Board responsibility for cybersecurity and AI, turned into concrete decisions.
You get a clear view of the decisions you need to put to your board, and a simple way to follow up on them. Every engagement has a named senior lead who works at board and executive level and prepares each decision so the board can make the call.
The short answer
Accel Comply, founded by Behzad Motaghi, gives boards and executive teams in Denmark and the Nordics a short list of the security decisions that matter most and a way to see whether they are carried out. The list can include AI decisions. If you want, Accel Comply follows up on the decisions and reports to the board.
The decisions that belong with the board
The board doesn't need the technical detail, but a few decisions are its own. How much risk will the company live with, and where is the line? What starts first, and what should it cost? Who in the executive team owns each area? And what does the board need to see to know it's done? You get a concrete proposal for each question, so the board decides from a short list rather than a technical report, and approval becomes a decision rather than an item noted for information.
What NIS2 (the Danish NIS 2 Act) says about management responsibility
In an essential or important entity, the management body must approve the cybersecurity risk-management measures the entity takes under section 6 of the Act and oversee their implementation. That's section 7 of the Danish NIS 2 Act, which also requires the members of that body to attend relevant training on managing cybersecurity risk. Where a company has both executive management and a board of directors, the management body is the board, and where it has only executive management, it's the executive management (section 3, no. 20). Accel Comply works on the practical side: what approval and oversight should mean in your board meetings.
What oversight looks like in practice
In practice, oversight means the board can see whether what it decided is being done, without digging for it. Each decision gets an owner, a status and a note on what's in the way. Your senior lead follows up with IT and suppliers and, if you want, gives the board a short update on what is done and what has stalled.
The board can put AI on the same list
The NIS 2 Act itself doesn't mention AI, but the board may well want the same discipline once the company starts using AI. The key decisions are what AI should be used for in the business, which data must never go into it, and who in the executive team owns the area. When they sit on the same list as security, the board gets a status update on them at the same meeting, along with the evidence supplied and any reported exceptions to the limits it set itself. How AI plans are ranked is covered under AI advisory for leadership.
When the question reaches the board
The board must approve a security plan nobody on it can judge
Accel Comply goes through the plan with you and says what the board is really approving, what it costs and what it should ask to see afterwards. The board can then approve with its eyes open or ask for what's missing.
The chair asks what the board has approved, and the answer is scattered across minutes
You get the decisions pulled onto one short list with an owner and a status. Once the list is in place, the board can see what's done and what's stuck, and the chair has the answer in front of them.
What Accel Comply takes on, and what it doesn't
What Accel Comply takes on
- A short list of the security and AI decisions that belong with the board, each with an owner in the executive team
- Decision papers the board can act on, including budget and priorities
- Follow-up with IT and suppliers and, if you want one, a short status update for the board on what's done and what has stalled
- If you want one, a session with the board on what approval and oversight mean for you
What Accel Comply does not take on
- Audit and certification
- Security operations, monitoring or 24/7 incident response
- A board seat
The board and executive team make the decisions and stay accountable.
Questions about board responsibility
What does the board have to decide and oversee under NIS2?
If the company is covered, the management body must approve the cybersecurity risk-management measures and oversee their implementation (NIS 2 Act, section 7). In practice the work can be organised around risk appetite, priorities, ownership and follow-up, and Accel Comply prepares a concrete proposal for each, so the board has something it can actually decide on.
Does NIS2 apply to our company?
That depends on your sector, your size and any exceptions in the Danish NIS 2 Act. Either way, the routine is the same: a few decisions, an owner for each and a regular status update, which Accel Comply helps you set up. The NIS2 page covers where to start.
Is it the board or the executive team that's responsible under NIS2?
It depends on how the company is run. The Act calls it the management body. With both executive management and a board of directors, it's the board. With executive management only, or executive management and a supervisory board, it's the executive management (section 3, no. 20). The list makes clear who approves and who carries the work out.
What should the board see at each meeting?
A short status update on the decisions it has taken: what's done, what has stalled and why, and which new risks or decisions have come up. Each line has an owner in the executive team. It can fit on one page, so the board spends the meeting on what needs a decision. Accel Comply can prepare it for you.
Does the board need cybersecurity training?
Yes, if the company falls under the Act. Section 7(2) of the NIS 2 Act says members of the management body must attend relevant training on managing cybersecurity risk and encourage similar training to be offered to other staff. Your senior lead can brief the board on your own decisions and risks.
Related pages
Get the board's own decisions on the table
Briefly describe how your board and executive team handle security and AI today. The reply comes from the senior who would lead the work and says whether it's something Accel Comply can help with.