Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Glossary

AI Governance for Managing Directors: Duties

AI governance from the board's perspective: duty of care and liability, AI literacy under Art. 4 AI Act and solid decision papers for AI projects.

Definition: AI governance for managing directors covers the tasks that stay with top management when a company builds or uses AI. Management makes the strategic calls. It weighs risks and chances with care. It sets up a fitting organisation and checks that it works. You can hand off the daily work. You cannot hand off the overall responsibility.

Why AI is a task for leaders

Choices about AI touch many areas at once:

  • the business model
  • information security
  • data protection
  • employment law
  • liability

Take three examples. A language model answers customer questions. A tool sorts job applications before a person sees them. Or the company trains a model on its own data. None of this is just an IT matter. Choices like these belong where budgets are set and where the risk for the whole company is carried.

The legal frame for management

General duty of care

Under German law, managing directors of a GmbH must act with the care of a prudent businessperson (Section 43 GmbHG). The management board of an AG is held to the same standard (Section 93 AktG). The law protects business decisions that were based on good information and made in the company's best interest. This is the business judgment rule.

For AI, that means: if you approve an AI project without a risk analysis, or ignore known weak spots, you will find it hard to rely on that protection later. A well-informed decision that is written down is your best self-protection. This is the core of AI governance for managing directors.

EU AI Act

Regulation (EU) 2024/1689 entered into force on 1 August 2024. Key dates and rules:

  • Since 2 February 2025: the bans on certain practices (Art. 5) and Art. 4 on AI literacy apply.
  • Digital Omnibus (in force since 27 July 2026): as amended, providers and deployers must support AI literacy among their staff and other persons acting on their behalf. Management should anchor this task in the organisation. Training remains the main tool.
  • Since 2 August 2026: the transparency duties under Art. 50, among others, apply.
  • High-risk deadlines: the Digital Omnibus moved them back. Systems under Annex III follow from 2 December 2027. High-risk AI in regulated products under Annex I follows from 2 August 2028.

Fines reach up to EUR 35 million or 7 % of worldwide annual turnover for banned practices. For other breaches, they reach up to EUR 15 million or 3 %.

NIS2 and the German BSIG

Your company may fall under NIS2 (Directive (EU) 2022/2555). In Germany, it is put into law through the BSIG, in force since December 2025. Then Section 38 BSIG says management must:

  • approve the risk management measures
  • oversee how they are put in place
  • take part in training on a regular basis

Breaches can lead to personal liability. NIS2 has no separate rules for AI. But AI systems are part of the IT that risk management must cover.

What managing directors should do

  1. Set an AI strategy: Where should AI add value? Where is it clearly not wanted? How much risk are you willing to take?
  2. Assign responsibility: name a person or role to build the AI governance framework and report on it. Give them enough budget and direct access to management.
  3. Build your own AI literacy: leaders do not need to code. But they should grasp ideas such as hallucination, prompt injection, training data and the AI Act risk classes. Only then can they question proposals in a critical way.
  4. Order a training programme: set up tiered training for all staff under Art. 4 AI Act. Keep records of who took part.
  5. Ask for regular reports: at least every quarter. They should cover the AI inventory, new use cases, incidents, open risks and compliance status.
  6. Write down decisions: record each approval of a major AI project. Add the reasons and the risk assessment.

A good decision paper for AI projects

A decision paper should give management what it needs to decide on an informed basis. It should answer at least these points:

  • Business purpose, expected benefit and options without AI
  • Role under the EU AI Act (provider or deployer) and likely risk class
  • Data processed, above all personal and confidential data. Add the result of any required data protection impact assessment.
  • Vendor, contract terms, where the data is stored and what you depend on
  • Main security risks and planned countermeasures. Add the results of a security test where you have one.
  • Human oversight: who reviews the outputs, and who can stop the system?
  • Costs over the whole life cycle, success criteria and a date for review

Conclusion

Management does not have to run AI itself. But it must set the frame, decide on an informed basis and oversee how plans are carried out. That is what AI governance for managing directors means in practice. SecTepe supports managing directors with executive training. As an external ISO or CISO, we also help assess AI projects.

Frequently asked questions

Can management hand off AI responsibility entirely?

Tasks, yes. Responsibility, no. Management must choose the right people with care and give them what they need. It must also oversee the tasks it handed off.

Is a one-off AI training session enough for management?

Hardly, because technology and rules change fast. A basic course works better when short, regular refreshers follow it. Ideally, you combine it with the NIS2 training duty where that applies.

More terms in “AI & Machine Learning”

All terms in “AI & Machine Learning” →