Implementing AI in the Workplace
Which steps have proven effective and what the legal requirements will be in 2026
The short answer
57 percent of companies in Germany now use AI. This is according to a Bitkom survey conducted on September 14, 2026; two years ago, the figure was 20 percent. However, none of the users surveyed believe they are fully tapping into AI’s potential. Many have purchased licenses without adapting their processes. Anyone who wants to introduce AI into their company therefore needs a plan that goes beyond simply selecting the right tools.
This article explains why secure AI access for everyone is the first step, which use cases are suitable, what the works council and the AI Act require, and how to proceed in six steps.
5 key takeaways
- Access for everyone first: An enterprise tool for all employees prevents “shadow AI.” According to the IW, 29.1 percent of professional AI users rely on tools not provided by their employer.
- Involve the works council early on: AI tools that log inputs and usage are generally subject to co-determination under Section 87 of the Works Constitution Act (BetrVG).
- Provide training before rollout: 91 percent of AI users train their employees. Article 4 of the AI Act requires the promotion of AI literacy.
- Select pilot projects based on utility: Frequent tasks with good data availability are best suited. You can measure success, for example, by the processing time per transaction.
- Keep an eye on the AI Act: The disclosure requirement for chatbots takes effect on August 2, 2026. Requirements for high-risk AI take effect on December 2, 2027.
Where do German companies stand in terms of AI adoption?
The majority are already using AI, but most do so only on an ad hoc basis. According to Bitkom, 57 percent of companies with 20 or more employees use AI, and another 38 percent are planning or discussing its use. By their own estimates, only 3 percent are making significant use of its potential.
For companies that are already using AI, the main hurdles lie in legal and organizational issues. They cite data protection (66 percent), legal uncertainty (56 percent), and costs that are difficult to estimate (54 percent) as the biggest obstacles. Bitkom President Ralf Wintergerst comments: “If you just buy a license, you’ve purchased AI, but you haven’t changed anything yet.” Implementation therefore involves use cases, rules, employee participation, and training.
Why do all employees need access to secure AI tools?
Employees are already using AI. Providing official access to everyone prevents company data from ending up in personal accounts. According to an IW survey conducted on September 19, 2026, 29.1 percent of professional AI users work with tools not provided by their employer. With this “shadow AI,” the company has no contract with the provider and no oversight of what customer data or internal documents are being entered.
The most important first step, therefore, is to implement an enterprise-grade tool for all employees, such as Microsoft 365 Copilot, ChatGPT Enterprise, or Claude Enterprise. According to the providers, these versions do not use company data for training by default. Your IT department manages access and permissions in one central location. Bans alone are of little help: If you have a good official tool, you don’t need a private one. With a brief AI policy and basic training, your teams can then use AI safely in their day-to-day work.
Which use cases are suitable for getting started?
Tasks that are frequently performed, involve a lot of text or research, and whose results can be quickly reviewed by a human are suitable for the initial rollout. Examples include meeting minutes, draft proposals and emails, internal knowledge searches, and the evaluation of customer inquiries. Decisions involving people do not belong in the initial pilot. According to the AI Act, AI systems used for selecting applicants are considered high-risk.
Evaluate each idea based on five criteria:
| Kriterium | Leitfrage | Gutes Signal für den Start |
|---|---|---|
| Häufigkeit | Wie oft fällt die Aufgabe an? | Gutes SignalTäglich oder wöchentlich in mehreren Teams |
| Zeitaufwand | Wie viel Arbeitszeit bindet sie heute? | Gutes SignalEin spürbarer Teil der Wochenarbeitszeit |
| Datenlage | Liegen die nötigen Informationen digital vor? | Gutes SignalDokumente oder Systeme mit geklärten Zugriffsrechten |
| Prüfbarkeit | Kann ein Mensch das Ergebnis schnell kontrollieren? | Gutes SignalEine Fachkraft erkennt Fehler in wenigen Minuten |
| Risiko | Betrifft das Ergebnis Personen oder Verträge direkt? | Gutes SignalNein, die KI liefert Entwürfe und Menschen entscheiden |
What does the works council have a say in when it comes to implementing AI?
If there is a works council, you must inform it in a timely manner about the planned AI applications. Section 90(1)(3) of the Works Constitution Act (BetrVG) has expressly required this since 2021. A genuine right to co-determination arises under Section 87(1)(6) of the Works Constitution Act (BetrVG) if a system is objectively capable of monitoring employees’ behavior or performance. This applies to many enterprise solutions that log user input and usage. You may not introduce such a tool without an agreement with the works council or a ruling by the conciliation board.
The works council may consult experts for the assessment. In the case of AI, this is required under Section 80(3) of the Works Constitution Act (BetrVG). In practice, a framework works agreement has proven effective. It establishes principles such as performance monitoring and data access on a one-time basis. New use cases can then be added without having to establish an entirely new procedure.
How do you build AI expertise within your teams?
What does the AI Act require following the AI Omnibus?
The EU AI Regulation has been largely in full effect since August 2, 2026, but was amended shortly before that date. The AI Omnibus (Regulation (EU) 2026/1744) has been in effect since July 27, 2026. For companies that use AI, three points are relevant:
- AI Competence (Art. 4): Companies must promote AI competence among their staff. They are no longer required to guarantee a specific level of competence. However, they should still document training and guidelines.
