In 60 seconds
- Without rules, shadow AI emerges. With rules, AI becomes usable.
- The framework: AI register, AI policy, approved tools, training.
- The 90-day plan gets you there in 3 steps, with templates to download.
Legal status: 5 November 2026
3 goals that belong together.#
Realise the benefits
AI saves time with texts, analyses, programming and service. This requires approved tools and training.
Manage the risks
Data protection, confidentiality, security and quality must be considered from the start.
Stay compliant
The AI Act, the GDPR and employment law require documentation, competence and transparency.
Governance as a cycle.#
4 steps that repeat continuously.
Inventory
Build an AI register: tool, purpose, data, vendor, owner. Include shadow AI.
Assess
Risk class under the AI Act, data protection risk, security risk, impact on people.
Control
Policy, approvals, training, contracts, technical safeguards.
Monitor
Monitor use, quality, incidents and legal changes and adjust the rules.
The AI policy: 10 building blocks.#
Click a building block to see more.
1. Purpose and scope
Why does the policy exist, for whom and for which tools does it apply? Half a page is enough.
2. Permitted and prohibited use
A positive list of approved purposes and clear prohibitions, for example no automated decisions about people without review.
3. Data traffic light
Which data may go into which tools? Green, yellow, red as on the AI overview page.
4. Approved tools
List of permitted tools with a contract. New tools go through a review process (see procurement).
5. Quality assurance
Results are checked by people before they are used. Responsibility stays with the person, not with the tool.
6. Labelling and transparency
When is AI content labelled, and when are customers informed about the use of AI?
7. Copyright and confidentiality
Handling third-party content, licences and trade secrets in input and results.
8. Roles and responsibility
Who decides on new tools, who checks data protection and security, who is the contact person?
9. Incidents and reporting channels
What to do in case of errors, data leakage or manipulation? Where to report, and by when?
10. Training and review
Mandatory training and regular updating of the policy, at least once a year.
Vendor assessment: 8 questions for every AI provider.#
| Topic | The question | Why it matters |
|---|---|---|
| Training | Is our input used to train models? | Prevents trade secrets from flowing into third-party models |
| Data location | Where is data processed and stored? | Data protection and transfers to third countries |
| Contract | Is there a data processing agreement and clear deletion periods? | GDPR obligation for personal data |
| Security | Which certificates and audits are there (e.g. ISO 27001, BSI C5)? | Evidence of security measures |
| Logs | Which data is logged, and who has access? | Traceability and data protection |
| Compliance | How does the provider comply with the AI Act (documentation, obligations for AI models)? | Division of obligations between provider and deployer |
| Copyright | Are there commitments on handling copyright issues with results? | Legal risk when using the results |
| Exit | How can data be exported and contracts terminated? | Avoids dependency |
Law in operation: 5 areas.#
Data protection
Legal basis, data processing agreement, data protection impact assessment for high risk, informing the people concerned.
Works council and employees
Information and co-determination rights, for example when systems can evaluate performance or behaviour.
Copyright and secrets
Rights to results, third-party content in input, protection of trade secrets.
Liability and contracts
Own responsibility for results, liability clauses in vendor contracts, new product liability.
Sector-specific law
Additional requirements in finance, health or insurance, for example from BaFin.
AI literacy: training by role.#
Art. 4 of the AI Act has applied since 2 February 2025.
| Audience | Content |
|---|---|
| All employees | Basics, opportunities and limits, data traffic light, hallucinations, fraud using voice and video |
| Specialist users | Safe use in their own area, quality assurance, labelling, copyright |
| Managers and executive management | Risks and responsibility, regulation, governance, decisions on use and approval |
| IT and security | Attacks on and with AI, OWASP list, agent guardrails, monitoring |
| Development and operations | Secure development, testing, documentation, supply chain, requirements of the AI Act |
Training should be documented: content, participants, date. This allows you to prove compliance.
Data traffic light for employees.#
A decision aid that fits into any policy.
Guidance for everyday use. Your company's rules and the contract with the provider always apply.
The 90-day plan.#
From zero to a sustainable framework.
Days 1 to 30: see
Create an AI register, ask about shadow AI, collect risks, name owners, publish a first data traffic light.
Days 31 to 60: set rules
Agree an AI policy (with data protection, IT security and the works council), define approved tools, introduce vendor assessments.
Days 61 to 90: enable
Carry out role-based training, test the incident reporting channel, set up metrics and legal monitoring.
Check: AI governance.#
7 questions for your company.
Rough guidance, not an audit. Your selection stays in your browser.
Frequently asked questions.#
Do I need an AI officer?
A fixed role is not mandatory everywhere, but it makes sense: someone should be responsible for the register, policy and training. This can also be an existing role in data protection or IT.
Is banning private AI accounts enough?
A ban alone is rarely enough. Offer an approved alternative and explain the rules. Otherwise employees find workarounds.
How do I measure success?
With a few metrics: share of approved tools, trained staff, reported incidents, quality of results and time saved.
How does this relate to NIS2?
AI systems are part of the IT landscape. Risk management, supply chain, incident handling and training under NIS2 apply to them too.
Building AI governance?
Tell me where you stand, and we will add suitable templates and content.
Sources and further reading
Was this page helpful?
Found a mistake? Let me know.
Suggested citation: Russo, K.: "AI in business". sicherheitsdenker.de/en/ki-im-unternehmen/, as of 6 November 2026.