Service · Prototype and AI

AI governance and the EU AI Act for energy utilities: set-up, register and operating model

Since 29 July 2026 the Federal Network Agency supervises AI in Germany. We build roles, an AI register, risk classification and training with you, then settle who runs it for the long term.

Book an implementation check

30 minutes on the project that's pressing for you right now. No sales loop.

IT employee with a clipboard at the end of a rack row in a municipal utility's server room, working through the cabinets

The German KI-MIG took effect on 29 July 2026. Since then the Federal Network Agency has been the market surveillance authority for the AI Act. In many utilities a usage policy still decides which tools are allowed and which data must stay out of them. For a supervisor, that's not enough.

Summary

AI governance for energy utilities at innobu means: we record which AI runs in your organisation and which obligations from the AI Act, the German KI-MIG, data protection and information security attach to it. Then we build roles, rules, an AI register, a risk classification procedure and training with you. In a second phase, management decides whether to run it in-house, in a mixed model or with external specialist support. We do not give legal opinions on individual cases, and we do not certify.

Who this service is for

  • ManagementYou are accountable when the supervisor asks, and you want to know which AI runs in the organisation and who approved it.
  • Head of IT and digitalisationBusiness units use AI assistants and forecasting models. Nobody keeps a list of them.
  • Compliance, internal audit, security and data protection officersYou are expected to review AI and need criteria, a register and evidence a review can work with.
  • Programme ownersYour AI project is waiting for approval, and no one can say who gives it.
  • Municipal utilitiesOften no AI team of their own, a multi-utility setup spanning grid, retail, public pools and transport, municipal boards and, for public-law enterprises, a staff council instead of a works council. What counts is what a small team can sustain.
  • Larger suppliers and grid operatorsSeveral companies, critical-infrastructure duties and in-house development. The question is who classifies across the group and who decides in each company.

Starting point

Why a usage policy is no longer enough

A usage policy says what staff may do with a chatbot. The AI Act asks something else: which systems are running? Is the company the provider or the deployer? And who decided the classification?

The PwC study on the German energy industry from April 2026 counts 79 percent of companies with AI in place, while one in four has an AI roadmap. Lots of AI, little order around it. That's the situation supervision now walks into.

And the grid? AI in the operation of electricity, gas, heating or water supply can be high-risk under Annex III point 2 when it serves as a safety component. The Commission's draft guidelines of 19 May 2026 draw the line more tightly: the system must directly protect physical integrity, and the operator must be designated a critical entity under the CER Directive, which Germany implements through the KRITIS umbrella act. The draft is not final. Anyone classifying today should record the reasoning so it can be adjusted later.

Background in our articles: KI-MIG and supervision by the Federal Network Agency and which AI at a utility is really high-risk.

The dates

  • since 2 February 2025Article 4: providers and deployers take measures for the AI literacy of their staff.
  • since 29 July 2026KI-MIG in force. The Federal Network Agency is market surveillance authority, single point of contact and complaints body. Its AI service desk offers an online tool for a first estimate of the risk class.
  • since 2 August 2026Transparency obligations under Article 50, for example for customer service chatbots and AI-generated content.
  • from 2 December 2027Obligations for high-risk systems under Annex III. Under Article 26, deployers must among other things assign human oversight, keep logs for at least six months and inform workers' representatives before use at the workplace. The date was moved by the Digital Omnibus, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Classification for typical roles, not an assessment of your individual case and not legal advice. Information as of 17 October 2026. All dates in the deadline calendar.

Phase 1

Set-up: what we build with you

Eleven building blocks, not all at the same depth. A municipal utility without an AI team needs fewer committees and more templates. For a supplier with several companies it's the other way round.

