Which legal provisions ground board liability for AI?
The Austrian Stock Corporation Act requires board members to apply the care of a diligent and conscientious manager. For banks, Section 39 BWG adds the duty of proper business organisation. These rules form the basis for organisational failure having personal consequences.
If an AI system is operated without sufficient governance and damage results, civil-law, supervisory-law and insurance-law questions can arise. Concrete liability always depends on the individual case and should be legally assessed.
What liability risks exist?
Three: regulatory sanctions, civil liability for damages and D&O coverage risk.
Regulatory sanctions
For high-risk AI used by supervised financial institutions, Art. 74(6) AI Act in principle assigns market surveillance to the financial supervisor – in Austria the FMA; Member States may deviate from this. Austria had not yet formally designated its authorities as of 20 October 2026, and the final allocation will follow from national implementation. The FMA has already been notified as a fundamental-rights authority under Art. 77 AI Act. The ECB is not a market surveillance authority under the AI Act, not even for significant institutions. Existing supervisory regimes such as BWG, VAG, DORA and GDPR also continue to apply; for insurers, EIOPA's opinion of 6 August 2025 sets out risk-based, proportionate expectations for AI governance.
Civil liability for damages
AI systems without documented governance, without risk assessment and without appropriate human-oversight structures can affect the diligence standard of a proper manager. Damage from AI misdecisions may lead to claims against the company and internal recourse questions.
D&O coverage risk
D&O insurance does not cover breaches of duty without limit. Exclusions may become relevant in cases of intentional or grossly negligent breaches. This is precisely why documented, traceable governance is important.
At which levels does liability arise?
From corporate fines of up to EUR 35 million or 7 % of global annual turnover through personal and organisational liability to internal recourse.
| Level | Risk |
|---|---|
| Corporate fines | The EU AI Act provides tiered sanctions of up to EUR 35 million or 7 percent of global annual turnover. |
| Personal liability of board members | Through Section 84 AktG, Section 25 GmbHG and sectoral organisational duties, missing AI governance can become a duty-of-care issue. |
| Organisational and oversight duties | Boards and managing directors must create appropriate structures, monitor them and react to deviations. |
| Internal liability | Where culpable breach of duty causes damage, recourse questions against board members may arise. |
The strategic consequence: documented governance is not only a regulatory duty, but also personal liability protection. An institution that documents inventory, roles, controls, escalation and management reviews stands in a different risk position than one that does not actively monitor AI use.
Does not knowing protect against liability?
No. A common misunderstanding is: "We did not know that this system contains AI." As a control concept, that argument does not hold. Deployer duties assume that the institution knows, classifies and documents the AI systems it uses. Not knowing about vendor AI is therefore a governance risk and argues for a structured AI inventory.
CSRD / ESRS: When do AI bias risks become reportable?
If AI bias leads to material social impacts, discrimination cases or governance risks, this can also become relevant for CSRD / ESRS reporting. For management bodies, the key issue is not only technical AI compliance, but also whether policies, controls, due-diligence processes, incidents and measures can be reported and audited clearly. This presupposes that the institution is subject to reporting at all: Directive (EU) 2026/470 has limited the CSRD scope to EU companies with more than 1,000 employees and more than EUR 450 million net turnover; national transposition, transition years and group-level assessment must also be checked. The impact or risk must also be material – not every bias incident leads to an ESRS disclosure.
Where required governance measures are knowingly omitted, criminal-law aspects may need to be reviewed in addition to supervisory and civil-law questions. Such statements should not be assessed in general terms, but always through specialised legal advice in the concrete facts.
Ing. Mag. Patrick Eiler
Patrick Eiler advises banks and insurers in Vienna on regulatory reporting, data architecture and AI compliance. More than twenty years in banking, insurance and financial services; speaker at the Hypo-Verband (expert session of 23 September 2026).