What management owes when deploying AI
Introducing an AI system is a business judgement. It is protected in liability terms, but only where it rests on adequate information and the results are reviewed afterwards.
Introducing an AI system is a business judgement, and business judgements enjoy a measure of protection from liability. That protection comes with one condition: the decision has to have been prepared.
Three duties that cannot be delegated away
- Prepare the decisionWhat is the system for, where are its limits, what alternatives were there? Without answers there is no adequate basis of information, and that basis is what the protection rests on.
- Supervise operationA system once approved does not stay what it was. Models are updated and data shifts. Not looking again breaches a continuing duty.
- Review the outputResponsibility for a decision stays with the person taking it. Anyone adopting an output unchecked cannot later point at the system.
What belongs in the file
- The purpose of the system and the area in which it is used
- Known limits and how they are handled
- Alternatives considered and the reason for the choice
- Responsibility for approval, operation and switching it off
- Rules for reviewing the output in the department using it
- Points in time at which the decision is looked at again
How we help
We prepare the decision so that it meets the requirements and put it in a form that still makes sense years later. That includes the responsibilities and the point at which a decision comes back on the table.
AI project awaiting approval?
We prepare the decision so that it meets the requirements, and record what it rests on.
Get in touchFrequently asked questions
Are directors personally liable for errors of an AI system?
Not for the error itself, but for breaching their own duties of care. Sections 43(2) GmbHG and 93(2) AktG create personal liability towards the company. The allegation is then not that a system got something wrong, but that it was introduced without adequate preparation or run without supervision.
Does the business judgement rule protect us?
It protects the decision, not the absence of preparation. It requires management to act on the basis of adequate information for the good of the company. Introducing a system without knowing its limits removes that basis, and the protection falls away with it.
Can we delegate this to IT?
The execution yes, the responsibility no. Delegation only relieves you where selection, instruction and supervision were careful. With AI there is a further point: the substantive assessment does not sit in IT. Whether an output is defensible is decided by the department that uses it.
Who has to prove what in a dispute?
The management. Under section 93(2) sentence 2 AktG a board member bears the burden of showing that they applied the care of a prudent and conscientious manager, and the same allocation applies to a GmbH. In practice that means your own documentation is not merely helpful, it is what makes a defence possible at all.
Is there an accepted standard for reviewing an AI output?
Not a dedicated one. The Federal Court of Justice has not developed criteria for AI-supported analysis, so the literature falls back on the ISION principles developed for external human advice, meaning a complete presentation of the facts, the independence and expertise of the adviser, and a plausibility check. How far those standards transfer to a technical system is open. The plausibility check should apply in any event.
What should we document?
The decision and its basis. Which alternatives were considered, which risks were known, what was done about them, and who reviews the results. In a dispute those records are the only thing that evidences the care taken.