Compliance - AI systems and cyber security

As a manager, you have strategic responsibility: you manage resources, priorities and business processes. At the same time, you are the central interface between operational business and supervisory authorities - making you a key figure in risk management. Every compliance breach has a direct impact on your company's image.

In the area of data protection, all measures must be verifiable - keyword accountability in accordance with Articles 5 and 24 of the GDPR. Set up a data protection committee or a data protection officer. Establish regular reports on incidents and audit results - ideally on a monthly or quarterly basis. Provide budget approvals to ensure data protection-compliant tools and external audits.

The NIS 2 directive requires the clear assignment of responsibilities for IT security and awareness. Managers should take part in annual cyber table tops in order to be prepared for crises. Cyber risk analyses must be carried out regularly and approved by management. If incidents occur, they must be escalated to the authorities and the supervisory board within 24 hours.

When using artificial intelligence, a distinction must be made between high-risk and standard applications. An AI steering committee is needed to approve new use cases. All AI models used must be documented and risk-assessed. Schedule regular audits and monitoring measures.

Data protection, cyber security and AI governance are interlinked. Findings from data protection or security incidents should flow directly back into AI governance. An annual review cycle with a focus on continuous improvement is recommended for all three areas.

Concrete to-dos for management: approve training and budget planning, define reporting KPIs such as incident figures or response times, participate in governance committees and regularly communicate compliance results internally.