Which AktG duties ground the AI organisation?
Section 70 AktG assigns management of the stock corporation to the management board. Section 84 AktG defines the diligence standard. For AI governance, this means appropriate information, control and escalation structures.
The business judgment rule in Section 84(1a) AktG protects business decisions only under conditions: no extraneous interests, adequate information and action for the benefit of the company. In AI use, adequate information becomes practical: is there an AI inventory, is the provider/deployer role clear, are risks, human oversight and controls documented?
What should the management board define?
Five building blocks: AI inventory, risk classification, responsibilities, human oversight and management review.
| Building block | Governance question |
|---|---|
| AI inventory | Which AI systems are actually used, including vendor AI and GPAI? |
| Risk classification | Which systems are high-risk or affect HR, customers, credit, insurance or safety? |
| Responsibilities | Who owns the system, business process, compliance, privacy, IT security and supplier control? |
| Human oversight | Who can review, override, escalate and document AI outputs? |
| Management review | How often does management receive reliable information on inventory, risks, incidents and measures? |
Relation to board liability
This page describes the positive governance programme. The existing board liability page describes the risk perspective where governance, documentation or oversight are missing.
A robust starting point consists of AI inventory, role allocation, risk classification, policy, approval process, escalation path and regular reporting to management and supervisory bodies.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).