AI governance at German utilities: who registers, classifies and approves
79 percent of German energy companies have introduced AI, and one in four has an AI roadmap. From 2 December 2027 the deployer obligations in Art. 26 of the AI Act apply to high-risk systems on top. A board isn't required by the regulation. Named people, an approval path and a register are needed anyway by any utility that wants to answer the supervisor.
AI governance at an energy utility is the set of roles, approval path and AI register with which a municipal utility or grid operator decides which AI runs, who is responsible for it and why it is classified as it is. Two events trigger it in Germany: the KI-MIG, which has made the Federal Network Agency (Bundesnetzagentur) the market surveillance and fining authority for the AI Act since 29 July 2026, and the deployer obligations in Art. 26 for high-risk systems under Annex III from 2 December 2027. The regulation requires neither an AI officer nor a board, but deployers of such systems must name oversight staff, keep logs for at least six months and inform worker representatives before use. Breaches of Art. 26 can be fined up to 15 million euros or 3 percent of worldwide turnover. A municipal utility below 100,000 customers can often run one board for the whole company; in a group, approval of grid AI has to respect the grid company's decision rights under Section 7a of the Energy Industry Act (EnWG).
What changed on 29 July
No new obligations. An address. Since 29 July 2026 the Federal Network Agency has been the competent market surveillance authority for the AI Act under Section 2(1) of the KI-MIG, Germany's act implementing the regulation. Complaints go there, and under Section 17 it also imposes the fines.
Its powers come from Section 11, which refers to the EU Market Surveillance Regulation (EU) 2019/1020: requesting documents, entering business premises during normal business hours, testing systems. How the act came about and what the supervisor can actually check is covered in our piece on the KI-MIG and the Federal Network Agency as AI supervisor.
For the organisation this means something simple. A usage policy that nobody ever checked now meets someone who can ask. Rarely will the first question be a legal one. It'll be: which AI runs here, and who decided that?
PwC's study of the energy industry, reported by the trade paper ZfK on 13 April 2026, supplies the first two figures; the third comes from the Digital@EVU 2026 study by BDEW, VSE, Kearney and IMP³ROVE. Lots of AI in the building, little order around it. For a supervisor, that's the least comfortable combination.
Three parts of the regulation already apply: AI literacy under Art. 4, since 27 July 2026 in the softer wording of Regulation (EU) 2026/1744, the prohibitions in Art. 5, and the transparency duties in Art. 50 since 2 August 2026, for example for the chatbot in the customer portal. That same Digital Omnibus pushed the high-risk obligations for Annex III back to 2 December 2027.
What the regulation requires, and what it doesn't
No organisational form is laid down in the AI Act. Outcomes are, and each one needs an owner.
Asked whether an AI officer along the lines of the GDPR's data protection officer, or an AI governance board, is needed, the Commission's questions and answers on AI literacy are short: "No, no specific governance structure is mandated to comply with article 4 of the AI Act." Training certificates aren't needed either; an internal record is enough. And the new wording of Art. 4 says explicitly that nobody has to guarantee a particular level of literacy for any individual.
Art. 26 is a different matter. Anyone deploying a high-risk system has to organise a whole list of things from 2 December 2027:
- use the system in line with the provider's instructions, backed by appropriate technical and organisational measures (para. 1),
- assign human oversight to natural persons with the necessary competence, training and authority, and give them the support they need (para. 2),
- check that input data fit the purpose and are representative, as far as the deployer controls them (para. 4),
- monitor operation, inform the provider and the market surveillance authority of a risk and suspend use, and report serious incidents without delay (para. 5),
- keep automatically generated logs for at least six months (para. 6),
- inform worker representatives and affected staff before use at the workplace (para. 7),
- cooperate with the authorities (para. 12).
Every line of that list ends up with a name next to it, even though the regulation names nobody. One more trap sits in Art. 25(1)(c): change a system's intended purpose so that it becomes high-risk, and you become its provider, with the much longer list of duties in Art. 16.
