Management means organisation
Section 70 AktG assigns management of the stock corporation to the management board. Section 84 AktG defines the diligence standard. For AI governance, this means appropriate information, control and escalation structures.
The business judgment rule in Section 84(1a) AktG protects business decisions only under conditions: no extraneous interests, adequate information and action for the benefit of the company. In AI use, adequate information becomes practical: is there an AI inventory, is the provider/deployer role clear, are risks, human oversight and controls documented?
What management should define
| Building block | Governance question |
|---|---|
| AI inventory | Which AI systems are actually used, including vendor AI and GPAI? |
| Risk classification | Which systems are high-risk or affect HR, customers, credit, insurance or safety? |
| Responsibilities | Who owns the system, business process, compliance, privacy, IT security and supplier control? |
| Human oversight | Who can review, override, escalate and document AI outputs? |
| Management review | How often does management receive reliable information on inventory, risks, incidents and measures? |
Relation to board liability
This page describes the positive governance programme. The existing board liability page describes the risk perspective where governance, documentation or oversight are missing.
A robust starting point consists of AI inventory, role allocation, risk classification, policy, approval process, escalation path and regular reporting to management and supervisory bodies.