as the environment changes, and governance activities happen on schedule without being driven by external deadlines. Documentation without these outcomes is governance theatre.

The clearest signal of governance drift is when everything looks fine on paper but the organisation cannot answer operational questions with evidence. If the board asks “when was our last security control test?” and the answer requires significant effort to retrieve, that is a warning sign. Functioning governance produces answers that are readily available because the processes that generate them are running continuously.

Signs governance is operational

Governance is operational when risk registers are updated regularly without being prompted by an audit, when staff in accountable roles can describe their responsibilities clearly, when incident response has been exercised in the past twelve months, and when governance reporting to the board is structured and consistent rather than ad hoc.

Signs governance is only documented

Governance is likely only documented when policies exist but have not been reviewed since implementation, when the same person holds every governance role because no one else knows what the roles require, when compliance activities spike before certification audits and go quiet afterwards, or when the board receives governance updates only when something has gone wrong.

Continuous governance, by contrast, is designed to prevent that cycle. It treats governance as a permanent operational capability rather than a project that ends when the certificate arrives. This is the model we built our services around — because the organisations that struggle most are not those that lack documentation, but those that lack the system to keep governance alive between audits.

Who should own governance accountability inside the organisation?

Governance accountability inside the organisation should sit with management, not with external advisors or a single compliance officer. Each governance domain — security, privacy, AI, quality — should have a named internal owner with the authority, resources, and mandate to act. The board’s role is to hold those owners accountable, not to absorb the accountability itself.

One of the most common governance failures in mid-market organisations is the concentration of accountability in one person, often a COO or IT manager who also holds several other roles. When that person leaves, governance continuity breaks. A resilient governance structure distributes accountability across roles, not individuals, so that the system functions regardless of personnel changes.

Boards should ask whether governance accountability is role-based or person-dependent. If the answer is person-dependent, the organisation has a structural vulnerability. The board should also verify that governance owners have a direct reporting line to the board and that governance is a standing agenda item — not something raised only when a regulator asks or an incident occurs.

Governance in 2026 is not a compliance project with a finish line. It is a permanent capability that requires structural ownership, continuous operation, and genuine board engagement. The questions in this article are a starting point for boards that want to move from oversight of documentation to oversight of outcomes. If you are ready to assess where your organisation stands and build governance that works between audits as well as during them, contact us to plan a conversation.

Frequently Asked Questions

How often should boards formally review their governance posture under NIS2, DORA, and the EU AI Act?

Under the current regulatory frameworks, annual reviews are no longer sufficient — boards should expect governance reporting on at least a quarterly basis, with continuous monitoring in place between those reviews. NIS2 and DORA in particular are built around the assumption of ongoing operational resilience, not periodic snapshots. A practical starting point is to establish a governance dashboard that gives the board real-time or near-real-time visibility into key indicators such as incident response readiness, control testing schedules, and open risk items.

What is the best way for a board to get started if governance has drifted since initial implementation?

The most effective first step is a structured gap assessment across each governance domain — cybersecurity, data privacy, AI, and quality — to establish an honest baseline of what is operational versus what is only documented. From there, boards should prioritise closing accountability gaps before updating documentation, because governance that lacks clear ownership will drift again regardless of how well the policies are written. Engaging an external advisor for this initial assessment can be valuable, but the goal should be to build internal capability, not ongoing external dependency.

What are the most common mistakes boards make when trying to improve their governance oversight?

The most common mistake is treating governance improvement as a documentation project — commissioning policy rewrites or framework updates without addressing the operational processes and accountabilities that make governance real. A closely related mistake is delegating governance entirely to a single internal role or external consultant without ensuring the board itself has meaningful visibility into outcomes. Boards that improve governance most effectively focus first on structural questions: who owns each domain, how are risks escalated, and how does the board know governance is running between audits?

How should boards handle governance accountability when key personnel change or leave the organisation?

Governance accountability should be documented at the role level, not the individual level, so that onboarding a new person into a role also transfers the governance responsibilities, reporting lines, and institutional knowledge associated with it. Boards should request a succession or continuity plan for every critical governance role as part of their oversight function. If the organisation cannot articulate what happens to privacy, security, or AI governance when a key person leaves, that is a structural vulnerability that needs to be addressed before it becomes an operational crisis.

Does integrated governance actually work in practice for smaller or mid-market organisations, or is it only realistic for large enterprises?

Integrated governance is arguably more important for mid-market organisations than for large enterprises, precisely because smaller organisations rarely have the headcount to run separate, siloed governance functions for each domain. A unified governance system — where cybersecurity, privacy, AI, and quality oversight share common processes, reporting structures, and risk frameworks — is more efficient and more effective at catching cross-domain risks than maintaining four independent workstreams. The key is proportionality: the system should be scaled to the organisation's complexity, not copied from an enterprise playbook.

What should boards do if management consistently cannot provide evidence-based answers to governance questions?

If management cannot produce clear, evidence-based answers to standard governance questions — such as when controls were last tested or whether the risk register has been updated — the board should treat this as a governance gap requiring immediate structural attention, not a one-off information request. The appropriate response is to mandate a specific remediation plan with a defined timeline, rather than accepting verbal reassurances. Boards that accept vague answers repeatedly are, in effect, allowing governance theatre to persist, which increases both regulatory and operational risk exposure for the organisation.

How does the EU AI Act's requirement for high-risk AI oversight interact with existing GDPR obligations?

The EU AI Act and GDPR overlap significantly in the context of high-risk AI systems, particularly where those systems process personal data — which is the case for the majority of AI tools deployed in HR, customer service, fraud detection, and similar functions. A Data Protection Impact Assessment (DPIA) required under GDPR and a conformity assessment required under the AI Act will often cover overlapping ground, and organisations that run these processes in isolation risk duplicating effort while still missing cross-domain risks. The most efficient approach is to integrate AI risk assessments into the existing DPIA process, ensuring that privacy and AI governance are reviewed together rather than sequentially.

Navigation