KI-Governance in companies | article 1
In conversations with executives, I encounter the same thing time and again: AI has long since arrived in the company—whether management realizes it or not. In the SME sector, this often happens quietly, gradually, and without a plan. This is not a technology problem; it is a leadership problem. In this series, I explore what this means for you as a leader—drawing on my own experience.
THE REALITY FOR SMES: AI IS COMING – PLANNED OR NOT
Large companies have long since established AI strategies, Chief AI Officers, and dedicated project teams. In the SME sector—and even more so in smaller businesses—the reality is usually quite different: a marketing employee uses ChatGPT to draft text; the sales team experiments with AI-powered email tools; IT tests a coding assistant. And management? They are often completely unaware of any of this.
This is not a criticism of the employees—quite the opposite. Anyone using AI to work more efficiently is showing initiative and thinking like an entrepreneur. The problem lies elsewhere: the framework is missing. The strategy is missing. And there is a lack of responsibility from the top.
While some companies are beginning to deploy AI strategically, uncoordinated usage is emerging in many other organizations—bringing both risks and missed opportunities. This is precisely where the question of leadership arises. Companies that manage AI deliberately gain not only security but also speed and competitive advantages.
Why is this still not happening in many companies? The reasons are understandable: a lack of resources, a lack of direction in the rapidly growing AI market, and insufficient knowledge regarding the legal framework—specifically the EU AI Act and the GDPR. Added to this is another, often underestimated gap: even the company’s top experts know their core processes inside out, yet rarely have a clear enough picture of what AI can achieve today—or where its limitations lie. Consequently, neither the right questions nor the right use cases emerge.
THE LEADERSHIP VACUUM: WHEN NO ONE IS AT THE HELM
What emerges instead is not a new phenomenon—I speak from experience here: technologies that spread “from the bottom up” within a company, long before management even becomes aware of them. Many know this as “shadow IT”—employees using personal tools and systems because official solutions were too slow, too cumbersome, or simply non-existent. Today, we are seeing the same thing with AI. Let’s call it what it is: shadow AI.
What appears harmless—or even innovative—at first glance has far-reaching consequences. Employees using AI tools without training or guardrails are often unaware of the data they are exposing in the process. Personal customer data, contract details, and internal metrics can all end up in AI systems without anyone knowing exactly what happens to them. Moreover, since employees frequently use personal accounts with major AI providers like OpenAI, Anthropic, or Google, the company often lacks any control over how that data is stored or processed.
What experts call the “black box effect” makes the situation particularly tricky: what goes into the system and how it is processed is often neither transparent nor easily controllable for the company. For me, this is not an abstract risk; it is a concrete liability issue that ultimately lands on the managing director’s desk.
There is another risk, too, which I consider just as dangerous: the uncritical acceptance of AI-generated results simply because an employee trusts the system. AI hallucinates—this is not a bug, but a structural characteristic of current language models. Anyone unaware of this—or who ignores it—risks flawed analyses, a faulty basis for decision-making, and, in the worst-case scenario, legal or reputational consequences for the company.
And finally: fear. Many employees fear being replaced by AI. If the company does not communicate a clear stance on this, rumors, reluctance, and active resistance arise. This, too, is a leadership task—not an HR task, nor an IT task.
THIS TOPIC BELONGS TO THE CEO – NOT THE IT DEPARTMENT
In many companies, the topic of AI reflexively lands on the IT department’s desk. That is understandable—but wrong. The consequences of uncontrolled AI usage are strategic, legal, and cultural in nature—and therefore a matter for top management.
It is strategic because AI has a decisive influence on how a company remains competitive in the future. Those who do not actively shape AI leave the outcome to chance—or to the competition.
From a legal standpoint, because violations of the GDPR or the EU AI Act do not stop with the individual employee but extend to the managing director. Ignorance is no defense against penalties in this regard.
It is a cultural issue, because how a company handles AI is a matter of trust, a willingness to change, and strong leadership. The IT department cannot deliver this—it has to come from the top.
Properly implemented AI governance leads to faster decisions, clearer responsibilities, reduced uncontrolled proliferation, and better prioritization of use cases—ideally aligned with corporate strategy.
AI governance does not mean controlling every step from the top down. It means establishing a framework: Who is permitted to use which tools? What data may be fed into AI systems? How are results critically evaluated? Which use cases are prioritized? And how does the company communicate openly and honestly with employees about the intended direction?
Anyone who does not actively answer these questions answers them anyway—only without a strategy and without control.
CONCLUSION: AI GOVERNANCE BEGINS WITH A DECISION
AI is not an IT project. AI is a business transformation—and every transformation requires leadership. Not at some later point, once the strategy is finalized. But right now, while AI is already underway. In your company. Whether you realize it or not.
The first step is not the perfect strategy. The first step is the conscious decision: this topic belongs on my agenda.
The good news: You don’t have to become an AI expert.
But you do have to decide who holds the helm at your company—you or chance.
WHAT TO EXPECT IN THIS SERIES
In the upcoming articles in this series, I will examine what AI governance means in practice—specifically, pragmatically, and in the language of leadership rather than IT. We will discuss what happens when AI enters a company unplanned, why AI adoption is primarily a matter of leadership, why the CEO retains responsibility even when a machine makes the decision, and why simply waiting is not an option: AI has already arrived in the enterprise—and the market will not grant us the time we might still think we have.
The topic of the next article will be: “Shadow AI in the Enterprise: Why Unplanned AI Usage Becomes a Leadership Trap?”
What is the situation in your company? Do you know today where and how AI is already being used—even without your knowledge? I look forward to exchanging views.
WHO THIS SERIES IS RELEVANT FOR
This series is aimed at CEOs, board members, advisory board members, and executives who do not want to reduce the handling of AI to a purely IT issue. It is particularly relevant for companies where AI is already being used in specific areas without clearly defined roles, responsibilities, and guidelines.
Especially in medium-sized companies, this quickly creates a complex mix of opportunities, uncertainty, and pressure to act. That is exactly where leadership is needed—not later, but now.
About the Author
He guides management teams, executive boards, advisory boards, and leadership teams in consciously shaping their roles, effectively leading change, and positioning their organizations for the future amidst the complex interplay of digitalization, artificial intelligence, and regulation. His approach combines business practice, strategic thinking, and personal reflection—with a clear focus on sustainable impact.
