EU AI Act for German Boards 2026: Practical Steps for Management & Supervisory Boards

The EU AI Act Germany compliance picture has moved from theoretical debate to operational reality, and in 2026 boards face a supervisory environment that expects demonstrable action rather than good intentions. Regulation (EU) 2024/1689 (the “AI Act”) entered into force on 1 August 2024 and applies in phases: certain prohibitions and AI literacy obligations began to apply from 2 February 2025, rules on general-purpose AI models from 2 August 2025, and the bulk of the high-risk obligations apply from 2 August 2026, with certain obligations for high-risk systems that are safety components of regulated products applying from 2 August 2027.

Because the AI Act is a Regulation, it applies directly in Germany without transposition, although national implementing measures (including the designation of competent authorities) are being finalised. This guide is written for management and supervisory boards, general counsel and compliance leaders in German companies who need concrete, board-level steps to manage AI risk and reduce personal and corporate liability. What follows is a prescriptive playbook, not a survey, designed to be lifted directly into board minutes, compliance workstreams and vendor negotiations.

1. What the EU AI Act requires of companies

The Regulation establishes a risk-based framework that classifies AI systems and imposes graduated obligations on the organisations that build and deploy them. For German boards, the essential task is to understand where your systems fall within that framework and which obligations flow to your company as a provider, a deployer, or both. The EU AI Act Germany compliance exercise begins with definitions and classification, because everything downstream, documentation, conformity assessment, monitoring, depends on getting the categorisation right.

1.1 Scope & definitions

The Act applies across sectors and reaches organisations placing AI systems on the EU market or putting them into service, as well as those deploying such systems, and it can apply extraterritorially where the output of a system is used in the EU. The core definitions distinguish an AI system from conventional software, a provider (the entity that develops or has an AI system developed and places it on the market or puts it into service under its own name) from a deployer (the entity using the system under its authority), and a high-risk system from lower-risk categories.

These definitions and the legislative objectives are set out in the AI Act itself and in the European Commission’s accompanying materials, and boards should anchor their internal classification policy to that primary text rather than to secondary summaries.

1.2 What “high-risk” means for companies

High-risk classification is the trigger for the most demanding obligations, so understanding which AI systems are classified as high-risk is the first substantive board question. The framework captures AI used in areas such as employment and worker management (recruitment screening, performance evaluation), access to essential private and public services (including creditworthiness assessment and credit scoring, subject to the Act’s exceptions), certain critical infrastructure, education and vocational training, and safety components of regulated products, as set out in the AI Act and its annexes. For German industry, the practical exposure is concentrated in finance (credit decisioning, model-driven underwriting), healthcare and medical devices (diagnostic support systems), and HR technology (automated CV filtering and candidate ranking).

A system’s placement in one of these categories materially expands the compliance burden and, correspondingly, the board’s oversight duty. Boards should treat classification as a documented, defensible decision, not an informal judgement, because regulators and litigants will scrutinise how the determination was reached.

1.3 Core obligations that map to board oversight

For high-risk systems, providers and deployers must operate a range of controls that map directly onto board oversight responsibilities. For providers these include a documented risk management system that runs across the lifecycle of the AI system; data governance measures addressing the quality, relevance and representativeness of training, validation and testing data; comprehensive technical documentation and record-keeping (including automatic logging) sufficient to demonstrate compliance; a conformity assessment before the system is placed on the market or put into service; human oversight arrangements; and post-market monitoring together with serious-incident reporting. Deployers have their own, more limited set of obligations, including using the system in accordance with instructions, ensuring appropriate human oversight, and monitoring operation.

Each of these is not merely an engineering task, it is a governance obligation that the management board must implement and the supervisory board must monitor. The intersection with data protection law is significant: the European Data Protection Board and European Data Protection Supervisor have issued guidance relevant to data governance and data protection impact assessments, and cybersecurity controls should be aligned with guidance from the EU Agency for Cybersecurity (ENISA) on model robustness and incident response. Boards that fail to connect these regulatory strands leave gaps that enforcement will expose.

2. Who on the board is responsible? EU AI Act Germany duties compared

German corporate governance is dualistic: the management board (Vorstand or, in a GmbH, the Geschäftsführung) runs the business, while the supervisory board (Aufsichtsrat) oversees management. (Note that a supervisory board is mandatory for an AG but only required for a GmbH in defined circumstances, for example under co-determination legislation.) Allocating EU AI Act Germany duties across these organs is among the most important governance decisions boards must make, because it determines who acts, who monitors, and where liability crystallises if something goes wrong. The comparison table below is the centrepiece of this guide and should inform your delegation of duties and your board minutes.

