Where should your organisation use AI, and where should it hold back?
Boards approve AI budgets and answer for AI risk, often on the strength of vendor decks and survey headlines. S&P Global reported in March 2025 that 42% of companies had abandoned most of their AI initiatives, up from 17% a year earlier. In July 2024 Gartner predicted that at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, citing poor data quality, inadequate risk controls, rising costs and unclear business value. The rules have moved too: AI Act Article 50 has applied since 2 August 2026, and the Dutch Cyberbeveiligingswet since 15 August 2026.
This course gives directors a method to decide where AI adds value, where it adds exposure, and which decisions belong to the board. The morning teaches the method, the early afternoon the sector rules, and the last block applies both to your own organisation’s case.
After this course
- Can you name where AI creates value and where it creates exposure in your organisation, use case by use case?
- Can you test a vendor or survey claim by its sample, method, date and definition of success?
- Can you choose AI that supports people first, and set the evidence needed before it may act alone?
- Can you apply MAR, DORA and NIS2 duties to the AI tools your organisation uses or plans to buy?
- Can you place your AI plans on the AI Act timeline: Article 4, Article 50 and the 2027 high-risk date?
- Can you write a one-page AI position and a decision list with owners and dates?
Skills you practise
- Value and exposure assessment
- Claim testing
- Sector rules for AI tools
- AI Act timeline
- Board questions
- Decision lists
- Change leadership
Course structure
The course is 1 day of 6 teaching hours, in 2 blocks of 3 hours with a lunch break. Online, it runs as 2 live sessions of 3 hours on the same day, not recorded.
The morning covers value, exposure and claims. Participants build a value and exposure table for their organisation’s AI use cases. They then test vendor and survey claims by sample, method, date and definition of success. One worked example is the 2025 MIT NANDA report on returns from generative AI, which rests on 52 interviews and 153 survey responses and calls its own findings preliminary; critics say its headline oversimplifies. The morning ends with autonomy: for each use case, whether AI suggests, drafts or acts, and what evidence would justify a higher level.
The afternoon starts with the rules. MAR Articles 7 and 10 define inside information and unlawful disclosure. Whether typing inside information into an AI tool counts as disclosure has not been tested by regulators or courts. ESMA’s May 2024 statement on AI in investment services expects firms to control staff use of AI tools. DORA has applied since 17 January 2025, and a contracted SaaS AI tool used by a financial entity belongs in its register of information. NIS2 Article 21(2)(d) covers supply chain security and Article 20 covers board oversight and training, with the Dutch Cyberbeveiligingswet as the worked example. The AI Act timeline follows: Article 4 since 2 February 2025, Article 50 since 2 August 2026, and Annex III high-risk rules from 2 December 2027.
The last 75 minutes are the case: the board works on its own organisation, online or at your office. The day ends with the one-page AI position, the decision list and a short note for staff.
More than half the time is hands-on work on your own material.
1Where AI creates value and where it creates exposure60 min
- Value cases from your own processes
- Exposure from data, contracts and customer-facing tools
- Who answers for what an AI tool tells a customer
- One table with both sides
Value and exposure differ from one use case to the next, even inside one department. One verdict on AI as a whole hides both, so the table has a row per use case.
Caution. In February 2024 a Canadian tribunal held Air Canada liable for its website chatbot's wrong advice on a bereavement fare. What an AI tool tells a customer counts as the company's word.
You leave with: A value and exposure table for the organisation's current and planned AI use cases.
2Reading vendor and survey claims45 min
- Sample, method, date and definition of success
- Predictions and measured results
- Preliminary studies and how they get quoted
- Questions to send back to the vendor
A model can give a confident answer that is wrong, so any number it produces needs a source check. Apply the same check to numbers in vendor decks and surveys.
Caution. The 2025 MIT NANDA report behind the widely quoted 95% figure on zero returns rests on 52 interviews and 153 survey responses and calls its own findings preliminary.
You leave with: A claim-testing checklist and 3 questions for the vendor behind the organisation's largest AI proposal.
3When AI may act without a person45 min
- Tools that support a person and agents that act
- The autonomy level per use case
- Conditions for raising autonomy
- Customer-facing AI and hard limits
Start where AI supports a person who stays accountable, and let an AI act on its own only where evidence shows the checks hold. Write down that evidence for each step up.
Caution. In December 2023 a car dealer's ChatGPT-powered chatbot was talked into 'agreeing' to sell a 2024 Tahoe for USD 1, so customer-facing AI needs hard limits on what it may promise.
You leave with: An autonomy level and the conditions for raising it, for each use case in the value and exposure table.
4Listed and financial entities: MAR and DORA60 min
- Inside information under MAR Articles 7 and 10
- AI tools and unlawful disclosure: an untested point
- ESMA's May 2024 statement on AI in investment services
- DORA's register of information
- SaaS AI tools as ICT third-party services
Instructions hidden in a document or an email can make a model leak data it has access to. Record any supplier's AI tool with access to inside information or client data as a third-party risk.
Caution. No AFM or ESMA statement, including the AFM's April 2026 report on AI in capital markets, addresses staff typing inside information into AI tools, so treat it as a material, untested risk under MAR Article 10.