How many municipal utilities does Art. 26 actually reach? Fewer than the debate suggests. Under the Commission's draft guidelines of 19 May 2026, AI in electricity supply is high-risk only if it directly protects the installation as a safety component and the operator has been identified as a critical entity. Details are in our piece on which AI at a municipal utility is really high-risk. That's no reason to skip governance, though. Art. 4, Art. 50, the GDPR and the duty to answer the supervisor apply to every company.
Add a duty that predates the AI Act. Under Section 5e EnWG, management of grid and plant operators must implement and monitor the requirements of the IT security catalogue and attend regular training; Section 38 of the BSI Act (BSIG) says the same for NIS2 entities. AI systems sit in there like any other IT system. Management's responsibility is already written into law.
Five roles, one of them in the law
Most companies get by with five roles. Only the oversight person for high-risk systems is explicitly required by the regulation; the rest are organisational choices.
| Role | What it does | Legal basis | Required or chosen |
|---|---|---|---|
| Management | adopts the AI policy, decides escalations and the operating model, receives regular reports | Section 5e EnWG, Section 38 BSIG for IT risk management | responsibility required, form open |
| AI lead | keeps the register and the procedure, classifies or has cases classified, reports to management | no specific provision | chosen |
| Use-case owner | registers the use case, owns it in business terms, organises day-to-day oversight | Art. 26(1) and (5) for high-risk | chosen, in practice needed for high-risk |
| Oversight person | exercises human oversight of a high-risk system and may intervene | Art. 14, Art. 26(2) | required from 2 Dec 2027, high-risk only |
| AI board | decides approvals with elevated risk, involves data protection, information security, legal and the works or staff council | no specific provision | chosen |
Everything hangs on the AI lead. She doesn't have to decide every case herself. Her job is that none gets stuck and that every decision can still be found two years later. At a municipal utility this is rarely a full position; more often a fixed share of someone's time in IT, information security or organisation.
And the board? Its own rules of procedure, a monthly slot, twelve members: plan it like that and the agenda backs up after three meetings. A board that decides only on elevated risk and otherwise meets as needed lasts longer. What each building block looks like in detail, with minimum content per role, is set out in our AI governance building blocks for utilities.
The approval path
A pilot needs the same path as regular operation, just with fewer stops. Exempt pilots, and a year later you're running production that nobody ever approved.
It starts with the business unit registering the case: purpose, data, vendor, users. The AI lead classifies it and pulls in whoever the case touches. Data protection when personal data is involved, information security for new services or interfaces, procurement for new contracts. Low risk, she approves it herself. Transparency duties, employee data or high-risk go to the board, which approves with conditions and a review date.
Most often missing is the dashed arrow. New purpose, new model, new data source: the case has to go back to classification. If the billing software vendor switches on an AI feature with the next update, that's a change too. Nobody ordered it.
What about the works council? Since 2021 Section 90(1) no. 3 of the Works Constitution Act (BetrVG) has named the use of artificial intelligence explicitly among the work procedures the council must be informed about, and Section 87(1) no. 6 applies as soon as a system can monitor employees' behaviour or performance. For high-risk systems at the workplace, Art. 26(7) adds its own duty. Worker representatives belong early in the path, not at the end.
Does every office tool then go to the board? No. A whitelist names the standard tools that run under fixed data rules without individual approval. Only what isn't on the list takes the full path.
The AI register and the regulator's register
Without a register nobody can answer the supervisor's first question. That's the practical reason for keeping one, and it's enough.
Each use case gets what a third party needs to follow the decision: purpose, role as provider or deployer, responsible people, classification with reasons, approval status, next review date, and references to the data protection impact assessment and the ISMS. A template with 23 fields is free to download as CSV and XLSX with our governance building blocks. A tick next to "minimal risk" won't carry much weight with an authority. Two sentences on why will.