2.1 Key legal principles under German corporate law

Under the German Stock Corporation Act (Aktiengesetz, AktG), management board members owe a statutory duty of care under § 93 AktG and are protected by the business judgment rule only where they act on an adequately informed basis and in the company’s interest. Implementing an effective compliance and risk-early-warning system is a core management responsibility; failure to establish and maintain one where the company’s risk profile demands it can constitute a breach of duty. The supervisory board’s duty under § 111 AktG is to monitor management, and that duty is not passive, it requires the supervisory board to obtain adequate information, question management, and intervene where risk management is deficient.

AI risk now falls squarely within these established duties; the technology is new, but the governance principles are not.

2.2 Practical delegation & reporting lines

The management board may delegate the operational execution of AI compliance to a named AI compliance lead or a cross-functional committee, but it cannot delegate away its supervisory responsibility for the compliance system as a whole. Effective delegation means clear mandates, defined reporting lines, and a cadence of reporting to the full management board and onward to the supervisory board. The supervisory board should insist on structured, periodic reporting and reserve certain decisions, such as approving the AI risk appetite and signing off on material high-risk deployments, to itself where appropriate.

2.3 EU AI Act Germany decision framework: which board leads?

Use the decision framework below to determine which board organ should take the lead on a given AI risk matter. The distinction is practical: management leads execution, the supervisory board leads strategic and oversight-failure questions. When the two overlap, document the interface explicitly in board minutes so that oversight is evidenced.

Choose Management Board lead when:

• High-risk AI systems are operationally embedded and require technical remediation.
• The issue is executional, procurement, vendor management, or documentation.
• Fast operational fixes, vendor negotiations, or technical conformity checks are needed.
• Conformity assessment mapping and post-market monitoring must be built into day-to-day operations.
• Incident reporting workflows must be stood up quickly.

Choose Supervisory Board lead when:

• The question is strategic, such as setting the AI risk appetite.
• There are concerns about management’s capability to manage AI risk.
• There is evidence of systemic failure of management oversight.
• Major transactions or significant reputational or legal exposures require independent review.
• Independent assurance or a special committee is warranted for material AI risk.

3. Practical compliance roadmap for management boards

The management board owns execution. The roadmap below sequences AI risk management for boards into concrete phases with indicative timelines, so that the board can demonstrate a structured, informed approach if challenged. Treat each phase as a deliverable with an owner, a deadline and a documented output. The indicative timings below are practical planning suggestions, not statutory deadlines; the binding dates are those set out in the AI Act itself.

3.1 Immediate triage (0–30 days)

Begin by creating an AI inventory that records every AI system in use or under development, its business owner, its function and its data inputs. Run a first-pass classification to flag potential high-risk systems using the Act’s categories. Appoint an AI compliance lead with a clear mandate and reporting line to the management board. Where a flagged system presents obvious near-term risk, for example, an automated hiring tool with no human oversight, impose immediate stop-gap controls such as mandatory human review pending full assessment. The goal in the first 30 days is visibility and containment.

3.2 Short-term actions (1–3 months)

With the inventory in place, design the risk management system that the Act requires for high-risk systems. This means defining how AI risks are identified, assessed, mitigated and monitored across each system’s lifecycle. Begin conformity assessment mapping, identify which systems require assessment, which route applies, and what documentation is missing. Stand up data governance processes addressing the quality and provenance of training, validation and testing data, coordinating with data protection obligations and any required data protection impact assessments consistent with EDPB and EDPS guidance. Establish logging and record-retention protocols so that system behaviour is traceable. Review vendor contracts and identify where audit-clause triggers and model-transparency obligations are absent, flagging these for renegotiation.

This phase converts the inventory into a working AI Act compliance programme.

3.3 Medium-term actions (3–6 months)

Complete conformity assessments for high-risk systems where you act as provider, and implement mitigation for every gap identified during mapping. Where a system cannot be brought into conformity, the board must decide whether to remediate, retire or replace it, and record that decision. Deliver training programmes so that operational teams understand their obligations, particularly around human oversight and incident escalation; note that the Act’s AI literacy obligations already apply. Critically, integrate AI controls into your existing compliance management system (CMS) and information security management system (ISMS) rather than building a parallel structure; alignment with recognised frameworks such as ISO/IEC 27001 (and emerging AI management standards such as ISO/IEC 42001) reduces duplication and strengthens the evidentiary record.

By the end of month six, the management board should be able to show a documented compliance position for all high-risk systems, which is the core of credible AI governance practice in Germany.

