Orphaned Access: The Silent Cybersecurity Gap
Benedikt Langer
5 Min. Read Time Service accounts, API keys, and AI agents often outnumber human accounts. Many of these ...
Only 26 % of supervisory boards discuss artificial intelligence at every meeting. Yet companies with AI-savvy boards achieve a return on equity 10.9 percentage points higher than the industry average. Since September 2024, the German Corporate Governance Code (DCGK) has required all supervisory board members to possess basic AI knowledge. For most boards, this recommendation arrives not a moment too soon: nearly 60 % of executives and supervisory board members admit to having little or no AI expertise. The question is no longer whether digital competence is essential in the boardroom, but how quickly it can be built.
These figures paint a contradictory picture. On the one hand, 85 % of DAX-40 supervisory boards include at least one member with digital expertise, according to a 2025 Russell Reynolds study-progress compared with 72 % in 2022. On the other hand, only 30 % meet all criteria for genuine “Digital Leadership,” as the DAX Digital Monitor by Prof. Tobias Kollmann shows.
The gap is explained by what Kollmann calls “digital washing”: companies tout digital competencies in reports without substantive proof. A former telecommunications executive on a supervisory board may be labeled “digitally competent” even though their last operational experience dates back a decade and focused on basic-feature mobile phones.
The challenge intensifies with AI. The Deloitte Supervisory Board Panel 2024 reveals a troubling self-assessment: nearly 60 % of executives and supervisory board members admit to having little or no AI knowledge, while only 2 % describe themselves as “very competent and experienced.” In an era where AI is reshaping business models and the EU AI Act imposes costly compliance obligations, this is a governance risk.
The most striking figures come from the MIT Center for Information Systems Research (CISR). Researchers Peter Weill, Stephanie Woerner and Jennifer Banner analyzed the composition of hundreds of supervisory boards and compared it with corporate performance. The result: companies with AI-“expert” supervisory boards achieve a return on equity that is 10.9 percentage points higher than the industry average. Companies without AI-competent supervisory boards trail the average by 3.8 points.
The difference is not marginal. In terms of market capitalization, this corresponds on average to €15.5 billion. And the study gets even more specific: the updated definition of an AI “expert” now also includes experience with generative AI, AI agents and robotics. According to these criteria, only 26 % of the supervisory boards examined qualify.
For German supervisory boards, this means: digital competence is no longer a soft skill. It is a measurable value driver. Supervisory boards that do not have AI on their agenda not only fall behind regulatorily, but also financially.
Companies with AI-competent supervisory boards achieve a return on equity that is 10.9 percentage points higher than the industry average.
MIT Sloan Management Review, December 2025
The Government Commission German Corporate Governance Code published its third practice impulse in September 2024, this time on the topic of “Use of artificial intelligence in the supervisory board.” The key message: all supervisory board members must have a basic knowledge of AI – its functionality, opportunities and limitations.
Important: this practice impulse is not a change to the code. It is a recommendation rather than a “comply or explain.” But it signals the direction of travel. The DCGK already requires a competence profile for the supervisory board that must be disclosed in a qualification matrix. Digital competence and AI understanding are increasingly expected as part of this profile.
The recommendation has three levels: first, supervisory boards must understand where AI is being used in the company. Second, they must be able to assess risks – particularly in the context of the European AI Act. Third, they must act as a “strategic partner to the executive board” on digital issues, not just as a control body.
In practice, this means: nomination committees must actively seek AI competencies when making the next appointment. Not as a token item in the job advertisement, but as a concrete criterion in the qualification matrix.
Some companies are already taking action. SAP appointed René Obermann, the former Deutsche Telekom CEO and recognized digital expert, as supervisory board chair starting in 2027. Deutsche Telekom has brought Dr. Reinhard Ploss, former Infineon CEO, onto its supervisory board-a clear signal of targeted recruitment for semiconductor and technology expertise.
A study by Russell Reynolds identifies 13 supervisory board members in the DAX-40 as “highly digital,” with several members bringing digital experience to the table. These are the boards where digitalization isn’t treated as a single agenda item but as a cross-cutting theme woven into every strategic discussion.
Yet the majority are lagging behind. Germany’s two-tier system with parity-based co-determination and large supervisory boards (up to 20 members) complicates the rapid integration of new skill sets. Employee representatives bring different priorities to the table. And international tech leaders who flock to US boards are harder to attract in Germany, where supervisory roles are more time-intensive and less lucrative than in the US.
In the US, technology/telecommunications is the most common industry background for new S&P 500 board members according to the Spencer Stuart Board Index 2024: 19 % of all new appointments in 2024 came from the tech sector. For “next-generation directors” (under 50), that share rises to 29 %. By comparison, Germany’s share of tech-based appointments to DAX supervisory boards is significantly lower-exact figures are methodologically tricky to compare, but the trend is unmistakable.
