In most companies AI adoption has by now become a programme with its own budget, its own owners and a growing number of productive applications. What stands out is how blurred the division of roles at the top often remains. Either the supervisory board treats the topic as an IT matter and stays out of it, or the management board delegates not only the implementation but also the decisions to the CIO or Chief Digital Officer. Both create a gap that only becomes visible when something goes wrong. This article describes how leadership and oversight in AI adoption can be cleanly separated and connected.
Adoption is a leadership task of the management board
The management board manages the company under its own responsibility, as section 76 of the German Stock Corporation Act states, and the same applies in substance to the managing directors of a GmbH. The implementation of AI initiatives can and should be delegated. The decisions that change the risk profile and the capital commitment of the company cannot. Added to this is the business judgment rule: an entrepreneurial decision is protected only if it was taken on the basis of adequate information. For AI decisions this means that the information basis must be documented before the decision is taken, not afterwards.
In concrete terms, four decisions rest with the management board. First, ambition and priorities, meaning where AI is to contribute to results and where deliberately not. Second, risk appetite, in particular the question of in which processes systems may act without human approval. Third, platform and partner decisions, because they create dependencies lasting years. Fourth, organisation and enablement, meaning who owns productive systems and which competence is built for that. Everything else can be delegated, these four points cannot.
The supervisory board oversees, and for that it needs information
The supervisory board oversees management, and it can only oversee what it sees. In many companies the reports of the management board under section 90 of the Stock Corporation Act have so far covered AI only in passing, usually as a list of use cases in a strategy presentation. That is not enough to judge whether the management board is steering the topic. A sensible step is to extend the information rules by four items: a register of productive AI systems with risk classification, the status of investments and their impact against plan, relevant incidents and near misses, and the status of regulatory implementation.
What matters is less the volume than the regularity. A compact quarterly report, plus ad hoc information on incidents, is sufficient in most cases. The guiding question for its design is: can the supervisory board judge on this basis whether the management board has taken the four core decisions and whether implementation follows them? If the answer is no, the report is either too technical or too promotional, and in both cases it misses its purpose.
Where AI belongs in the governing bodies
The question of whether AI needs a committee of its own is asked often and usually answered too early. For the risk side there is a natural home: under section 107 of the Stock Corporation Act, the audit committee deals with the effectiveness of the internal control system and the risk management system, and AI risks belong exactly there. The strategic side, meaning ambition, priorities and capital, belongs in the full board. A dedicated AI committee makes sense when AI changes the business model at its core. Otherwise there is a risk that the topic disappears into a committee instead of becoming effective in existing structures.
The audit committee has a tool here that is rarely used: its connection to internal audit and the statutory auditor. AI controls can be included in the internal control system, and results of independent assessments, for example from red teaming engagements, are robust evidence of their effectiveness. The supervisory board can request this evidence, and it should, because it says more about actual steering than any presentation.
Competence within the supervisory board
The German Corporate Governance Code provides for a competence profile that guides the composition of the supervisory board. Many profiles now include digitalisation, AI as a field of its own less often. The aim is not for every member to become a specialist. The body as a whole must be able to ask the right questions and put the answers into context. A targeted briefing is often enough for this, ideally held together with the management board so that both bodies speak on the same basis.
Five questions serve as a touchstone that a supervisory board should be able to ask. Which systems at our company act without human approval? What would be the most expensive realistic failure of one of these systems? Who is personally accountable for it? How do we know that the systems do what they are supposed to do? And what happens if a central vendor fails or discontinues its offering? A board that can ask these questions and assess the answers oversees effectively without interfering in management.
Conclusion and recommendation
AI adoption needs clear roles at the top, not more committees. For the next ninety days we recommend three steps. First, take the four core decisions on ambition, risk appetite, platform and organisation as explicit management board resolutions with a documented information basis. Second, extend the information rules of the supervisory board by an AI register, investment status, incidents and regulatory status, and assign AI risks to the audit committee. Third, review the competence profile of the supervisory board and schedule a joint briefing for both bodies.
ECODYNAMICS advises management and supervisory boards at exactly this interface as part of AI Executive Advisory. We structure the decisions that rest with the management board, develop a reporting format for the supervisory board and run joint briefings for both bodies. For supervisory board members who want to sharpen their own judgement, the C-Level & Executives AI Masterclass offers a compact introduction in a closed setting. If AI so far only appears as a list of applications in your supervisory board, get in touch.