A joint study by Germany’s federal cybersecurity authority and the TÜV Association finds that 17 percent of companies registered an attack or fraud attempt in the past year in which AI played or could have played a role. The 42 percent that neither use AI nor plan to are exposed to those attacks all the same. Staying out of AI settles the risk a company creates for itself and leaves the risk attackers bring untouched.
What changed
On 7 October 2026 Germany’s Federal Office for Information Security (BSI), the federal cybersecurity authority, and the TÜV Association published their AI security study 2026 (“KI-Sicherheitsstudie 2026”). The polling institute forsa interviewed 505 companies in Germany with 20 or more employees by telephone between 22 June and 31 July 2026.
Of all companies surveyed, 17 percent registered a cyberattack or fraud attempt in the previous twelve months in which AI played or could have played a role. The composition of that figure says more than the total: 4 percent report confirmed incidents only, 11 percent suspected cases only, and 2 percent both. Among the affected companies, 90 percent report highly realistic phishing emails, 40 percent automated attack scripts that search for weaknesses on their own and adapt, and 11 percent deepfakes, such as a faked recording of an executive’s voice used to get staff to make a transfer.
The study also records companies’ own use of AI. Of all companies surveyed, 49 percent use it, 9 percent plan to within twelve months, and 42 percent neither use it nor plan to. In that last group, 53 percent give data protection or security concerns as a reason.
Why it matters
The study measures two different risks that tend to reach the board as one item called AI risk. One is the risk a company creates through its own use of AI. The other is the risk that arrives because attackers use AI. Governance has grown up around the first, because it attaches to a decision: someone chose to deploy something, and that choice produced a named owner, a policy, an approval gate and training. The second attaches to no decision the company made. It falls by default to the general security function, where nothing marks it as having changed.
This produces a specific blind spot. A company that has stayed away from AI on security grounds has made a decision about the first risk alone. The BSI’s Vice President said as much on publication: companies that do not use AI themselves are also at risk from AI-supported cyberattacks, and the subject merits attention from every company regardless of its own AI strategy. A companion handout for small businesses from the Alliance for Cyber Security, which is hosted at the BSI, makes the same point. The company with the most cautious position on AI can be the one where AI-enabled attack is never discussed, because there is no AI programme under which to discuss it.
Even the measurement follows the adoption decision. The study’s figure on readiness for AI-related security incidents is reported for companies that use AI or plan to. Within that group, 11 percent have processes specifically for such incidents, 43 percent rely on general IT security processes with no AI-specific rules added, 20 percent are developing processes and 25 percent have no arrangements. The figure does not cover the 42 percent that have opted out.
Detection is the second problem. Suspicions outnumber confirmations by a wide margin in the study’s figures. The TÜV Association’s President observed that staff can often barely tell whether an email was written by a person or created with AI, and that what companies have registered so far could be the tip of the iceberg. A board that waits for confirmed AI incidents before asking for a response is waiting for a signal its organisation cannot reliably produce. Whether a suspicion can later be confirmed also depends on what the company records, the subject of an earlier piece in this series on logging choices. The controls that matter most are those that work whether or not anyone recognises the fake.
What changes for management
Ownership comes first. The risk from attackers’ use of AI needs a named owner whose remit does not depend on the company’s own AI plans. Leaving the subject inside an AI governance group that exists because the company deploys AI reproduces the blind spot.
Verification should replace recognition as the control. The study recommends that all companies make staff aware of AI phishing and fraud attempts and reconfirm sensitive payment or data releases through an independent communication channel. The companion handout adds a binding two-person rule for transfers and sensitive data. Under these controls a convincing fake cannot complete an action on its own, however it was produced.
The existing incident process should be extended, with no parallel structure built beside it. The study recommends adding AI scenarios such as data leaks, manipulated content and unintended agent actions to existing IT security and emergency processes. For companies that rely on their general processes, the work is to write those scenarios in and rehearse them.
For companies that do use AI, the study shows governance concentrated at the entry point. Among AI-using companies, 63 percent have a fixed responsibility for AI topics and 59 percent have binding internal policies. The operating controls are less common: 45 percent have a formal approval process and 40 percent log or monitor AI use. The BSI’s Vice President said that whoever uses AI must know where its protective mechanisms fail, which includes targeted tests and monitoring in live operation. A named owner and a policy are in place more often than the means to see what an approved system is doing.
What changes for the board
AI-enabled attack belongs under the security or risk item on the board agenda, whatever is also said under the AI or digital item. If the adoption programme is the one place AI appears on the board calendar, the attacker-side risk has no forum.
The sentence “we do not use AI” addresses exposure created by the company’s own deployments and says nothing about exposure created by attackers’ tooling. It should not be accepted as a complete answer on AI risk.
Board reporting should be triggered by an attempted attack or fraud of the kinds the study describes, whether or not the AI element is ever proven. Most affected companies report suspicion alone.
For entities within the scope of the NIS2 Directive, this is more than good practice. Article 20 has the management body approve the cybersecurity risk-management measures, oversee their implementation and follow training, and it can be held liable for infringements. Article 21 requires measures that are appropriate and proportionate, taking into account the state of the art, and lists incident handling and cybersecurity training among them. Germany’s BSI Act, in the version that implements NIS2, places the duty to implement and oversee the measures on management in section 38, and section 30 requires the entity to document its compliance. None of these duties depends on the entity’s own AI strategy.
The study is a survey with recommendations and creates no legal duty of its own. But the national cybersecurity authority has now put on record how common these attacks are and what a proportionate response looks like. For the management of a regulated entity, that makes likelihood and the standard of a reasonable measure harder to treat as open questions. Management’s reading of the exposure also benefits from being tested against an outside view, since the gap is one the internal structure was not built to see.
Questions boards should now ask
- Who owns the risk from attackers’ use of AI, and would that ownership survive if the company’s AI programme were paused tomorrow?
- Where on the board agenda does AI-enabled attack appear, and when was it last discussed outside the AI adoption item?
- Which payment and data releases must be reconfirmed through an independent channel, and is a two-person rule binding for them?
- What triggers a report to the board on a suspected AI-enabled attack or fraud attempt, given that AI involvement often cannot be confirmed?
- Which AI scenarios have been written into the existing incident and emergency processes, and which have been rehearsed?
- Where the company uses AI, what is monitored after approval, and who acts on what the monitoring shows?
- For an entity within NIS2 scope, where is it documented that the management body considered AI-enabled attack when it approved the risk-management measures?
Not every company surveyed falls within NIS2. The study’s value to a board is that it separates two risks that share a name. A board that leaves AI risk as a single item owned by the adoption programme leaves the attacker-side half without an explicit owner. That holds for the company that has declined AI as much as for the one that has embraced it.