The structural difference: US boards are smaller (average 11 members), meet less frequently, and pay better. That makes them more attractive to international tech executives. German supervisory boards with 20 members, monthly meetings, and complex co-determination require a different level of commitment. To attract top digital specialists, the framework conditions need to become more appealing.
From 1 August 2026, the EU AI Act will be fully enforceable for high-risk AI systems. For supervisory boards, this means concrete obligations: every AI system in the company must be identified and classified by risk level. High-risk systems (recruitment, credit scoring, biometric identification) require compliance assessments, documentation, and human oversight.
A Protiviti/BoardProspects study reveals an interesting trend: 40 % of companies have now assigned AI oversight to at least one supervisory board committee, up from 11 % last year. Regulation is acting as a catalyst. Yet 60 % still lack a formal AI governance process at the supervisory board level-just four months before the deadline.
Fines of up to €35 million or 7 % of global annual revenue turn AI governance from a recommendation into an existential obligation. A supervisory board that doesn’t understand which AI systems the company uses cannot fulfill its oversight function. This isn’t theoretical-it’s a tangible liability risk.
1. Update the skills matrix. Integrate digital competence and AI understanding as fixed criteria. Not as a “nice-to-have,” but as a hard requirement alongside finance, law, and industry knowledge.
2. Provide AI training for the entire supervisory board. Not as a one-off event, but as a recurring format. Semi-annual deep dives into current AI developments, the regulatory environment, and concrete AI applications in the company.
3. Make AI a permanent agenda item. The MIT study shows the connection: 63 % of companies with high returns discuss AI at every meeting. For companies with low returns, it’s only 13 %. Governance correlates with performance.
4. Establish or expand a digital committee. A committee dedicated to digitalization and AI, staffed with the most digitally experienced members. Analogous to the audit committee or the remuneration committee.
5. Actively bring in external expertise. Digital advisory boards, external AI experts in supervisory board meetings, study trips to tech companies. If the competence isn’t in the body itself, it must be brought in from outside.
The criticism is justified: supervisory boards don’t need to become AI experts. Their job is oversight, not implementation. If every practical impulse becomes a new mandatory topic, the agenda-already packed-risks overload.
But the alternative is worse: a supervisory board that doesn’t understand AI cannot judge whether the executive board is using the technology responsibly. It cannot assess whether compliance measures meet the AI Act requirements. It cannot evaluate whether AI investments deliver the right return. This isn’t overregulation; it’s the bare minimum for functional corporate governance in 2026.
Digital competence in the supervisory board is no longer a trend-it’s a measurable value driver and a regulatory obligation. The MIT study quantifies the difference: 10.9 percentage points in return on equity. The German Corporate Governance Code recommends basic AI knowledge. The European AI Regulation turns this into a liability issue from 1 August 2026. And 60 % of German supervisory boards aren’t prepared. For nomination committees, this means the next board appointment must include targeted digital expertise. For existing bodies: training and structural changes now-not after the first fine.
No. The DCGK’s practical guidance calls for foundational knowledge, not expert-level expertise. Supervisory board members must grasp what AI can and cannot do, identify risks, and understand how the company manages them. At least one member should possess deep expertise.
No, a practical guidance is a recommendation rather than a formal code amendment. There is no “comply-or-explain” obligation. However, it signals the direction and is increasingly reflected in assessments by institutional investors and proxy advisors.
The DCGK recommends AI competence; the AI Act mandates it. From August 2026, companies deploying high-risk AI systems must demonstrate robust governance structures. Supervisory boards aligned with the DCGK guidance are better prepared for the AI Act. Those ignoring both risk reputational damage and fines of up to €35 million.
Through specialized executive search firms (Russell Reynolds, Spencer Stuart, Egon Zehnder) that increasingly maintain tech profiles in their databases. Other options include former CTOs, CIOs, or CDOs of DAX companies, startup founders, or professors with applied AI research.
Training programs range from €5,000 to €15,000 per member per year. An external AI briefing for the entire board costs between €3,000 and €8,000 per session. These figures pale in comparison to potential fines under the AI Act, which can reach €35 million.
Read more on Digital Chiefs
Digital ChiefsAI in Industry: The Next Productivity WaveDigital ChiefsMade for Germany: Why 105 Companies Are Investing €735 Billion in the LocationDigital Chiefs2026 Outlook: Top 5 Tech Decisions for C-LevelMore from the MBF Media Network
cloudmagazinGoogle Gemini in the enterprise: what the AI Act enforces mybusinessfutureAI Act from August 2026: high-risk AI in SMEsImage source: Pexels / fauxels (px:3184465)