{"id":1737,"date":"2025-12-27T13:01:47","date_gmt":"2025-12-27T12:01:47","guid":{"rendered":"https:\/\/auranexus.ai\/ai-governance-thought-pragmatically\/"},"modified":"2026-02-19T21:22:57","modified_gmt":"2026-02-19T20:22:57","slug":"ai-governance-thought-pragmatically","status":"publish","type":"post","link":"https:\/\/auranexus.ai\/en\/ai-governance-thought-pragmatically\/","title":{"rendered":"AI Governance Thought Pragmatically"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

A pragmatic approach to AI governance:
As much structure as necessary, as little as possible<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Too few rules create risk. Too many rules kill usage. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The Dilemma of AI Guidelines\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

36% of German companies are already using AI, almost twice as many as in the previous year. However, according to Bitkom<\/a>, 53% see legal hurdles as the biggest obstacle, and 76% complain about uncertainty due to legal ambiguities. This gap between use and control is the biggest unsolved problem of the digital transformation in Germany. <\/p>

The figures become even clearer: According to KPMG<\/a>, 69% of German companies have an AI strategy, but only 26% have established a company-wide Trusted AI Governance. And according to a CyberArk study<\/a>, 66% of German companies do not have complete control over unauthorized AI tools. <\/p>

Most companies are stuck in a dilemma. Either they have no rules and risk data leaks, compliance violations and reputational damage. Or they have rules that are so complicated that nobody follows them. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Why classic governance models fail with AI\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Classic IT Governance works according to a proven pattern: A central team defines rules, releases technologies and monitors usage. With AI, this model fails in three areas. <\/p>

The speed is not right.<\/strong> While IT Governance approves over months, employees have long been experimenting with new AI tools. According to the Zendesk CX Trends Report<\/a>, 49% of service employees are already using external generative AI tools, compared to only 17% in the previous year. Usage has almost tripled. And according to Bitkom<\/a>, 10% of employed people use AI specifically without the knowledge of their employer, a doubling within a year. <\/p>

The control does not take effect.<\/strong> According to the KPMG\/University of Melbourne study<\/a>, 57% of employees worldwide secretly use AI tools. In German authorities, the problem is particularly acute: A Microsoft\/Civey study<\/a> shows that 45% of employees at the federal level use unapproved AI tools. These are not malicious actors, but people who want to get their work done. <\/p>

The responsibility is unclear.<\/strong> AI systems do not make decisions, they provide recommendations. But who is responsible if the recommendation is wrong? The employee who adopted it? The IT department that released the tool? The specialist department that defined the use case? According to Bitkom<\/a>, only one-fifth of German employees have received AI training so far, seven out of ten have never received a training offer. <\/p>

The consequence is measurable: According to CyberArk<\/a>, 41% of German companies actively use AI tools that have not been officially approved. At the same time, 94% are already using AI and large language models. The gap between usage and governance is growing. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

The most common exaggerations in AI guidelines\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The reaction of many companies to these risks is more regulation. But that’s exactly what exacerbates the problem. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Exaggeration 1: General Prohibitions.<\/strong> After initial data protection incidents, many German corporations reacted with blanket AI bans. The result? Employees resort to private accounts. The Zendesk CX Trends Report<\/a> shows: Shadow AI usage has almost tripled from 17% to 49%. Matthias G\u00f6hler, CTO EMEA at Zendesk, warns: “It endangers data security when confidential customer information gets into unauthorized systems.” <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Exaggeration 2: Legal Perfection.<\/strong> Some AI guidelines read like legal texts: comprehensive, watertight, incomprehensible. According to Zendesk<\/a>, 65% of CX executives see more AI transparency as necessary, and 83% name data protection and secure AI implementation as top priorities. But the complexity of the requirements overwhelms many companies. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Exaggeration 3: Governance Theater.<\/strong> According to Bitkom<\/a>, only 23% of German companies have established rules for AI use (previous year: 15%). But paper does not change behavior. At the same time, shadow AI is spreading: In 8% of companies it is already widespread (previous year: 4%), in another 17% there are individual cases. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Exaggeration 4: Too many approval levels.<\/strong> If every AI use case has to go through five departments, one of two things happens. Either the approval takes so long that the project becomes irrelevant. Or the employees bypass the system completely. In Germany, the economy is therefore demanding clear consequences: According to Bitkom<\/a>, 91% of industrial companies say that politics should not stifle AI innovations through over-regulation. And 46% of companies are calling for a reform of the EU AI Act. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

The 5 Governance Building Blocks with Real Benefits\n<\/h3>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Effective AI Governance is not a set of rules, but a manageable framework. The concept of “Minimum Viable Governance”<\/a> describes what actually works: essential controls that enable rapid innovation without ignoring risks. <\/p>

Five building blocks form the foundation.<\/p>

A recent study by the Cloud Security Alliance<\/a> from December 2025 confirms: Companies with mature governance are almost twice as likely to be early adopters of Agentic AI (46%) as those without clear guidelines (12%). Governance does not slow down, it accelerates. <\/p>

1. Permitted Use Cases<\/h3>

Instead of forbidding everything and then approving exceptions, the opposite works better: A clear list of permitted use cases with defined limits.<\/p>

What belongs to it:<\/strong><\/p>