- Transparency (Art. 50): As of August 2, 2026, people must be able to recognize that they are speaking with a chatbot. Deepfakes must be disclosed. Our article on the AI labeling requirement explains the details.
- High-Risk AI: The obligations for systems listed in Annex III—such as those used in recruiting—will not take effect until December 2, 2027.
In Germany, the Federal Network Agency, as the competent market surveillance authority, monitors compliance.
How do you implement AI in six steps?
Plan the rollout as a program with fixed decision points. This sequence has proven effective in our projects:
- Zugang für alle schaffenCopilot, ChatGPT oder Claude Enterprise für alle Mitarbeitenden
- Alle schulenBasisschulung zu Prompting und sicherem Umgang mit Daten
- Ziele klärenVerantwortliche Person und messbare Geschäftsziele benennen
- Anwendungsfälle wählenHäufige, prüfbare Aufgaben mit guter Datenlage priorisieren
- Pilot testen8 bis 12 Wochen mit Kennzahlen wie Bearbeitungszeit
- SkalierenErfolgreiche Anwendungsfälle ausrollen und Multiplikator:innen benennen
How does ROOVER help companies implement AI?
ROOVER supports companies through each of the six steps, either individually or as part of a comprehensive program. We have supported more than 50 companies in over 65 digital transformation and AI projects and trained more than 10,000 participants. The overview shows which service is appropriate for each step.
| Step | How ROOVER Provides Support |
|---|---|
| 1. Ensuring Access for All | Governance Framework, AI Policy, and Roles in the Target Operating Model |
| 2. Train Everyone | Practical AI training for all employees, such as on Copilot and ChatGPT |
| 3. Clarify Objectives | AI Workshop for Management and the Development of an AI Strategy |
| 4. Select Use Cases | Identifying AI Use Cases and Evaluating Them Based on Benefits and Effort |
| 5. Test the pilot | Collaborate with technology partners on AI implementation |
| 6. Scaling | AI transformation and change management, as well as training internal champions through our AI trainers |
If there is no one within the organization responsible for this area, a Chief AI Officer will take over management on an interim basis until the role is filled. You can find examples from projects at medium-sized companies and large corporations in our client projects.
Frequently Asked Questions About Implementing AI
FAQ on Implementing AI in Your Business
For an initial pilot with a clearly defined use case, you should plan on about three months. This includes coordination with the data protection team and the works council, as well as training for the pilot group. The company-wide rollout will then follow in phases, one use case at a time.
That depends primarily on your IT environment. Microsoft 365 Copilot works directly within Word, Outlook, and Teams. ChatGPT Enterprise and Claude Enterprise are standalone assistants that are also suitable for more in-depth analyses. For each solution, review the data processing agreement and verify that your data is excluded from the training process.
There is no set fee. According to Bitkom, AI users cite infrastructure such as the cloud and computing power (51 percent), data preparation (50 percent), and integration into existing systems (41 percent) as major cost drivers. Licenses (21 percent) and training (19 percent) are mentioned less frequently. Plan your budget on a per-use-case basis.
Article 4 of the AI Act requires companies that use AI in their professional activities to promote AI literacy among their staff. Since the AI Omnibus Act, they are no longer required to guarantee a specific level of proficiency, and no fines are provided for under Article 4. Documented training remains the most reliable form of evidence. Our article “Building AI Competence” shows you how to go about this.
It is not required by law, but it provides clarity for all employees. A good policy specifies which tools are permitted, what data may be included, how results are verified, and who the point person is. With the works council’s approval, it can be incorporated into a company agreement.
Questions about implementing AI?
Oliver Breucker answers your questions about implementing AI in your company.
Sources
- Bitkom: For the First Time, a Majority of Companies Are Using AI (September 14, 2026)
- Regulation (EU) 2026/1744 (AI Omnibus), EUR-Lex
- Regulation (EU) 2024/1689 (AI Regulation), EUR-Lex
- Section 87 of the Works Constitution Act (BetrVG): Co-determination rights
- Section 90 of the BetrVG: Rights to Information and Consultation
- Section 80 of the BetrVG: General duties of the works council
- Federal Network Agency: Press Release on the Implementation of the AI Regulation (July 29, 2026)
- IW Cologne: Shadow AI. Employees Are Faster Than Their Companies (September 19, 2026)
Researched with AI support, editorially reviewed by Oliver Breucker.
As of November 4, 2026.
This article provides an overview and is not a substitute for legal advice.
About the Author
Oliver Breucker
Managing Director ROOVER
Oliver Breucker ist Experte für KI-Transformation bei Roover und ehemaliger Strategieberater von Roland Berger. Mit Expertise vom MIT unterstützt er Unternehmen bei KI-Strategien und digitalem Erfolg.
You might also be interested in
AI Tools & Tutorials 18. November 2025 18 Min. Lesezeit Prompting Guide für Unternehmen How to get better AI results with clear prompts Robin Reuschel Experte für KI-Strategie & Organisation The short answer The short answer Prompting is not a “nice-to-have” in the company, but a core competence: those who
AI has been around for a long time in many companies, just not officially. Employees are trying out tools such as ChatGPT or Gemini to write emails faster, revise texts or get help with research. This is understandable, as it saves time. At the same time, however, nobody knows exactly