Marcus Belke
CEO of 2B Advice GmbH, driving innovation in privacy compliance and risk management and leading the development of Ailance, the next-generation compliance platform.
The AI Regulation requires effective governance structures. AI systems must be identified, assessed, documented, and monitored. In addition, processes must be put in place to ensure an appropriate response to incidents. This ensures that AI—Compliance on an operational topic related to Data protection or information security. Unlike in these areas, however, many companies still lack the necessary organizational maturity. Yet this can be implemented today.
The Reality in Many Companies: Invisible AI
In business practice, a clear pattern emerges: The use of AI is growing rapidly, while governance is lagging behind. Most organizations underestimate not so much the relevance of regulation as the complexity of its operational implementation.
A key problem is that there is often no complete picture of the AI being used. In addition to official projects, numerous applications are developed in a decentralized manner—for example, through the use of SaaS solutions or generative AI in line-of-business departments. However, without a consistent inventory, there is no basis for any form of governance.
Furthermore, even well-known systems are often not systematically evaluated. Classification into regulatory categories is done on a case-by-case basis or is not done at all. As a result, it is unclear which specific requirements actually apply.
The lack of transparent decision-making processes is particularly problematic. In many cases, the use of AI is approved without a structured review. Documentation and responsibilities remain unclear. The result is governance that exists on paper but is hardly effective in day-to-day operations.
Reading tip: What Is Shadow AI in the Workplace, and How Can It Be Detected?
The Operational Gap: Why AI Guidelines Are Not Enough
The widespread assumption that an AI directive is synonymous with Compliance, proves to be deceptive in practice. Guidelines merely describe a target state. Governance, on the other hand, means actually implementing this target state in the company and ensuring it on a permanent basis.
The real challenge, therefore, lies in operationalization. While many organizations have guidelines in place, they lack consistent processes to ensure compliance. Decisions are made on an ad hoc basis, documentation remains incomplete, and there is no systematic monitoring during day-to-day operations.
In addition, responsibilities are often not clearly defined. Without clearly defined responsibilities, a structural vacuum arises: risks are identified but not consistently addressed. At the same time, there is a lack of established mechanisms for responding to incidents in a structured manner.
The result is a gap between regulatory requirements and operational reality. This gap cannot be closed by additional guidelines, but only by establishing robust processes.
Reading tip: What Is Shadow AI in the Workplace, and How Can It Be Detected?
Liability dimension of management when using AI
The AI Regulation is not directed specifically at individual members of management, but primarily at the respective companies in their role as providers, operators, or other market participants of AI systems. Anyone who violates key provisions of the regulation—such as the prohibitions in Article 5 or the operator obligations set forth in Article 26—must expect significant regulatory and financial penalties.
For board members and CEOs, the risk therefore lies primarily—and indirectly—in their duty to ensure that the company is properly organized. This includes, among other things, clear lines of responsibility, a comprehensive AI inventory, risk classification, approval processes, and a Documentation and effective control mechanisms. If such structures are lacking, this may not only represent an operational deficit, but also a liability-relevant organizational deficiency.
If a lack of AI governance results in damages to the company—such as fines, project cancellations, reversals, or costly remedial measures—the question of internal liability to the company may arise. In Germany, liability under Section 130 of the German Administrative Offenses Act (OWiG) may also apply if necessary supervisory measures are neglected and this specifically leads to violations within the company that are subject to fines.
The practical consequence is therefore that, although the AI Regulation does not create any completely new managerial liability, it does increase the requirements for proper organization and Compliance at management level. AI governance is therefore not an optional innovation topic, but a question of entrepreneurial diligence.
Governance as a workflow: a pragmatic approach
To close the operational gap, a shift in thinking is needed: away from static sets of rules and toward process-based governance. It is crucial that the use of AI be integrated into a clearly structured workflow.
The first step is to systematically identify all AI applications. Based on this, a consistent assessment is conducted that takes into account both regulatory requirements and operational risks. Decisions regarding their use are no longer made informally but are based on defined criteria and are documented.
These systems must be continuously monitored during operation. Quality, risks, and anomalies must be checked regularly. It is also essential to ensure that clearly defined response procedures are in place in the event of problems.
Such a workflow maps the entire lifecycle of AI—from implementation to decommissioning. It translates regulatory requirements into concrete operational processes, thereby laying the groundwork for transparent and robust governance.
Ailance AI Governance as a Solution for Businesses
The implementation of effective AI governance rarely fails due to a lack of will, but rather due to challenges in execution. This is exactly where Ailance AI Governance comes in.
Ailance AI Governance translates the regulatory requirements of the AI Regulation into concrete, actionable workflows. This creates a comprehensive system encompassing inventory, classification, approval, and monitoring, rather than a collection of isolated guidelines.
Companies therefore not only receive Transparency about their AI landscape, but also the ability to actively manage and mitigate risks. Compliance in everyday life.
The focus is deliberately on practice: there are clear responsibilities, structured processes and reliable evidence.
Ailance turns governance into a functional operating system for AI.
Marcus Belke is CEO of 2B Advice as well as a lawyer and IT expert for data protection and digital Compliance. He writes regularly about AI governance, GDPR-Compliance and risk management. You can learn more about him on his Author profile page.
Questions and Answers
Why aren't many companies yet operationally prepared for the AI Regulation?
In many companies, the use of AI is growing faster than the necessary governance structures. Often, there is no comprehensive inventory of the AI systems in use, no systematic risk classification, no documented approval processes, no clear lines of responsibility, and no ongoing monitoring of the systems.
Why Do Companies Need a Comprehensive AI Inventory?
An AI inventory creates Transparency about which AI applications are used within the company and in which departments they are deployed. Without this overview, companies can neither determine their regulatory role nor reliably assess, classify, document, and monitor the systems.
Why Isn't an Internal AI Policy Enough to Ensure Compliance?
An AI policy initially describes only how AI should be used within the company. Effective AI governance also requires specific processes for identifying, reviewing, approving, documenting, and monitoring AI systems during ongoing operations. Without such procedures, the policy often remains ineffective in day-to-day operations.
What responsibilities does senior management have regarding AI governance?
Board members and managing directors must ensure that the company is properly organized. This includes clear lines of responsibility, a comprehensive inventory of AI assets, transparent evaluations, approval processes, and effective control mechanisms. The absence of these structures may constitute an organizational deficiency that could give rise to liability.
What does a well-functioning AI governance workflow look like?
An effective workflow begins with the systematic inventory of all AI applications. The systems are then evaluated from both a regulatory and operational perspective, approved according to defined criteria, and documented in a traceable manner. During ongoing operations, risks, quality, and anomalies must be monitored, and response procedures for potential incidents must be established.
How does Ailance help companies comply with the AI Regulation?
Ailance AI Governance translates the requirements of the AI Regulation into actionable workflows. The platform helps companies with inventorying, classifying, and approving, Documentation and monitoring of AI systems, thereby establishing clear responsibilities and robust Compliance-Supporting documents.
German 
English 
Italian 
French