AI Literacy Training

🖱️ Interaktiv: Ziehen zum Drehen · Lektion 8

Learning objectives

After this lesson you will be able to:

Build an AI governance structure for your organization
Define roles and responsibilities for AI topics
Implement approval processes for new AI tools
Run compliance monitoring and internal audits

What is AI governance?

AI governance covers the structures, processes and policies that ensure AI systems are used responsibly, legally and with low risk in an organization.

The goal is not to prevent AI, but to steer its use so that opportunities are seized and risks minimized.

The AI policy

An AI policy is the central document of AI governance. It regulates:

Scope: who does the policy apply to? (All employees, contractors)
Approved AI tools: whitelist of approved AI systems
Prohibited use: what is not allowed? (Personal data, critical decisions)
Data protection requirements: which data may be entered into AI tools?
Quality assurance: how is AI output reviewed?
Labeling obligations: when must AI use be communicated?
Training obligation: which training is required?
Incident reporting: how are incidents reported?
Responsibilities: who is accountable for what?
Sanctions: what happens in case of violations?

💡 The AI policy is not a one-time document

A good AI policy is alive: it is updated regularly (at least annually), adapted to new AI developments and communicated to all employees. Best kept as a wiki page, not a dusty PDF.

Roles and responsibilities

AI officer

Responsible for the strategic steering of AI use. Accountable for policies, training, audits and communication with authorities. This role can be taken on by an existing position (data protection officer, compliance).

AI committee

An interdisciplinary body from IT, legal, data protection, compliance and business departments. Decides on approvals of new AI tools and handles escalations.

Department representatives

Each department (HR, marketing, sales) names a contact person for AI topics. This person knows the AI tools in their area and is the point of contact for questions.

📝 Schnellprüfung

Which role is responsible for the strategic steering of AI use?

The approval process for AI tools

Before an AI tool may be used in the company, it goes through an approval process:

Stages of the approval process

Request: the business department reports a need
Initial review: IT checks technical requirements (interfaces, security)
Data protection review: data protection checks GDPR compliance (DPA, server location, data categories)
Risk assessment: classification by EU AI Act risk classes
Legal review: compliance checks the legal framework
Decision: the AI committee or AI officer approves or rejects
Integration: IT sets up the tool (with security configuration)
Training: employees are trained
Monitoring: regular review of usage

🏢 Praxis-Szenario: Approving a new AI tool

The marketing department wants to introduce an AI tool for automatic social media planning. The tool promises to create posts automatically and publish them at the optimal time. It would access customer data. How do you proceed?

Compliance monitoring

Regular reviews

Interval	Measure
Monthly	Review usage statistics, record new AI tools
Quarterly	Update the AI inventory, check training progress
Semi-annually	Update risk assessments, review policies
Annually	Full AI audit, policy update, refresher training

What is audited?

Completeness of the AI inventory: are all AI systems recorded?
GDPR compliance: are DPAs in place? Are data rights respected?
Art. 4 compliance: have all employees been trained?
Policy compliance: do employees follow the AI policy?
Incident history: have incidents been documented and resolved?

The emergency plan for AI incidents

An organization needs an emergency plan for AI incidents:

Detection: how is an AI incident detected? (Monitoring, employee reports)
Assessment: is it a reportable incident?
Escalation: who is informed? (AI officer, management, data protection)
Response: what measures are taken? (Stop the system, contain damage)
Documentation: what happened? What was done?
Follow-up: how is the incident resolved? What measures prevent recurrence?

💡 AI governance is a competitive advantage

Companies with good AI governance are not just compliant — they can introduce AI faster and more safely than competitors. Governance builds trust with customers, employees and supervisory authorities.

Summary: the AI governance roadmap

Create and publish the AI policy
Record the AI inventory (all AI systems)
Conduct Art. 4 training (AI literacy)
Name the AI officer
Establish the approval process for new AI tools
Set up compliance monitoring
Plan the annual refresher

✅ Wichtige Erkenntnisse

Haken setzen, um deinen Lernfortschritt zu markieren:

→ Go deeper: AI tools at work — concrete usage policies for tools · Liability & compliance — incident reporting and fines

AI Governance in the Enterprise