BSI AI Security Guidance for Businesses

What role does the BSI play in AI security?

The BSI is Germany's federal cybersecurity authority. Its main tasks:

• It advises businesses, public bodies and citizens.
• It develops standards such as the IT-Grundschutz Compendium.
• It supervises operators of critical facilities and entities that fall under NIS2.

On AI, the BSI looks at two sides. One is the security of AI systems themselves. The other is how AI changes the threats we face. Both show up in its papers and in its yearly report on the state of IT security in Germany.

Key publications

Generative AI models: opportunities and risks for industry and authorities

The German title of this paper is "Generative KI-Modelle – Chancen und Risiken für Industrie und Behörden". It is for organisations that use, or plan to use, large language models and other generative AI. The BSI sorts the risks into three groups:

• Risks in proper use: for example outputs that are wrong, made up or biased, outdated knowledge, and results that are hard to trace.
• Risks from misuse: such as using generative AI to write phishing messages, false information or harmful code.
• Risks from attacks on the models: including prompt injection, poisoned training data and pulling out secret information.

From this, the BSI derives countermeasures:

• make users aware of the risks
• test carefully before you go live
• handle sensitive data in prompts with care
• check outputs with a critical eye
• limit the rights a model has to reach other systems

The paper is updated over time. So always use the current version on the BSI website.

AIC4: AI Cloud Service Compliance Criteria Catalogue

AIC4 is a criteria catalogue for AI-based cloud services. It builds on the BSI's C5 catalogue for cloud services. It adds rules just for AI. Among other things, they cover security and robustness, performance, reliability, data quality, explainability and bias. Providers can have auditors confirm that they meet these rules. For customers, AIC4 helps most when buying a service. An audit report gives solid proof that goes beyond marketing claims.

IT-Grundschutz as the foundation

Right now, the BSI's guidance does not center on one Grundschutz module that covers AI in full. But AI apps run on servers, cloud services and interfaces. Existing modules already apply to them, for example on cloud use, web apps, identity and access management, and patch and change management. The AI guidance adds to these basics. It does not replace them.

Applying the guidance in practice

For mid-sized companies, the BSI's advice leads to a practical approach:

1. Take stock: Find out which AI services are in use across the company. Include those that staff started using on their own (shadow AI).
2. Usage policy: Decide which services are approved and which data staff may enter. Secret data and personal data belong only in approved services with suitable contracts.
3. Risk assessment per use case: Rate each use against the three BSI risk groups. An internal writing helper needs different measures than an agent that sends emails or places orders.
4. Secure procurement: Ask providers for proof such as C5 or AIC4 reports. Ask where and how they store and use your data, and how they handle security incidents.
5. Technical safeguards: Give AI apps as few rights as possible. Keep trusted and untrusted inputs apart, and log access.
6. Training: Teach staff about the limits of AI outputs and about deception with the help of AI. This also supports the duty to promote AI literacy under Article 4 of the EU AI Act. That duty has been in force since 2 February 2025. The Digital Omnibus (in force since 27 July 2026) reframed it as a duty to support the development of AI literacy.
7. Review regularly: AI services change quickly. Build reviews into your ISMS cycle.

Relationship to the EU AI Act and NIS2

The BSI's recommendations are technical guidance. The EU AI Act (Regulation (EU) 2024/1689), by contrast, is law that applies directly.

In Germany, the BSI is not the main AI Act authority. That role goes to the Federal Network Agency (Bundesnetzagentur). It is the national market surveillance authority, single point of contact and complaints body for the AI Act. This has been the case since the German AI Market Surveillance Act (KI-MIG) came into force on 29 July 2026.

For entities covered by NIS2, however, the BSI is the supervisor in charge. AI systems are part of general risk management under Section 30 of the BSI Act (BSIG). If you follow the BSI's guidance, you can show supervisors, auditors and customers that you rated AI risks by a recognised standard.

Conclusion

The BSI's recommendations give companies in Germany a practical basis for using AI safely. They do not favor any vendor. They cover everything from usage policies to choosing suppliers. SecTepe helps you build this guidance into your existing ISMS processes based on ISO/IEC 27001 or IT-Grundschutz.

Frequently asked questions

Are the BSI's AI recommendations mandatory?

For most companies, not directly. But they spell out what counts as fitting security. They are used as a benchmark in NIS2 audits, in certifications and after incidents.

Do we need an AIC4 attestation for every AI service?

No. An attestation is useful proof for AI cloud services with high protection needs. For less critical apps, a supplier check and promises in the contract are often enough.