Don't confuse it with the register the Federal Network Agency keeps. Section 20 KI-MIG sets up a non-public register only for high-risk systems under Annex III point 2, critical infrastructure. Providers must register there before placing a system on the market. Deployers only if they are federal public bodies, which hardly any municipal utility is.
Your internal register isn't a filing obligation. It's the answer you have ready. Incorrect or incomplete information to the authority can be fined under Art. 99(5) with up to 7.5 million euros or 1 percent of worldwide turnover.
While one company and one person maintain it, a spreadsheet is the right tool. Software nobody opens is worse than a spreadsheet somebody touches every month.
Municipal utility or group: where the differences lie
Same building blocks, different load. What makes the biggest difference isn't the number of AI applications. It's unbundling.
A vertically integrated company with fewer than 100,000 connected customers is exempt from legal and operational unbundling of its distribution system operator under Sections 7(2) and 7a(7) EnWG. One board can then decide for the whole company, grid and retail included. Above that threshold, Section 7a(4) requires the grid company to have effective decision-making rights over the assets needed to run the grid, independent of group management. A central approval of AI in grid operations that bypasses the grid company fits that badly.
| Question | Municipal utility, one company, under 100,000 customers | Utility with grid company, over 100,000 customers |
|---|---|---|
| Where does the board sit? | as a standing item in the existing IT or security committee | group level for rules and register, approval of grid AI inside the grid company |
| Unbundling | no legal or operational duty, Section 6a EnWG on confidentiality still applies | Section 7a EnWG with the grid company's decision rights, compliance programme and compliance officer |
| Co-determination | for municipal enterprises or public-law institutions, state staff representation law instead of the BetrVG | works councils per company, often a group works council |
| KRITIS and NIS2 | one classification for the company | classification per company, often different |
| Register | one spreadsheet | linked to the application inventory and the processing records instead of run in parallel |
| Who does the work? | often mixed: responsibility in-house, outside support for classification and training | dedicated staff time, board with rules of procedure |
Two publicly described approaches, reported by ZfK on 13 July 2026, show what this looks like in practice. At Stadtwerke Jena an AI board produced a group-wide directive on artificial intelligence. Introducing or using an AI application there requires documented approval by that board; the business unit starts the process with a standardised checklist. Stadtwerke Karlsruhe went the other way: its group-wide "KI-Kompass" programme checks new AI systems through the existing software and cloud request processes and assesses the risk class under the AI Act along the way.
A dedicated board or an existing process. Either can carry the load. Which fits depends less on size than on whether there's already a request process the business units actually use.
One peculiarity matters for municipal companies. Section 17(2) KI-MIG says the Federal Network Agency imposes no fines on authorities and public bodies within the meaning of Section 2(1) and (2) of the Federal Data Protection Act. A Stadtwerke GmbH is organised under private law and shouldn't count on that. Whether a municipal enterprise falls under it is a question for legal counsel. How far grid data may flow into retail AI within a multi-utility is the subject of our piece on meter data, AI and unbundling in the multi-utility.
Brake or guardrail: three readings
Does governance slow AI projects down or make them possible in the first place? People in the industry disagree. A single ZfK article of 13 July 2026 put three positions side by side (quotes in our translation).
"We see customers prohibiting the use of AI, for example in software development. That shows security and data protection concerns aren't abstract, they influence decisions in practice and can slow AI projects down."
"IT security and data protection matter, but they block AI projects less often than people tend to assume."
"If all you do is prohibit, you produce shadow AI. Staff then use the tools privately and without control."
Vogel describes companies that ban out of caution. Anders thinks the caution is overrated. Menge says the ban creates exactly the risk it's meant to prevent. These three statements don't reduce to one sentence, and we won't try here.
What the law provides for breaches
For breaches of the deployer obligations in Art. 26, the AI Act provides for fines of up to 15 million euros or 3 percent of total worldwide annual turnover, whichever is higher (Art. 99(4)(e)). For SMEs, Art. 99(6) applies the lower of the two. In Germany the Federal Network Agency is the fining authority under Section 17(1) KI-MIG, and proceedings follow the Administrative Offences Act (Section 16). What applies in an individual case depends on its facts, and the company's legal counsel judges that, not this article.
