Guideline for AI Officers

Technical role and competency profile

These guidelines describe the professional, organizational, and personal competencies required to perform the function of an AI officer.

The AI Officer supports the organization in the legally compliant, secure, and responsible use of AI.

His core competency is: recognize – classify – coordinate – document – escalate.

The responsibility for the use of AI always remains with the executive management.

1. AI Fundamentals

1.1. Basic understanding of AI

An AI officer needs a solid foundational understanding of how AI systems, AI models, and AI agents work and how they differ.

1.2. Basic applications

The meaning of prompts and input contexts must be understood, e.g., hallucinations, over-prompting, response analyses such as the reason for the response.

1.3. Limitations of AI

An AI officer must know that there are limits to the use of AI (e.g., prohibited practices, hallucinations, bias, erroneous or incomplete results, unsuitable training or input data, as well as risks from insufficient human oversight, including the impact on the rights of data subjects).

2. Legal baseline understanding of the AI Act

2.1. Risk-based Approach

An AI Officer must understand the risk-based approach of the AI Act and be able to classify AI applications from a regulatory perspective. This includes, for example, prohibited practices, high-risk AI systems, and transparency obligations.

2.2. Roles under the AI Act

The AI Officer must be able to distinguish which role the organization assumes regarding the respective AI system: provider, deployer, importer, product manufacturer, distributor. Determining the role is essential because it gives rise to different obligations.

2.3. Human Oversight

The AI Officer should understand the concept of human oversight. They should be able to assess at which point a human review is necessary or useful and how to design it to be organizationally effective. (Human-in/on/over-the-Loop)

2.4. Basic understanding of governance

An AI officer requires knowledge of the organizational, legal, and technical structures for the responsible management of the deployment of AI systems. This includes understanding the importance of governance, compliance, and accountability, as well as the distinction between corporate, IT, data, and AI governance.

2.5. Deadlines and Obligations

Knowledge of the AI Act obligations and deadlines relevant to the organization is required.

2.6. Documentation and Verification

The AI Officer needs an understanding of which decisions, reviews, responsibilities, and measures must be documented in order for AI governance to be traceable and auditable.

2.7. Implementation in operational processes

The AI Officer should be able to translate the obligations into operational processes.

2.8. AI Literacy

The AI Officer should support the organisation in the development, implementation and further development of a role- and risk-based concept for AI literacy pursuant to Art. 4 of the AI Act and coordinate its implementation.

3. AI Governance

3.1. AI Lifecycle Governance

The AI Officer should oversee the governance over the entire lifecycle of AI—selection/procurement, development or introduction, approval, use, modification, monitoring, and decommissioning.

3.2. AI Inventory

An AI officer should conduct an inventory analysis of which AI is currently being used in the company.

3.3. AI Register

As a central instrument of effective AI governance, the AI Officer should maintain and regularly update an internal AI register.

3.4. AI Guidelines

The AI officer should help develop internal organizational rules for the use of AI.

3.5. Shadow AI

The AI officer should identify risks from unapproved or unknown AI applications. This includes, in particular, the uncontrolled entry of company data, personal data, or confidential information into external AI services.

3.6. Classification and Regulatory Status

The AI Officer should participate in the development and implementation of a procedure for the regulatory classification of AI systems and coordinate its application. This includes, for example, determining whether an AI system falls under the AI Act and whether it is a prohibited practice, a high-risk AI system, a system with transparency obligations, or another type of AI system.

3.7. Risk Management

The AI Officer should be able to coordinate the identification, assessment, treatment, and monitoring of AI risks and involve the respective responsible departments.

3.8. Incident Management

Tasks include handling malfunctions, bad decisions, bias, security and data privacy incidents, as well as escalation and documentation.

3.9. Traceable Documentation

Reviews, approvals, measures, and key decisions regarding the use of AI must be documented in a traceable, up-to-date, and auditable manner. Reliable documentation is a prerequisite for effective governance and subsequent audits.

3.10. Reporting and Escalation Paths

Clear reporting and escalation channels must be established for errors, incidents, and critical observations. The AI Officer should record incidents, coordinate their handling, and follow up on necessary measures.

3.11. Roles and Responsibilities

The AI officer should be able to help develop clear roles and responsibilities for the deployment of AI systems. In particular, it must be determined who is responsible for business use, approval, risk assessment, technical support, data protection, information security, monitoring, and escalation. Responsibilities and interfaces should be documented in a comprehensible manner.

4. Testing of new AI applications

4.1. Use Case Check

Before introducing an AI application, its specific purpose should be described and it should be examined what function the system will perform, what data will be processed, and what impacts its use may have. The AI Officer must coordinate this with the relevant departments.

4.2. Vendor and System Audit

The AI officer should coordinate the review of the provider and the AI system. Depending on the application, this includes, among other things, contracts, security, hosting, data usage, and the question of whether inputs or outputs are used for training purposes.