  • InventoryWhich AI is already running, including in standard software and at service providers? We record the applications and set them against the obligations from the AI Act, data protection and information security. The result is a gap list with a sequence.
  • Target organisationRoles, committees, decision rights, escalation paths. Who registers a use case, who classifies, who approves, who stops it?
  • RulesA policy at management level and work instructions business units can apply without translation.
  • End-to-end processFrom registering a use case through classification and approval to change and decommissioning. With forms and responsibilities, so the process works without a diagram on the wall.
  • Risk classificationA procedure with templates that business units run themselves: prohibited practice, high-risk under Annex III, transparency obligation or other AI. Borderline cases go to your legal counsel.
  • AI registerA central register with owners, classification and reasoning, approval status and next review date. Without a register every other rule stays on paper.
  • Review cycles and incidentsWho reviews when, and what gets documented? And what happens when a system produces wrong results or the vendor swaps the model?
  • First use casesTwo or three real cases from the business units run through the new process together with us. That shows which template snags.
  • Training conceptManagement, business units, developers and procurement need different content. Article 4 calls for measures on AI literacy. One seminar for everyone does that poorly.
  • ReportingA regular report to management: inventory, open classifications, incidents.
  • HandoverWe document so your organisation carries on without us. That's where the first phase is headed.

Process

How it works

A set-up usually takes several months. How many depends on the number of companies and use cases.

  1. Inventory

    Interviews with business units, IT, data protection and information security, plus contracts and systems. Afterwards the gap list is on the table.

  2. Organisation and rules

    Roles and the classification procedure are drafted and go through your committees, and where needed through the works council or staff council.

  3. Trial run

    First use cases go through the process and the register. Whatever snags, we change before training starts.

  4. Handover and operating model

    The owners in your organisation take over. Management gets a decision paper on who runs AI governance from then on.

Phase 2

Operating model: who carries it long term

The first phase ends with a management decision. We prepare it and compare effort, risks, benefits and accountability for each option.

In-house

Dedicated capacity for running the register and the reviews, with a deputy. Fits when new use cases keep coming and the knowledge should stay in the organisation.

Mixed

Responsibility stays in the organisation, and specialist support is added for classification and training. In our view the obvious route for many municipal utilities without an AI team of their own.

With external specialist support

A service provider keeps the register and the review cycles. The deployer's obligations stay with the company. The work can be outsourced, the accountability cannot.

Interfaces

Where AI governance meets existing obligations

Most of it hangs on functions the organisation already has. AI governance connects them instead of building a separate world next to them.

  • Data protectionLegal basis, data protection impact assessment and processing agreements stay with the data protection officer. The German data protection conference has published guidance on AI and data protection (May 2024) and guidance on generative AI with RAG (October 2025). The register points to the DPIA instead of repeating it.
  • Information securityAI systems are part of the ISMS: for grid and plant operators under the IT security catalogue under Section 5c EnWG (formerly Section 11(1a) and (1b)), for NIS2 entities also under the BSI Act. AI brings its own attack surface, prompt injection for example. The BSI describes it in its papers on LLM systems.
  • LegalWhether an obligation applies in an individual case is decided by your legal department or law firm. We prepare the cases so they can decide quickly.
  • Works council or staff councilSince 2021 the Works Constitution Act names AI explicitly, in Sections 80(3), 90(1) no. 3 and 95(2a). Co-determination under Section 87(1) no. 6 applies when a system can monitor performance or behaviour. Municipal enterprises under public law fall under the staff representation act of the federal state. Article 26(7) of the AI Act adds a duty for high-risk systems at the workplace.
  • ProcurementContracts with AI vendors need terms on documentation, model changes, logs and cooperation in reviews. With providers of high-risk systems it's worth asking about their quality management. The European standard EN 18286, published in 2026, describes it for providers.
  • ITAccess, logging, approval of new model versions, and switching things off. Many AI features arrive by update in standard software without any business unit ordering them.

Frame of reference

Standards and guidance we work with

Public standards provide the structure. We don't offer certification. Your set-up can be designed, though, so that a later ISO/IEC 42001 certification doesn't start from zero.