3.4 Ongoing obligations & post-market monitoring

Compliance is not a project with an end date. Establish incident reporting protocols that define what constitutes a reportable serious incident, who is notified internally, and the timeline for external reporting to the competent authority as required by the Act. Institute periodic model performance reviews to detect drift, degradation or emerging bias, and apply change control to every model update so that modifications are assessed before deployment. Maintain and update technical documentation continuously, treating it as a living record rather than a one-off deliverable. Prepare for regulator queries and market surveillance by rehearsing how the company would respond to a request for documentation, a dry run will expose weaknesses before a regulator does.

Draw on ENISA guidance to keep security controls and incident response current as threats evolve. This ongoing discipline is what distinguishes durable EU AI Act Germany compliance from a snapshot that decays the moment it is signed off.

4. Practical compliance roadmap for supervisory boards

The supervisory board’s task is oversight, and oversight must be evidenced to be effective. Supervisory board obligations in relation to the AI framework are not satisfied by receiving management assurances at face value; the board must demand structured information, test it, and record its scrutiny.

4.1 Board-level AI policy & risk appetite

The supervisory board should support and monitor adoption of a board-level AI policy that defines the company’s risk appetite for AI deployment, what is permitted, what requires escalation, and what is prohibited. The policy should specify the classification standard, the approval thresholds for high-risk deployments, and the reporting obligations owed by management. Deliberation should be minuted to show the board understood the risks it was accepting. The policy is the anchor against which all subsequent oversight is measured.

4.2 Reporting cadence & dashboards

Set a defined reporting cadence, for example quarterly, and more frequently for companies with significant high-risk exposure. Require management to deliver an AI risk dashboard with clear KPIs: number of high-risk systems, conformity assessment completion rates, open remediation items, incidents reported, and vendor risk status. Use red-amber-green indicators so that deterioration is visible at a glance. Define red flags that trigger escalation to the full supervisory board or a committee, such as a missed conformity deadline, a material incident, or a regulator contact. Dashboards without escalation triggers create the appearance of oversight without its substance.

4.3 Independent assurance & external experts

For material high-risk systems, the supervisory board should consider commissioning independent assurance rather than relying solely on management’s self-assessment. Independent technical audits, external conformity reviews, or expert briefings give the board an objective basis for its oversight and strengthen its position if liability is later alleged. Engage external experts when management lacks the technical depth to assess a system, when a material incident occurs, or when a significant new high-risk deployment is proposed. The cost of independent review is modest against the exposure it mitigates.

4.4 Minutes, escalation records and documenting oversight

Documentation is the supervisory board’s principal defence against liability. Minutes should record not only decisions but the questions the board asked, the information it received, and the responses management gave. Where the board escalated a concern, the record should show the escalation, the action demanded, and the follow-up. Maintain an audit trail linking supervisory queries to management responses over time, so that a pattern of active, informed oversight is demonstrable. Under German law, the difference between a supervisory board member who is exposed and one who is protected often turns on whether contemporaneous records show that the board discharged its duty to monitor.

Treat minute-taking as a compliance control in its own right, and use a standard template so that oversight is captured consistently.

5. Procurement, vendors, and M&A: due diligence & contractual controls

Much of a company’s AI exposure is imported through third-party systems, which makes AI vendor due diligence and contractual control a frontline defence. Boards must ensure that procurement processes are updated so that AI risk is assessed before a system is acquired, not after it fails.

5.1 Vendor due diligence checklist

Before contracting for any AI system, the buyer should require and assess:

• Model provenance. How the model was developed, by whom, and on what basis, including whether it was trained in-house or acquired.
• Training data provenance. The sources, licensing and representativeness of training data, and the vendor’s ability to evidence lawful data use.
• Conformity statements. Documentation showing the system meets applicable AI Act obligations, including any conformity assessment and CE marking where the system is high-risk.
• Third-party audits. Independent audit or certification reports covering robustness, bias testing and security.
• Security controls. Technical and organisational measures aligned with recognised standards and ENISA guidance, including incident response arrangements.
• Human oversight design. How the system supports the human oversight the Act requires for high-risk use.

Record the assessment in a vendor due diligence scorecard so that the board can see, and evidence, that risk was assessed before acquisition.

5.2 Contract clauses to require

Contracts should convert due diligence into enforceable obligations. Require representations and warranties as to AI Act compliance and data provenance; ongoing compliance covenants; audit rights allowing the buyer or its auditors to verify compliance; model update notification obligations so that material changes are disclosed before deployment; and clear allocation of responsibility for conformity assessment where roles could be contested. Scrutinise proposed liability caps and exclusions carefully: a vendor cap that leaves the deployer exposed to the full weight of regulatory sanction for a defect in the vendor’s system is not acceptable and should be resisted or offset by indemnities.