What to do before December 2027
Just over fourteen months remain until 2 December 2027. Plenty for a register and an approval path. Tight for a control-room AI whose tender is being written now.
An order that works
-
Name one person
Management appoints the AI lead, with a time budget and a deputy. Without a name, the rest stalls.
-
Take stock
The list gets longer than IT expects. AI sits in purchased specialist software, in the customer service tool, in the office suite and in browser tabs nobody registered. Vendors know better than any internal search where AI is built into their products, so ask them in writing. For each system, record: are we provider or deployer?
-
Start the register
A spreadsheet with reasons for each classification is enough to begin with.
-
Fix the approval path
Registration, classification, approval by risk, the way back for changes. Plus a whitelist for standard tools and a meeting with the works or staff council before the first system goes through.
-
Check grid AI separately
For every AI in grid operations, answer and record two questions: does it directly protect the installation? Is the company a critical entity? If both apply, prepare oversight staff and logging under Art. 26, plus the information for employees, and write all of it into the tender rather than leaving them for acceptance testing.
-
Report to management
Twice a year, one page: inventory, open classifications, anomalies.
If you'd rather not build this alone: our service AI governance and the EU AI Act for utilities describes how we set up the register and approval path with you and then settle who carries it long term. All our AI articles for utilities, from grid control to customer service, are collected in the topic area AI in the energy industry. Dates are in the deadline calendar.
This article sets out the AI Act, the KI-MIG and the EnWG for typical roles at energy utilities. It is not legal advice and does not assess your individual case. Whether a system in your company is high-risk and which obligations apply to your company is for your legal department or counsel to decide. As of 17 October 2026.
Further reading
Frequently asked questions
AI governance is the set of roles, rules, approval path and AI register with which a utility decides which AI systems run, who is responsible for them and why they are classified as they are. The EU AI Act prescribes no particular structure. It requires outcomes: AI literacy, transparency and, for high-risk systems from 2 December 2027, the deployer obligations in Art. 26.
No. In its questions and answers on AI literacy the European Commission states that no specific governance structure is mandated, neither an AI officer nor a board. A named person still makes sense, because someone has to keep the register and answer the supervisor. For high-risk systems Art. 26(2) requires named people for human oversight.
From 2 December 2027 deployers of high-risk AI systems have to use the system according to its instructions, assign human oversight to competent and authorised people, check input data as far as they control it, monitor operation and report incidents, keep automatically generated logs for at least six months and inform worker representatives before using the system at the workplace.
No. The internal AI register is the company's own list of all its AI use cases. Under Section 20 KI-MIG the Federal Network Agency keeps a non-public register only for high-risk systems under Annex III point 2. Providers must register there; deployers only if they are federal public bodies.
Mainly through unbundling. Below 100,000 connected customers legal and operational unbundling do not apply, and one board can decide for the whole company. Above that threshold the grid company must have effective decision-making rights under Section 7a(4) EnWG, and a group-level approval for grid AI has to respect them. Section 6a EnWG on confidentiality applies to both.
Breaches of the deployer obligations in Art. 26 can be fined under Art. 99(4) with up to 15 million euros or 3 percent of worldwide annual turnover, with the lower amount for SMEs. Incorrect or incomplete information to authorities can cost up to 7.5 million euros or 1 percent. In Germany the fining authority is the Federal Network Agency.
Let's collaborate
One contact, a team behind it
Thirty minutes on what you're working on, whether grid, metering, market processes, IT architecture or AI. Afterwards you'll know how we'd approach it and who would sit at the table.
Energy and measurement technology since 2010 · innobu GmbH since 2014 · Based in Schleswig-Holstein, Germany
Whoever pitches also delivers: whoever leads the first call stays your contact right through to the steering committee, with established partners in the project. Direct: info@innobu.com