  • ISO/IEC 42001Management system for AI, published in 2023. Same harmonised structure as ISO/IEC 27001, so risk assessment, internal audits and management review can run together with the ISMS.
  • ISO/IEC 27001The ISMS that grid operators certify anyway under the IT security catalogue.
  • EN 18286Quality management under Article 17 of the AI Act, aimed at providers of high-risk AI. Relevant for utilities when they become providers themselves or assess providers.
  • BSI"Generative AI Models: Opportunities and Risks for Industry and Authorities" and the design principles for LLM-based systems with zero trust, published together with France's ANSSI.

What you have at the end

  • Gap listInventory against obligations, with a sequence.
  • OrganisationRoles, committees, decision rights and escalation paths, adopted.
  • RulesPolicy and work instructions.
  • Process with templatesRegistration, classification, approval, change.
  • AI registerFilled with the first use cases.
  • Review planWho reviews when, and what happens after an incident.
  • Training conceptPer target group.
  • Management reportFormat and frequency.
  • Decision paperThe operating model and its options.

Limits

What we don't do

We classify in general terms and implement. Whether an obligation applies to your company is checked by your legal counsel, and that assessment is the input we build on. We don't certify and we don't attest conformity. We don't sell software either: which tool carries the register and the process is your vendor-neutral decision. To start with, what's already in place is often enough.

If AI governance is part of a larger programme, alongside NIS2 and the IT security catalogue for example, we also take on programme management. If you'd rather build a use case first, the path from prototype to operation is under Prototype and AI.

Questions

Frequently asked questions

The AI Act does not require an AI officer. It requires measures for the AI literacy of staff (Article 4) and, for high-risk systems, human oversight by people with the necessary competence and authority (Article 26(2)). Who coordinates this is up to each organisation. At a municipal utility the role can sit with the head of IT, the information security officer or the data protection officer, as long as authority and deputies are settled.

No. Annex III point 2 covers AI used as a safety component in the operation of electricity, gas, heating or water supply. Under the Commission's draft guidelines of 19 May 2026, which are not final, this applies only if the system directly protects physical integrity and the operator is designated a critical entity. The draft names load forecasting for grid optimisation as an example outside the scope. How a specific system is classified is a question for your legal counsel.

Per use case: purpose and business unit, the company's role as provider or deployer, owners, classification with reasoning, data categories, the model or product used, approval status and next review date, plus references to the data protection impact assessment and the ISMS. The AI Act does not explicitly name an internal register. Without one, though, a company can hardly evidence its own classification.

AI systems are IT systems and are covered by the existing risk management under the IT security catalogue and the German BSI Act. AI governance adds questions an ISMS does not ask: purpose, classification under the AI Act, human oversight, quality of results. ISO/IEC 42001 follows the same harmonised structure as ISO/IEC 27001, so risk assessment, internal audits and management review can be run together.

Often, yes. Under Section 90(1) no. 3 of the German Works Constitution Act, the works council must be informed when the employer plans to use AI. Section 87(1) no. 6 grants co-determination as soon as a system can monitor employee performance or behaviour. In 2024 the Hamburg labour court denied co-determination in summary proceedings where employees used ChatGPT only through private accounts in the browser (24 BVGa 1/24). Municipal enterprises under public law fall under the staff representation law of the federal state.

Management decides at the end of the first phase. In-house needs dedicated capacity and a deputy. A mixed model keeps responsibility in the organisation and brings in expertise for classification and reviews. Externally, a service provider keeps the register and review cycles, but the deployer's obligations stay with the company. We put the options side by side with effort, risks, benefits and accountability.

Let's collaborate

Next step

You have a usage policy and a list of AI tools, but no register? In a first conversation we assess where you stand and say which building blocks come first.

Book an implementation check More about innobu

Energy and measurement technology since 2010 · innobu GmbH since 2014 · Based in Schleswig-Holstein, Germany

Whoever pitches also delivers: whoever leads the first call stays your contact right through to the steering committee, with established partners in the project. Direct: info@innobu.com