You leave with: Where the rules apply: a list of AI tools to add to the DORA register and MAR questions for legal counsel.
5NIS2, the Cyberbeveiligingswet and board duties45 min
- NIS2 Article 21(2)(d): supply chain security
- AI vendors as direct suppliers
- Article 20: board approval, oversight and training
- The Dutch Cyberbeveiligingswet, in force since 15 August 2026
A buyer can rarely check in detail what a model was trained on, or how. The supplier's choices therefore belong in your supply chain risk, next to its security and its contract.
Caution. NIS2 Article 20(2) requires members of management bodies to follow training, and the Dutch Cyberbeveiligingswet has applied that duty since 15 August 2026.
You leave with: 6 board questions on AI suppliers, each linked to the document that answers it.
6The AI Act timeline for decision-makers30 min
- Prohibited practices since 2 February 2025
- Article 4 AI literacy, as amended in July 2026
- Article 50 disclosure duties from 2 August 2026
- Annex III high-risk rules from 2 December 2027
A model knows nothing after its training date unless it can search. Ask it which dates it is sure of, and check every legal date against the official text.
Caution. Article 50 breaches can be fined up to €15 million or 3% of turnover, with a lower cap for SMEs, while Article 4 penalties depend on national rules.
You leave with: The AI Act dates for each use case, with the role the organisation plays in each.
7Your AI position and decision list75 min
- The case: your own organisation's plans
- Drafting the one-page AI position
- Decisions with owners, dates and evidence
- What staff hear and when
Once the board approves a paper drafted with AI, every statement in it is the board's. Check each figure and statement against your own documents before the paper is circulated.
Caution. In May 2025 Klarna's chief executive said its AI cost-cutting push in customer service had gone too far. Put a quality measure next to every cost decision on the list.
You leave with: The one-page AI position, a decision list with owners and dates, and a short note for staff.
Where AI creates value and where it creates exposure
Ask for value and exposure in the same table, per use case.
What are the benefits of AI for our company?
For the 5 AI use cases below, build a table with 2 sides. Value: which process, what changes, how we would measure it. Exposure: which data the tool sees, who could be harmed, which contract or rule applies, what happens if the output is wrong. Use only the facts I give and write 'unknown' where a fact is missing. [use cases]
Reading vendor and survey claims
Ask for sample, method, date and success definition before accepting a number.
Is this vendor's claim about AI savings true?
Below is a claim from a vendor proposal and the page it comes from. List who was measured, how many, when, how success was defined, and who paid for the study. Mark each item 'stated' or 'not stated'. Search for the original study and give its link if you find it. Then write 3 questions for the vendor, each under 25 words. [claim and page]
When AI may act without a person
Ask what must be true before the AI may act without a person.
Should we let AI agents handle customer refunds?
For the refund process described below, propose 3 autonomy levels: AI suggests and a person decides; AI drafts and a person approves; AI acts and a person samples. For each level, list the conditions to meet first (error rate, value limit, audit trail), who signs off, and how we roll back. Table format, under 250 words. [process description]
Listed and financial entities: MAR and DORA
Paste the rule text and ask which process steps it covers.
Is it legal for our staff to use AI?
Below are MAR Article 7(1) and Article 10(1), and a description of how our investor relations team uses an AI assistant. List each step where inside information could enter the tool. For each step, say whether the article text clearly covers it, possibly covers it, or is silent, and quote the words you rely on. End with 3 questions for our legal counsel. [article text] [process description]
NIS2, the Cyberbeveiligingswet and board duties
Ask for board questions that a named document can answer.
What should the board know about NIS2 and AI?
Our organisation is an important entity under NIS2. Using Article 20 and Article 21(2)(d) quoted below and the list of our 4 AI suppliers, write 6 questions the board can put to management. Each question names the document that would answer it, such as a contract clause, a supplier assessment or a training record. Under 20 words per question. [article text] [supplier list]
The AI Act timeline for decision-makers
Ask for each date with its legal source, then check each one yourself.
When does the AI Act apply to us?
List the AI Act dates that apply to the 5 use cases below. For each date give the article, what applies, and whether we act as provider or deployer. Search the official AI Act Service Desk and EUR-Lex pages and link each date to its source. Where you cannot find a source, write 'check'. [use cases]
Your AI position and decision list
Ask for one page with fixed sections and a word limit.
Write our AI strategy.
Draft a one-page AI position for our board from the inputs below. Sections in this order: where we use AI now, where we will and will not use it in the next 12 months, the rules that apply to us, the 3 largest exposures and their owners, decisions needed. Under 450 words. Use only the inputs and mark any gap as 'to confirm'. [value table] [claim checks] [rules notes] [decision list]
The board leaves with a one-page AI position. It shows where AI is used now, where it will and will not be used in the next 12 months, the rules that apply, and the largest exposures with their owners. A decision list with owners and dates goes with it.
In the week after the course, the policy owner puts the decision list on the next board agenda, and management receives the board questions from the afternoon. Each participant receives an attendance record for your AI literacy file.
- Teaching time
- 6 hours on 1 day, in 2 blocks of 3 hours with a lunch break.
