C-LEVEL & MANAGEMENT BOARD
Using AI without conflicting goals
The decision on AI has long since been made in your company. Just not at board level. 67 per cent of employees in Germany use generative AI regularly, and more than half would do so even without their employer’s consent. This is no longer a question for the future; it is your current situation. The real leadership task is therefore: how do you capture the value for the business without liability, data protection and reputation becoming the price? We show you how to set up AI governance as a decision-making architecture – lean, tailored to your size and without an oversized consulting apparatus. With clear responsibilities and the option to exit at any time.
Legal status as of 24 September 2026
The conflict of objectives is real, but it lies somewhere other than most people think
The classic conflict is told like this: innovation versus compliance, speed versus control. In practice, we see a different conflict: unclear responsibility versus everything else. AI projects rarely fail because of the technology. They fail because nobody is allowed to decide, nobody wants to approve and, in the end, nobody wants to be liable. The result is the worst of both worlds: the workforce uses AI anyway (according to a BCG study from June 2025, 54 per cent would do so even without permission), only without any control, with company data in public tools and without any documentation. This is called shadow AI, and it is everyday reality in more than half of all companies, while only 23 per cent of German companies have any rules on AI use at all (Bitkom, October 2025).
For the management board, this means: whoever postpones AI governance is not deciding against the risk. They are deciding in favour of the uncontrolled version of the risk.
Shadow AI in figures. Sources: BCG employee study 06/2025, Bitkom 10/2025.
What already applies legally today
The EU AI Act is not a topic for the future. The prohibitions on certain AI practices have applied since 2 February 2025. Since the same date, Article 4 of the AI Act has required staff working with AI systems to have a sufficient level of AI literacy. Although the Digital Omnibus (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026) has postponed the obligations for high-risk AI systems to 2 December 2027, this changes nothing about the rules that already apply. In addition, the transparency obligations under Article 50 of the AI Act have applied since 2 August 2026, including the disclosure obligation for deepfakes on the deployer side. And the fines under the AI Act reach up to EUR 35 million or 7 per cent of worldwide annual turnover.
On top of this comes a second level that has not yet reached many executive floors: with the German NIS2 Implementation Act, in force since 6 December 2025, cybersecurity is explicitly a task of the management. The Act provides for approval, oversight and training obligations of the management bodies, with personal responsibility. That managing directors can be held personally liable for data protection breaches alongside the company is not theory: the Dresden Higher Regional Court (OLG Dresden) ruled exactly that (judgment of 30 November 2021, 4 U 1158/21). Setting up a documented governance system is part of the duty of care under Section 43 GmbHG (German Limited Liability Companies Act) and, in an emergency, is at the same time the best evidence of discharge. Anyone who introduces AI systems without clarifying the security and governance questions links both risk areas together.
Three questions every management board must be able to answer
First: where is AI running in our organisation? This means a complete inventory, including the tools that business units have introduced themselves and the AI functions that software vendors build into existing products via updates. Second: who decides on approvals? Using AI without a designated approval process is not innovation; it is unvetted operation. Third: what happens if something goes wrong? Misclassifications, data leakage, discriminatory results: for each of these cases, there needs to be a path from incident to decision before the incident occurs.
Anyone who can answer these three questions in one sentence has functioning AI governance. Everyone else has a document with that name.
Value is created through approval – control is what makes it possible
The economic effect of sound governance is measurable: approved tools are used more widely and more boldly than tolerated ones. Employees who know what is permitted work faster than those operating in a grey area. And projects with clear responsibility get through the works council, data protection and internal audit instead of fizzling out in the third round of consultations. Co-determination under the German Works Constitution Act (Sections 87 and 90 BetrVG) is not an obstacle if it is planned for early. It only becomes expensive when it has to be made up for at the end.
How we work
We start with a 90-minute management briefing: your current situation, your specific obligations, your three most urgent areas of work. Then you decide. Our engagement is modular, with each module commissioned individually and fully cancellable at any time. You keep control over scope, pace and budget. You get plain talk and a robust basis for decision-making.
Request a management briefing
90 minutes, fixed price: your current situation, your specific obligations, your three most urgent areas of work.
MODULAR · TRANSPARENT PRICING · CANCEL AT ANY TIME