5.3 M&A considerations

In transactions, AI assets require specific diligence. Buyers should require sellers to disclose their AI inventory, classification decisions and conformity status, and should test those disclosures against the underlying documentation. Reps and warranties should cover AI Act compliance, data provenance and the absence of known material AI incidents. Consider escrow arrangements for models or for the funds needed to remediate identified gaps, and use purchase price adjustments where diligence reveals non-conformity. Where remediation cannot be completed before closing, negotiate a post-closing remediation schedule with defined milestones and remedies for failure.

AI risk that is invisible in a data room will surface as a liability on the buyer’s balance sheet, so integrate AI diligence into the standard transaction workstream rather than treating it as a specialist add-on.

6. Enforcement, liability and litigation risk

Understanding board duties in relation to the AI framework requires understanding how enforcement translates into legal risk for the company and for individual directors. The exposure operates on two levels: regulatory sanction against the company, and personal liability under German corporate law.

6.1 Regulatory remedies & fines

The Act empowers authorities to impose administrative fines, to issue corrective orders requiring remediation, and to restrict or prohibit the deployment of non-compliant systems. The Act sets tiered maximum fines, the highest tier, for breaches of the prohibited-practices rules, can reach up to €35 million or 7% of total worldwide annual turnover, whichever is higher, with lower ceilings for other infringements; the applicable figure will depend on the nature of the breach and the enforcement decision. For a business whose operations depend on a high-risk system, a deployment restriction can be more damaging than the fine itself. Regulators may also require governance changes as a condition of continued operation.

The company-level consequences, financial, operational and reputational, are the primary driver for board action, and they escalate where non-compliance is systemic rather than isolated.

6.2 Director and supervisory liability under German law

Personal liability under the AktG arises where a management board member breaches the duty of care under § 93 AktG, for example, by failing to implement a compliance system that the company’s risk profile required, and that breach causes loss. Supervisory board members can face liability under § 116 AktG where they failed to monitor adequately or ignored known risks. In both cases, the decisive factor is frequently documentation: a director who can show that decisions were made on an adequately informed basis, and that oversight was actively exercised and recorded, is far better protected than one who cannot. This is why the roadmaps above emphasise documented decisions and minuted scrutiny, they are not bureaucracy, they are protective evidence.

6.3 Insurance & indemnity considerations

Review D&O cover, cyber and technology errors-and-omissions policies, and contractual indemnities together to identify gaps. AI-related claims can fall between traditional policy definitions, so confirm that AI exposures are addressed rather than assumed to be covered.

7. Board templates, reporting and documentation checklist

Assemble the following artefacts into board packs and compliance records so that oversight is consistent and evidenced:

• AI inventory. System name, owner, classification and risk rating.
• Conformity assessment tracker. Status and deadlines for each high-risk system.
• Incident reporting template. Standard format and reporting timeline.
• Vendor due diligence scorecard. Structured assessment for each AI supplier.
• Board AI risk dashboard. KPIs with red-amber-green indicators.
• Minutes template. Structured to capture supervisory queries and management responses.
• Record retention policy. Governing all AI documentation.

Conclusion

EU AI Act Germany compliance in 2026 is a board-level obligation that rewards early, structured and well-documented action. Management boards must own execution, inventory, classification, conformity assessment, vendor control and monitoring, while supervisory boards must demand evidence, test it, and record their scrutiny. The comparison table and decision framework above indicate which organ leads; the phased roadmaps set out what to do and by when; and the documentation checklist gives you the artefacts to prove it. Boards that treat these steps as a genuine governance programme, integrated into their existing CMS and ISMS, will manage AI risk effectively and materially reduce both corporate and personal liability.

Given the phased application dates and the pace of supervisory activity, the prudent course is to begin now and to seek tailored legal advice on Germany-specific liability wording and template language before relying on any of it.

This article is provided for general information and does not constitute legal advice. Companies should obtain advice tailored to their specific circumstances.

See also our related coverage of Germany Compliance Changes 2026. For deeper practical guidance, consult our resources on AI vendor & procurement due diligence, AI in M&A diligence for German buyers, and integrating AI risk into your CMS & ISMS, as well as our GLE Compliance practice page for Germany and the GLE lawyer directory for Germany Compliance.

Sources

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex
2. European Commission, Regulatory framework for AI
3. EUR-Lex, Official EU legal texts
4. European Data Protection Board (EDPB)
5. European Data Protection Supervisor (EDPS)
6. European Union Agency for Cybersecurity (ENISA)
7. OECD, AI Principles
8. German Federal Commissioner for Data Protection and Freedom of Information (BfDI)
9. Federal Financial Supervisory Authority (BaFin)