{"id":70960,"date":"2026-10-28T14:11:34","date_gmt":"2026-10-28T13:11:34","guid":{"rendered":"https:\/\/www.usd.de\/?p=70960"},"modified":"2026-10-28T14:11:36","modified_gmt":"2026-10-28T13:11:36","slug":"ai-governance-managing-ai-securely","status":"publish","type":"post","link":"https:\/\/www.usd.de\/en\/ai-governance-managing-ai-securely\/","title":{"rendered":"AI Governance: How Companies Maintain Control Over AI"},"content":{"rendered":"\n

Artificial intelligence (AI<\/a>) is evolving from an experiment into an integral part of everyday work at many companies. Business units are identifying new use cases, the first production systems are emerging, and the desire for greater efficiency is strong.<\/p>\n\n\n\n

As AI moves into production, the need for governance grows: Companies must continuously keep track of use cases, responsibilities, and risks.
AI governance<\/a> describes the organizational framework companies use to make the use of AI transparent, traceable, and controllable.<\/p>\n\n\n\n

Andr\u00e9 Hanke and Maximilian M\u00fcller addressed precisely this tension in a webinar on the practical implementation of AI governance. One point became clear: Many challenges do not arise until AI applications are in production.<\/p>\n\n\n\n

<\/div>\n\n\n\n

The Real Challenge Begins After Go-Live<\/h2>\n\n\n\n

Many companies are currently investing a great deal of time in selecting suitable AI solutions. The more difficult questions often arise only during ongoing operations.<\/p>\n\n\n\n

Are results still being generated reliably? Have data sources or permissions changed? And what are the consequences if an AI application makes incorrect statements?<\/p>\n\n\n\n

A publicly reported case involving a customer chatbot illustrates this issue. The case was caused neither by a cyberattack nor by deliberate manipulation of the system. The company had not ensured that the chatbot\u2019s responses were consistent with the applicable policies.<\/p>\n\n\n\n

The damage resulted from a lack of governance.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div>\n\n\n\n
\n
\n

People will use AI if they see value in it for their work. The question is therefore not whether that will happen, but whether companies create safe and practical conditions for it.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Maximilian M\u00fcller, Principal usd Security Consulting | AI Governance<\/em>, usd AG<\/sub><\/p>\n<\/blockquote>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n\n\n\n

Why the Use Case Is Critical to AI Governance<\/h2>\n\n\n\n

The example shows that AI governance goes far beyond technical questions. Companies must understand where and for what purpose AI is used, what risks arise from the specific context of use, and how those risks can be managed over time.<\/p>\n\n\n\n

The EU AI Act further increases the pressure to act. A central premise of the law is crucial here:<\/p>\n\n\n\n

The regulatory classification of an AI system depends on what it is used for and the context in which it is used<\/strong>.<\/p>\n\n\n\n

The same AI service can trigger very different requirements depending on how it is used. An AI system used to summarize meeting notes is not critical. However, if the same language model is used to screen job applications, it is a high-risk system subject to correspondingly extensive obligations. Companies therefore need not only an overview of the AI tools they use, but also transparency into their actual AI use cases. This transparency is the prerequisite for assessing risks and deriving appropriate controls.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Why Traditional Risk Management Alone Is Not Enough<\/h2>\n\n\n\n

Existing governance, risk management, and ISMS processes provide an important foundation for AI governance. However, AI systems introduce additional challenges that companies must take into account in these processes.<\/p>\n\n\n\n

Model updates, changes to data sources, and new integrations can affect the results of an AI system. The risk profile of an AI system therefore arises from the entire context of use:<\/p>\n\n\n\n