CEO Liability and a Two-Year Countdown: German Businesses Brace for the EU AI Act’s Next Wave

The clock is ticking for German companies. From August 2, 2026, managing directors face personal liability if they cannot demonstrate they have taken adequate security measures for any artificial-intelligence systems their firms use. That means maintaining an internal AI register, carrying out risk analyses, drafting usage guidelines and training employees — all before the summer deadline. In the event of a claim, the burden of proof flips: executives must show they did everything reasonable. Court rulings from May 2026, including at the Munich I Regional Court and the Hamm Higher Regional Court, have already reinforced this interpretation.

New Transparency Rules and a Staggered Timeline

At the heart of the regulation is a simple requirement: any AI-generated or manipulated image or other content must be clearly labelled. The obligation applies not only to developers but also to any business that uses AI features in standard software commercially. The European AI Act, passed in stages, sets a series of deadlines. For high-risk stand-alone systems — such as those used in personnel management or performance evaluation — the transition period runs until December 2, 2027. High-risk systems embedded in other products have until August 2, 2028. Providers of existing systems gained extra time under the so-called Digital Omnibus regulation, pushing their compliance date to December 2, 2026. Certain banned practices, like social scoring, have already been illegal inside the EU since February 2025.

The BSI’s Audit Architecture Seeks Standardisation

Germany’s Federal Office for Information Security (BSI) has published a draft for a standardised testing framework called the “AI Audit and Assurance Assessment Architecture” (A5). It is meant to become the basis for auditing AI applications, with a focus on explainability of models, prevention of bias, and defence against attacks such as data poisoning. Industry experts have until August 31, 2026 to submit feedback. The technical criteria are especially critical for high-risk applications, which must maintain high cybersecurity throughout their entire lifecycle under the AI Act.

Practice Lags Behind Policy, and Uncertainty Reigns

Though the regulatory framework is advancing, many companies are struggling to adapt. Market observers estimate that about 76 percent of mid-sized German firms now use AI productively, yet only 26 percent have fully integrated it into their business processes. In nearly every second company, AI remains confined to isolated departmental strategies, while roughly 16 percent of enterprises are dealing with uncontrolled “shadow AI” that bypasses official channels. The biggest obstacles: a lack of in-house expertise and persistent concerns over IT security. Adding to the confusion is the question of which authority is responsible for enforcement. The German parliament (Bundestag) passed the Implementing Act on June 11, 2026, designating the Federal Network Agency (Bundesnetzagentur) as the central market-surveillance body. But coordination with other institutions, such as the German Accreditation Body, is still underway.

Heavy Fines and a Tougher Regulatory Landscape

Non-compliance carries steep financial risks. Using prohibited AI practices can result in fines of up to €35 million or 7 percent of global annual turnover. Breaches of obligations for high-risk systems cost up to €15 million or 3 percent of turnover. These penalties sit alongside other tightening rules. Companies with more than 50 employees or turnover above €10 million must already fulfil registration and reporting requirements under the NIS2 directive by July 31, 2026. Recent legal actions — for instance against Meta — show that courts are increasingly awarding damages when firms fail to provide adequate information about their AI systems. Liability for hacker attacks exploiting unknown vulnerabilities, however, can still be avoided if the company can prove it took reasonable protective measures.

en | boerse | 69727455 |