Your five-minute summary
Shadow AI is the norm, not the exception
Depending on the study, between half and more than 80 per cent of employees use AI tools without formal approval. According to Microsoft/LinkedIn, 80 per cent of employees in SMEs bring their own tools.
SMEs are particularly exposed
Only around 20 per cent of SMEs use AI actively and in a managed way, while their workforce has long been using the technology privately.
The legal framework already applies today
The AI literacy obligation (Art. 4 EU AI Act) has applied since 2 February 2025, regardless of the postponement of the high-risk obligations to December 2027.
The real bombshell: personal liability
Through the duty of legality and compliance (Section 43 GmbHG, the German Limited Liability Companies Act; Section 93 AktG, the German Stock Corporation Act) and the duty of supervision (Section 130 OWiG, the German Administrative Offences Act), an infringement passes through to management, right down to their personal assets.
Documentation determines liability
Anyone who cannot prove that they have informed, trained and managed their staff loses the protection of the business judgement rule in the event of a claim and bears the burden of proof themselves.
Hardly anyone points this out
The public debate revolves around productivity and innovation. That failing to address shadow AI leaves senior management personally exposed is still widely misunderstood among SMEs.
These six points are the summary. The full white paper puts every statement into its legal context, cites specific cases and provides a 10-point implementation plan, with every source individually referenced.
What the white paper covers
Nine chapters, from taking stock to a concrete action plan:
- What shadow AI is and how big the problem really is
- Why SMEs in particular are flying blind
- The legal framework: what the EU AI Act requires and when
- The second area of law: data protection and trade secret protection
- The real bombshell: the personal liability of management
- What happens when things go wrong: documented cases and costs
- Why nobody is properly pointing this out
- What managing directors now need to do: the 10-point plan
- Conclusion
Frequently asked questions
Is the white paper really free?
Yes. You can read it online or download it as a PDF without registering and without providing an email address.
Does the white paper replace legal advice?
No. It provides an accessible summary of the publicly documented legal position as at July 2026, but does not replace individual legal or tax advice.
How current and reliable is the information?
The information is current as at July 2026. Every key statement has been checked against at least one primary and one secondary source, and the full bibliography with more than 130 references is included in the document itself.
Who is the white paper for?
For managing directors and owners of small and medium-sized enterprises in Germany, Austria and Switzerland who want to know where their personal liability risk from AI use in their own business actually lies.
