AI Reporting Lines in DACH: Who Reports What to the Supervisory Board?

# AI Reporting Lines in DACH: Who Reports What to the Supervisory Board?

The missing layer is rarely another title. It is the reporting contract: who reports which AI fact to whom, through which organ line, and which trigger turns routine into ad-hoc escalation?

Christian Pobbig and Beyond Chiefs work from Hamburg on AI Executive Search in DACH. This piece turns Germany’s dual-board architecture into a usable information model — not a job description and not a director-liability essay.

The missing layer is the reporting contract, not another title

Most houses can say AI is a board topic. Fewer can answer in one sitting: which owner supplies the signal? Who challenges the signal? Which management-board decision accepts it? Which path reaches the supervisory board — on the clock or on an important occasion?

Without those answers, governance is décor. With them, every material AI situation becomes legible: owner, decision, recipient, escalation.

German AG default: the Vorstand informs; the Aufsichtsrat supervises — it does not run AI

The Vorstand reports to the Aufsichtsrat on intended business policy and planning, profitability, the course of business and the company’s position, and transactions of material significance for profitability or liquidity (§ 90 AktG).

The Aufsichtsrat supervises management. It may inspect books and records and appoint experts. Management measures cannot be transferred to it (§ 111 (1) and (4) AktG). The supervisory board is therefore not the operating AI owner.

The German Corporate Governance Code makes the communication logic explicit: informing the Aufsichtsrat is the Vorstand’s task; the Aufsichtsrat must ensure it is adequately informed. The Vorstand reports regularly, promptly and comprehensively on strategy, planning, business development, risk position, risk management and compliance, and explains deviations from plans and targets (DCGK 2022, Principle 16). Important events go immediately to the chair (Principle 17). The Code is principles and recommendations (comply-or-explain) for listed / capital-market companies and orientation for others.

Map AI facts into § 90 buckets — do not invent a parallel AI statute

BC translation (INFERENCE — labelled) — not a freestanding “quarterly AI report” legal duty:

| § 90 bucket | Typical AI content (when material) |
|---|---|
| No. 1 planning / policy | AI strategy, investment plan, material plan deltas |
| No. 2 profitability | material AI-driven P&L / liquidity exposure in the annual-accounts meeting |
| No. 3 course of business (≥ quarterly) | running deployment and risk posture — inside the existing quarterly architecture, not as a freestanding statutory AI duty |
| No. 4 material transactions | commitments of material significance, in time for the Aufsichtsrat to comment |
| Important occasion → chair | material incidents, model failures, regulatory contacts — per GO / materiality criteria |

The Aufsichtsrat may demand a report at any time; an individual member may demand a report to the Aufsichtsrat — not a private side channel (§ 90 AktG).

Four lanes: owner → control → Vorstand decision → supervisory route

BC operating model (INFERENCE):

1. Operating signal — business / AI owner: what is deployed, for which outcome, with which risk class and human control?
2. Control challenge — risk / compliance / legal / DPO / CISO / internal audit: is the record credible? Dissent is logged.
3. Vorstand decision — deploy / tolerate / remediate / pause / escalate; minutes.
4. Supervisory oversight — routine via the Vorstand report; ad-hoc to chair / committee / full board per GO criteria.

Default in a German AG: the routine line runs through the Vorstand to the Aufsichtsrat. A direct CIO / CISO / AI-lead channel to the Aufsichtsrat may be an internal design — it is not a universal statutory requirement.

Routine vs ad-hoc; committee routing as company design

Routine: material AI posture rides inside the existing § 90 architecture and the DCGK information style. The cadence of an internal “AI packet” is internal governance, not invented law.

Ad-hoc: materiality under the rules of procedure / criteria → immediately to the Vorstand → then, when criteria are met, to the chair, a committee, or the full Aufsichtsrat. The DCGK practice impulse on AI (March 2026) asks the Aufsichtsrat to accompany the Vorstand on strategic AI use and to ensure adequate AI governance / oversight of AI Act compliance — explicitly non-binding (DCGK Praxis-Impuls KI). Information depth for the Aufsichtsrat need not match Vorstand detail; informal AI use can outrun reported use — the Vorstand steers, the Aufsichtsrat accompanies.

Committees (audit, risk, tech) are the company’s routing choice — not an AI Act org chart.

Reporting packet (practice, not law)

Seed for page one of a Vorstand / Aufsichtsrat packet — BC practice, not a regulator checklist:

- inventory delta and reclassifications
- material incidents / near misses
- open control exceptions
- oversight failures
- vendor / model dependency
- regulatory contacts / deadlines
- decisions requested; owner, due date, residual risk

Technical telemetry belongs in an appendix. Decision, exposure, trend, and the asked-for action belong on page one.

As practitioner support (not statute): the Audit Committee Institute recommends that the Aufsichtsrat regularly have the Vorstand report which AI systems are used or developed where, through which processes and measures compliance is ensured, who the main responsible persons are — and material violations (ACI Quarterly extra 2025 AI).

What is not required

- no “CAIO reports to the Aufsichtsrat” rule from the AI Act
- no universal statutory direct CISO / CIO line to the Aufsichtsrat
- no Aufsichtsrat as operator of the AI programme
- no freestanding legal duty for a “quarterly AI report” beside § 90 (2) No. 3
- no AI Act org chart for the German AG

AI Act duties explain why risk and control evidence must reach the responsible organs. They do not replace § 90 and § 111. Literacy proof packs and “whom the organ names as Träger” belong on other pages — not here.

DACH note: Germany is the legal anchor

This text anchors the German AG. For a GmbH, Geschäftsführung is the management route — a Beirat / Aufsichtsrat only if established, under different logic. Austria and Switzerland are analogies, not copy-paste statutes (Verwaltungsrat ≠ Aufsichtsrat).

FAQ

### Must AI go to the Aufsichtsrat every quarter?

§ 90 (2) No. 3 requires regular, at least quarterly, reporting on the course of business. AI content rides there when material — that is not a freestanding quarterly AI duty.

### Can the Aufsichtsrat demand AI reports at any time?

Yes. The Aufsichtsrat may demand a report at any time; a member may demand a report to the Aufsichtsrat (§ 90 AktG).

### May the Aufsichtsrat take AI operating decisions?

Management measures cannot be transferred to it (§ 111 (4) AktG). Consent reservations for defined transactions are possible — running the AI organisation stays with the Vorstand.

---

Draft inventory. Not live. No service CTA.