4.3. Approval and Re-evaluation

The approval of an AI system should be documented in a traceable manner. For relevant systems, it should also be defined when a reassessment is required, such as in the event of significant changes to the system, its intended purpose, or the legal situation.

4.4. Integration in the Procurement of New AI

Procurement of AI should not be done in isolation. The AI Officer coordinates the AI-specific assessment and, depending on the use case, involves procurement, legal, data protection, information security, and the affected department in particular.

5. Lifecycle and ongoing monitoring

5.1. Lifecycle of an AI System

An AI officer must consider AI governance across the entire lifecycle of an AI system. This ranges from selection or development and initial evaluation to implementation and operation, as well as modifications, reassessment, and decommissioning.

5.2. Post-Implementation Monitoring

The release of an AI system does not end governance. The AI officer should work to ensure that relevant systems are monitored during ongoing operations and that controls are checked for their effectiveness. In particular, it must be considered whether new risks arise, usage changes, or the system delivers different results than expected.

5.3. Change Management

The AI officer should be able to recognize when changes may require a re-evaluation or approval. Examples include a new or significantly modified model, a changed intended use, new data sources, additional interfaces, new user groups, or an expansion of autonomous functions.

6. Practical Implementation

6.1. Implementation in the Company

An AI officer should be able to translate regulatory requirements into workable company processes. They should understand and support business departments and mediate between innovation, actual workflows, and compliance.

7. Training

7.1. AI Competence and Training

The AI officer should participate in developing an appropriate training concept and ensure that the AI literacy required for the respective application is present. Training should be tailored to the employees' role, prior knowledge, and context of use.

8. Data Protection, Information Security, and Data Classification

8.1. Data protection law interface knowledge

An AI officer requires cross-functional knowledge of the General Data Protection Regulation (GDPR). They must be able to recognize whether personal data is being processed and, in particular, when issues regarding the legal basis, purpose limitation, necessity, deletion, or a data protection impact assessment need to be addressed.

8.2. Automated decisions

The AI officer should know the particular relevance of automated decisions pursuant to Art. 22 GDPR and be able to recognize when an AI application prepares decisions about individuals, significantly influences them, or makes them in an automated manner. In these cases, the requirements of the GDPR and the AI Act must each be examined independently and coordinated with one another.

8.3. Technical and Organizational Security

Understands the basic principles of confidentiality, integrity, availability, and resilience, as well as the importance of appropriate TOMs (Technical and Organizational Measures), and knows when to involve information security/data protection.

8.4. Importance of Data

An AI officer needs a basic understanding of the significance that training, input, reference, and output data have for the functionality and quality of an AI system. They should be able to recognize when data can be a major cause of risks or erroneous results.

9. Further legal interfaces

9.1. Copyright and Protection of Confidential Information

Particularly when using generative AI, the AI Officer should be able to recognize typical issues related to copyrighted content, AI-generated outputs, trade secrets, and other confidential information.

9.2. Other Special Subjects

Depending on the use case, labor law, co-determination, consumer protection, competition law, or industry-specific regulations may become relevant in particular. The AI officer's core competency is to identify such interfaces and involve the necessary expertise.

10. Position, Skills, and Communication

10.1. Organizational integration

The AI Officer should have appropriate access to the management level.

10.2 Advisory and Coordinating Function

The AI Officer generally acts in an advisory, coordinating, and monitoring capacity. They consolidate information, organize compliance processes, and support decisions without assuming the overall responsibility of company management.

10.3. Differentiation from other functions

The role of the internal AI officer must be distinguished in particular from the data protection officer as well as from legal, compliance, and information security. At the same time, close cooperation with these functions is necessary.

10.4. Core Competence of the Function

The core competence of the AI Officer consists in recognizing relevant issues, classifying them from a regulatory and organizational perspective, coordinating necessary measures, documenting decisions in a comprehensible manner, and escalating risks when required.

10.5. Communication skills

An AI officer must be able to explain complex technical and regulatory topics in an understandable way. They take on a translation function between management, business units, technology, data protection, information security, and legal.

10.6. Recognizing the limits of one's own expertise

An AI officer does not also have to be a lawyer, data protection officer, data scientist, and IT security expert. However, they must possess sufficient cross-functional knowledge to recognize when an in-depth technical review is required.

10.7. Regular Reporting

The AI Officer should regularly report to management on deployed AI systems, significant risks, open measures, incidents, training status, and planned steps.

10.8. Continuous Updating

An AI officer must continuously update their expertise. This particularly concerns technical developments, new AI applications, changes to the regulatory framework, as well as new risks and recognized governance standards.

CONTACT

Leopoldstrasse 31 
80802 Munich

team@bundesverband.ai

META

Imprint
Privacy policy
Statutes and contribution regulations
Membership