EU AI Act and ISO 42001 for the CEO: staff AI use, fines and governance ownership

Our staff all use generative AI. What should the CEO manage first?

First check whether the EU AI Act applies: a Taiwanese company is in scope when it places an AI system on the EU market or when the AI's output is used in the EU (Article 2(1)).

Where it applies, the Article 4 AI literacy obligation has applied since 2 February 2025. As amended by Regulation (EU) 2026/1744, providers and deployers must "take measures to support" the AI literacy of staff and others operating AI on their behalf, without having to guarantee any specific level for any individual. The European Commission's Q&A says no certificate is needed, internal training records can be kept, and staff should be told about specific risks such as hallucination.

Even where it does not apply, the CEO should do two things: set internal usage rules (which data must never be entered, such as confidential and personal data) and provide training.

We use AI to screen CVs or assess credit. What does the CEO answer for?

Recruitment and credit scoring are high-risk AI under Annex III. Under the Digital Omnibus (Regulation (EU) 2026/1744), high-risk obligations for Annex III systems apply from 2 December 2027.

If the company is a deployer (using someone else's AI system in its business), it must:

• use the system according to the provider's instructions
• assign competent people to human oversight
• keep logs for at least 6 months
• carry out a fundamental rights impact assessment when deploying credit scoring or life and health insurance pricing systems (Article 27)

If the company develops the system and offers it under its own name, it is the provider, with heavier duties including a conformity assessment. Even for use only inside Taiwan with no EU link, the service page recommends governance for high-risk scenarios such as HR decisions and credit assessment.

How high are EU AI Act fines? If AI causes harm, does the company pay damages?

Administrative fines (Article 99, whichever is higher; for SMEs, whichever is lower):

Civil damages: the EU AI Act itself contains no civil damages rules, and the Commission has withdrawn its proposed AI Liability Directive. Harm caused by AI is mainly handled under the new Product Liability Directive (EU) 2024/2853 (covering software and AI systems, for products placed on the market from 9 December 2026) and national tort law.

Whether to recognise a provision and how to allocate liability in contracts are for legal counsel and the statutory auditor to judge case by case.

Is ISO 42001 worth the investment? How does it differ from the EU AI Act?

They are different in kind:

The value is one management system that carries the risk management, record-keeping and human oversight processes the AI Act requires, so you can show customers an AI system inventory, risk assessment and control records. Timelines listed on the service pages: usually 4–6 months to certification with ISO 27001 in place, about 6–9 months from scratch; high-risk AI compliance usually 6–9 months, or 9–12 months integrated with ISO 42001 certification.

Who owns AI governance? What should go to the board?

Build three documents first so that responsibility has somewhere to land:

1. AI system inventory: every AI system in the company (built or bought), with its role and risk level, and the reasoning recorded.
2. AI risk and impact assessment: one document covering Article 9 risk management, the Article 27 fundamental rights impact assessment and the ISO 42001 risk and impact assessment.
3. EU AI Act obligation matrix: each obligation by role, with owner, evidence and due date.

An Article 6(3) exemption (claiming an Annex III system is not high-risk) needs a written assessment and registration, never a verbal judgment.

For the board, AI can sit in the existing risk management policy: under Article 18 of the TWSE/TPEx Risk Management Best Practice Principles, risk categories include compliance risk and information risk. These principles apply to listed companies; non-public companies are not bound by them but can follow them voluntarily.

What does Taiwan's AI Basic Act require of companies?

Taiwan's Artificial Intelligence Basic Act was promulgated and took effect on 14 January 2026, with the National Science and Technology Council as the central authority. Most provisions govern the government; concrete requirements for companies will mainly come through risk-based management rules and industry guidelines from each sector regulator, which the Executive Yuan has asked to be issued before January 2028.

What the CEO can do now:

• use the AI risk classification framework version 1.0, published by the Ministry of Digital Affairs on 7 July 2026, to inventory and assess the company's AI uses
• track the management rules of your sector regulator
• use the AI system inventory and risk assessment built under ISO 42001 to meet both Taiwanese and EU requirements, instead of running two systems

How does Winners Consulting help the CEO handle the EU AI Act and ISO 42001?

VP- and director-level consultants lead the work end to end, never outsourced, and hold ISO 42001 lead auditor qualifications. Winners Consulting is a consultancy and does not certify; certification is done by the certification body you choose.

• Classify before investing: inventory all AI systems, determine role (provider or deployer) and risk level, and plan the most cost-effective path by risk.
• Three core documents: AI system inventory, AI risk and impact assessment, and EU AI Act obligation matrix, with the legal source marked in every column.
• One set of evidence for ISO 42001 and the AI Act: ISO 42001 as the organisational governance backbone, with AI Act gaps closed article by article, sharing the backbone with ISO 27001 and 27701.
• Post-market monitoring: post-market monitoring and serious incident reporting folded into the existing security incident process.

Read more: EU AI Act consulting, ISO 42001 implementation, Choosing an EU AI Act consultant, Choosing an ISO 42001 consultant, Budget and timeline.

Request a free mechanism diagnosis