AI in the Boardroom: What corporate leaders need to know now

As the EU’s landmark AI Act begins reshaping workplace governance, board members and C-suites must confront a new digital reality. We sat down with three leading legal experts from Hannes Snellman — Sanna Honkinen, Partner (Employment), Klaara Lähteenoja, Senior Associate (Employment), and Maria Aholainen, Counsel (IP & Technology)—to unpack what listed company leaders must know about AI’s legal and operational implications, especially in HR context.

Nordic Listed Leaders: Let’s start with the basics. Why should board members and top management care about the AI Act today, especially when most of its provisions come into force in 2026?

Sanna Honkinen: The first parts of the Act are already in effect as of February 2025—most notably the obligations around AI literacy and prohibited use cases. That means management can no longer afford to think of AI governance as a future issue. It’s here. 

Maria Aholainen: AI is business enabler, not just a compliance issue. The Board’s role is to understand the actual AI use cases and how AI can generate value for the business. As AI comes with risks, the board is also responsible for overseeing the company’s risk appetite in achieving strategic objectives and maintaining sound risk management.  

Klaara Lähteenoja: Especially in the employment context, if AI can directly affect people’s career progression, salaries, and employment terms, as well as whether a job applicant is selected for a position, it is considered as a high risk AI system. If a recruitment or performance management system uses AI in a way that’s biased or opaque, that’s not just an HR issue—it’s a board and management level risk. Under both the AI Act and existing Finnish labour law, employers are responsible for the outcomes of these systems, even if decisions are made algorithmically.

Nordic Listed Leaders: So, what qualifies as “high-risk” AI in the workplace exactly?

Maria Aholainen: It’s narrower than many assume. The AI Act reserves most requirements for systems that directly impact people’s rights—like AI used in recruitment, performance reviews, promotions, or decisions about pay like Klaara mentioned. If you’re using AI to do narrow procedural tasks, such as draft job ads or scan CVs without making actual decisions, that’s typically lower risk. But once the system starts influencing who gets shortlisted, hired or promoted , you’re in high-risk territory. Bear in mind that the line between a final decision and micro-decisions influencing the final decision is often blurred.

Nordic Listed Leaders: What role does the board have in ensuring compliance? Isn’t this just an HR or IT responsibility?

Maria Aholainen: That’s a common misconception. The board has a duty to oversee risk management and legal compliance broadly—including AI use. This is not just about IT infrastructure—it’s about governance, ethics, and long-term corporate resilience. 

Klaara Lähteenoja: And from a legal point of view, liability ultimately lies with the employer. If a company’s AI tool makes a discriminatory decision in hiring or promotion, the company—and by extension, its leadership—is responsible. Boards need to ensure their companies are stress-testing these systems for bias and discrimination.

Nordic Listed Leaders: You mentioned AI literacy. What does that mean in practice for leadership teams?

Sanna Honkinen: It’s about more than understanding what AI is. Leaders need to know how AI works in the context of their organisation, what systems are in use, how decisions are made, and what risks are involved. Under both the AI Act and Finnish labour law, there’s a growing legal obligation to upskill employees—and that includes management. 

Maria Aholainen: You don’t need to write the code yourself, but you do need to ask the right questions: Is this AI system explainable? How was the data sourced? What safeguards are in place when AI gets it wrong? 

Nordic Listed Leaders: Let’s talk data. What’s the board’s role in ensuring ethical AI through data governance?

Klaara Lähteenoja: It’s critical. AI systems are only as good as the data they’re trained on. Historical data—especially in male-dominated industries—can be inherently biased. Boards must push for high-quality, representative data and demand regular audits of how that data is used in AI applications. Otherwise, even a well-intentioned system can perpetuate discrimination.

Maria Aholainen: AI doesn’t come with a built-in moral compass. It amplifies what it’s trained on, as Klaara said. Let’s face it, AI will be utilised by every business “governed or ungoverned”. Successful businesses don’t just adopt AI —they govern it. Governance is a key for mitigating risks while fostering innovation. The board should ensure that there is an appropriate balance between the two. 

Nordic Listed Leaders: One final legal grey area—does the use of AI at work require employee consent?

Maria Aholainen: Generally, no. Under current legislation and the AI Act, employee consent is not required for most AI use cases—particularly not for things like monitoring or surveillance. That’s because the power imbalance between employer and employee makes true consent tricky. And remember, employees can withdraw consent at any time, which weakens its legal reliability as a basis for processing.

Klaara Lähteenoja: That said, there are edge cases—particularly in high-risk AI applications involving automated decision-making that significantly impacts individuals. In some cases, consent may be the only viable legal basis. 

Nordic Listed Leaders: Your message to board members in one sentence?

Maria Aholainen: Don’t treat AI as another compliance issue—treat it as a business enabler that deserves a seat in the boardroom table. 

Sanna Honkinen: View AI risk like you would financial, cyber, or ESG risk—and act accordingly.

Klaara Lähteenoja: If AI makes a decision in your company’s name, the responsibility is still yours.

Closing Thought:

The AI Act marks a turning point for workplace governance in Europe. For listed companies, the conversation about AI must move from the margins of IT and HR to the core of strategic leadership. In the boardroom of the future, fluency in AI will be just as essential as financial acumen.