- Before the day
- AI Literacy and the AI Act, or a working knowledge of the AI Act's main duties; participants bring their organisation's current AI plans or proposals.
- After the day
- A one-page AI position for the board and a decision list with owners and dates.
Completion
You complete the course by working through each exercise on your own tasks. There is no exam and no grade. Each participant receives an attendance record for your AI literacy file (not a certificate).
Who is this course for?
Directors, board members and the policy owners who prepare their decisions. In the Board path, this course is step 2 of 2. It follows AI Literacy and the AI Act, which the board books as a private day.
The sector modules apply most to listed companies under MAR, financial entities under DORA, and essential and important entities under NIS2. Directors from other organisations spend that time on the AI Act and their own case.
Choose Leading AI Adoption: Governance, Policy and Culture if you need the AI use policy and approved tool list written. Choose AI Playbook Workshop if a cross-functional team should build and test use cases.
- Level
- Advanced
- Before you start
- AI Literacy and the AI Act, or a working knowledge of the AI Act's main duties; participants bring their organisation's current AI plans or proposals.
- Group
- 1 to 12 people, online, live or at your office
This course is right for you if you
- sit on a board or prepare its decisions
- approve AI budgets or answer for AI risk
- work in a listed company, a financial entity or an organisation under NIS2
Unsure whether it fits? Ask us. We reply within 1 working day.
Practical information
- 1 day, 6 teaching hours, with a lunch break
- Online: live in 2 sessions of 3 hours on one day, not recorded; times agreed in the intake call
- At your office: 09:30 to 16:30; you provide a room, a screen and internet access
- In English, in the AI tool your organisation has approved
- Taught live by a practitioner with more than 15 years of commercial and technical leadership in software and data companies across Europe and Asia-Pacific, including maritime, energy and fintech.
- Attendance record for your AI literacy file
- Online, live: 1 day in 2 live sessions of 3 hours, not recorded. Book it as a private day for your team of 1 to 12 people, on your own Teams, Zoom or Meet.
- At your office: 1 day (6 teaching hours) for 1 to 12 people, travel within the Netherlands included.
Dates and booking
Choose the format, an open weekday in the calendar and the number of participants, then reserve on this page.
The calendar and booking form load with JavaScript. Without it, ask us for a date on WhatsApp, by phone on +31 6 20 51 73 96 or at advisory@ai-business.school.
Investment
| Item | Online, live | At your office |
|---|---|---|
| Price | €399 per person | €2,900 for the day, for your group |
| Including 21% Dutch VAT | €482.79 per person | €3,509 |
| The training day | Included | Included |
| A 30-minute intake call on your tools and data rules | Included | Included |
| Course materials and templates | Included | Included |
| Attendance record for your AI literacy file | Included | Included |
| Travel within the Netherlands | Not needed | Included |
| Group | 1 to 12 people | 1 to 12 people |
Prices exclude VAT. Online, live, you pay per participant. At your office, one price covers your whole group, from 1 to 12 people; for a larger group, book a second day. You reserve on this page; the payment details appear when you do.
Questions
What should a board ask management about AI?
Where AI is used today, which data each tool sees, which rules apply, who decides on new uses, and what has been measured. The course turns these questions into a decision list with owners and dates.
How do MAR, DORA and NIS2 apply to AI tools?
Under MAR Article 10 (AFM guide on insider dealing), staff typing inside information into an AI tool is an untested point that regulators have not addressed. Contracted SaaS AI tools belong in a financial entity's DORA register of information. NIS2 Article 21(2)(d) requires supply chain security, which includes relationships with direct suppliers such as AI vendors.
Does this course cover the NIS2 board training duty?
It covers AI suppliers within the NIS2 supply chain duty and what Article 20 asks of boards. It does not cover the full list of cybersecurity topics that the Dutch rules set for board training.
Is the AI Act AI literacy duty still in force after the 2026 changes?
Yes. The Digital Omnibus, in force since 27 July 2026, keeps a duty on providers and deployers to take measures to support AI literacy, without requiring a guaranteed level for each person. The AI Act does not require a certificate; each participant gets an attendance record for your AI literacy file.
Can we use our own AI plans as the case?
Yes. The last block uses your organisation's own plans, online or at your office. Bring them at the level you would share with an outside adviser; our general terms (6.4) keep them confidential.
How does this course fit with AI Literacy and the AI Act?
Together they form the Board path. AI Literacy and the AI Act, booked as a private day for the board, comes first, and this course follows 2 to 6 weeks later.
Last reviewed 21 October 2026.
Related courses
AI Literacy and the AI Act
Explain what the EU AI Act asks of your organisation and keep the records for your AI literacy file.
€399 per person online · €2,900 a day at your office, up to 15 people
Leading AI Adoption: Governance, Policy and Culture
Draft your AI use policy and approved tool list on your own data, and set who decides on new AI tools and uses.
€399 per person online · €2,900 a day at your office, up to 12 people
AI for PR, Communications and Investor Relations
Use AI for research, drafting and monitoring in PR and IR, with labelling, disclosure and approvals in place.
€399 per person online · €2,900 a day at your office, up to 15 people