Why is reporting a steering and liability instrument?
Section 81 AktG governs management-board reports to the supervisory board. For AI governance, this reporting channel needs a clear format: what is monitored continuously, what is reported quarterly and which events trigger ad hoc information?
The goal is an auditable trail. Management and supervisory boards should later be able to understand which information was available, which risks were known, which measures were decided and how implementation was tracked.
What does a useful reporting cycle look like?
Four rhythms, continuous, quarterly, annual and ad hoc, from inventory status to the annual supervisory board report.
| Rhythm | Content |
|---|---|
| Continuous | New AI systems, material changes, vendor updates, approvals, incidents and escalations. |
| Quarterly | Inventory status, high-risk AI, open measures, control findings, training status and top risks. |
| Annually | Management review, policy review, internal-control effectiveness, audit planning and supervisory-board report. |
| Event-driven | Serious incidents, regulatory changes, material model changes or critical audit findings. |
What documentation is the minimum?
AI inventory, risk classification, approvals and controls, supplier documents with role allocation under Art. 25, and meeting minutes.
- AI inventory with owners, purpose, risk, role and review date
- Risk classification and rationale for each system
- Approvals, controls, human-oversight evidence and escalations
- Provider and supplier documentation including Art. 25 role allocation
- Minutes for management review, management decisions and supervisory-board information
CSRD / ESRS: Where does AI touch sustainability reporting?
If AI bias or discriminatory AI decisions create material social impacts, governance risks or human-rights risks, sustainability reporting may be affected. Policies, measures, risks, metrics and evidence then need to be consistent with the AI governance system.
The existing audit readiness page explains which evidence should be robustly available for authorities, auditors and internal control functions.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).