01 · Problem
AI without accountability
Ungoverned AI creates concrete legal, operational and strategic risks that remain invisible – until they materialise. Three risk dimensions hit SMEs first.
| Risk dimension | Concrete consequence |
|---|---|
| Legal risk | Personal MD liability for breaches of EU AI Act and NIS2. Fines up to €35 M or 7 % of global annual turnover. |
| Operational risk | AI outputs without quality control. Wrong decisions in sales, HR or compliance. Data leaks due to insufficient access controls. |
| Reputational risk | Trust of customers, partners and investors damaged by uncontrolled AI use – particularly critical in B2B supply chains. |
Market reality
86 % of SMEs see AI as relevant, 43 % have no AI strategy, only 23 % deploy it effectively (DMB/Salesforce AI Index 2025). The gap between adoption and governance is wide – those who close it now secure a structural advantage.
02 · Regulation
What already applies today
Compliance is not a future task. Three regulatory developments already apply today – with direct consequences for SME managing directors.
| Effective date | Requirement |
|---|---|
| Since 2 February 2025 | Art. 4 EU AI Act: evidence of sufficient AI literacy for all AI-using employees. No transition period. |
| From August 2026 | High-risk AI obligations: transparency and documentation duties in HR, lending and safety-critical processes. |
| Ongoing | Disclosure obligation for chatbots and automated communication. Users must know they are interacting with AI. |
| Since December 2025 | NIS2 fully effective in Germany – personal MD liability down to private assets for in-scope sectors from 50 employees / €10 M turnover. |
Compliance as competitive advantage
AI compliance is not a bureaucracy topic. Building a governance framework now also creates the structures for scalable AI projects – and earns preferred status in supply chains and due-diligence processes.
Supply chain compliance
NIS2- and AI-Act-compliant companies are preferred as partners. B2B customers increasingly ask for evidence.
Investors and banks
AI governance is part of due-diligence. Without a framework, companies are considered higher risk.
Talent
Qualified employees prefer companies that use AI in a structured and responsible way.
Audit readiness
Documentation is in place before the audit – not produced in panic after it is announced.
03 · Governance model
Four dimensions that work together
An effective AI governance model is not a one-off event but a continuous steering loop across four dimensions.
Preventive
Guardrails before use
Roles and responsibilities, approval processes for new AI tools, data standards and no-go zones, written guidelines.
Proactive
Spot risks early
Track regulatory developments, identify sensitive use cases early, risk prioritisation, early-warning system.
Detective
Ongoing control
Usage and access monitoring, output reviews, audit trails for AI decisions, deviation reporting to the MD.
Reactive
Manage incidents
Escalation and shut-off processes for AI malfunctions, reporting channels to authorities (EU AI Act, NIS2), incident documentation and lessons-learned loop.
Without governance
- Every department decides alone – isolated solutions
- Compliance questions stop projects mid-rollout
- Audit requests trigger panic
- AI errors are barely noticed internally
With governance
- Clear roles – faster approvals
- Compliance is planned in from the start
- Documentation is already in place
- Deviations are detected and corrected early
04 · Implementation
Five steps to robust AI governance
AI governance does not need to be complicated. Five steps describe a pragmatic path that can be implemented in a few weeks for companies from 50 employees upwards.
- 01
Inventory (weeks 1–2)
Identify all active AI systems. Who uses what? Which data is processed? Result: an AI map as the foundation.
- 02
Risk classification (weeks 3–4)
Classify tools by EU AI Act risk levels: minimal, limited, high. Prioritise governance measures by risk level.
- 03
Roles and guardrails (weeks 5–6)
Define decision rights. Policy with approval processes, no-go zones and data standards. Internal AI coordinator.
- 04
Training and evidence (weeks 7–8)
Art. 4 AI Act requires demonstrable AI literacy. Run audience-specific trainings and document them.
- 05
Monitoring (from month 3)
Access controls, monthly MD review, escalation paths for incidents, early-warning signals integrated.
05 · Use cases
Use cases and their governance needs (quick overview)
Quick overview: different AI use areas need different guardrails. Four patterns cover the majority of SME use cases. Depth and use-case-specific checklists in the whitepaper „AI adoption for SMEs“.
Generative AI for knowledge access
Clear data permissions for internal assistants. Disclosure to users. Human approval for outbound communication.
Document and contract review
Audit trail for AI outputs. Data protection for external documents. Clear handover of responsibility between AI and reviewer.
AI in sensitive processes
HR, finance and compliance often fall under high-risk AI. Explicit documentation, regular audits, mandatory human final decision.
Workflow automation
Define error-escalation paths, monitor for exceptions, regularly review the automation logic.
Most common pattern of failed projects
In roughly half of the SME projects analysed by Resilience Bakery (n=18, 2023–2026) the same picture repeats: tools were introduced but the processes stayed the same. Data was available but decision paths did not use it. Governance closes exactly this gap – it connects tool, process and roles into a robust steering system.
06 · Case study
Machine builder with AI chaos
Industry: special-purpose machinery · 220 employees · project duration: 14 weeks. Starting point: twelve parallel AI initiatives without a shared structure. Approach: inventory, prioritisation, governance design, operational embedding, early-warning dashboard. Methodology: anonymised client report, project period Q3 2025, measurement after 6 months of operation against pre-project baseline.
fewer active AI pilots
Focus instead of fragmentation. Four prioritised use cases with clear ownership replace twelve competing initiatives.
AI Act compliance
All AI-using employees with documented evidence of literacy under Art. 4 EU AI Act.
higher adoption
In the prioritised processes – through clear roles, embedded approvals and visible MD commitment.
07 · Series & authors
About this whitepaper series
This document is part 2 of the Resilience Bakery whitepaper series on organisational resilience and AI in mid-sized companies.
Part 1
Organisational resilience
Six dimensions and the resilience trilemma as foundation.
Part 2
AI governance for SMEs
You are reading this part – regulation, four governance dimensions, 5-step path.
Part 3
Resilience maturity model
EFQM and TEMP framework, five levels from reactive to anticipatory.
Part 4
AI readiness
Six readiness dimensions and the path to impact.
Part 5
AI adoption for SMEs
Four phases, seven pitfalls, two case studies.
Authors
Malte Lohrberg & Ralf Metternich
Resilience Bakery supports mid-sized companies in organisational resilience and structured AI adoption – through diagnostics, advisory and training. Contact: lohrberg@resilience-bakery.de · LinkedIn: linkedin.com/in/maltelohrberg
All whitepapers
Overview of all parts and PDF downloads: resilience-bakery.de/en/whitepapers