AI documentation in mid-sized companies: three documents

Whoever asks gets an answer

Almost every company can say that it uses AI. Far fewer can show which tools those are, what they are used for and who is responsible for them.

Since the summer, there has been a body that can ask these questions. Under the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) (AI Market Surveillance and Innovation Promotion Act, in German), in force since 29 July 2026, the Bundesnetzagentur (Federal Network Agency) is in principle the market surveillance authority for the AI regulation in Germany. Specialist authorities remain responsible for certain areas.

We take this as the occasion to put the documentation in order. The same questions come from management, data protection, the works council or a major customer anyway.

How to get an overview of your AI tools in the first place is covered in our practical check on the AI inventory. This article picks up from there: with three documents you can produce without having to create them first. And with the question of who keeps them up to date.

One question before every row

Before a tool goes into the register, we ask one question:

Are we using this tool the way the vendor offers it: under the vendor's name, without modifications and for the intended purpose?

If yes, we record that. If no, we note what differs and have the use legally reviewed before the tool is expanded any further. The same applies to systems you developed yourself or commissioned.

The AI Act distinguishes here between "deployers" and "providers" (definitions in Article 3 of the AI regulation). Which role you have for which tool is a legal question. The entry question only makes sure the deviations are on the table before anyone assesses them.

A typical case for a no: a general writing assistant suddenly starts pre-sorting applications in the HR department. That does not require a management decision. A business unit solving a problem pragmatically is enough.

Document 1: The AI register

For us, an AI register is the foundation of all further work. Without a list, you can show neither who has been trained nor where customers come into contact with AI.

If you have already built the AI inventory, extend it to eight columns. Each row describes exactly one system in one specific use. If marketing uses a tool differently from sales, that is two rows.

Column	What goes in it
System and vendor	Product, vendor, plan. Also AI features in existing software, for example in the CRM.
Purpose	One sentence: what the system does in your company and for whom. "Draft replies in customer service" rather than "productivity".
Responsible function	A role, for example head of customer service. "IT" does not count.
Entry question	Yes or no; if no, with a short note on what differs.
Sensitive use case?	Does the tool assess people (applications, credit, performance) or analyse voice, facial expressions or mood? Then: legal review, yes or no.
Emotions and biometrics	Yes or no, date, who checked.
Customer contact	Do customers or the public see what the tool produces? Linked to document 3.
Status	Last review and next date.

The "emotions and biometrics" column

We always flag tools that analyse the voice, facial expressions or mood of employees or customers for legal counsel. The AI Act contains both prohibitions and information obligations on this (Articles 5 and 50 of the AI regulation). For CX teams this is the most important checkpoint, because sentiment analysis in a call centre can arrive as an inconspicuous add-on feature. Data protection and co-determination (the works council's rights) also belong at the table early for tools like these.

If the review finds nothing, that is good. A documented no with a date is an answer. "We haven't looked" is not.

Where the entries come from

A register built only from licences and purchase records stays incomplete. Private accounts with chat assistants and features switched on by an update do not show up there. Ask the business units directly. Tell them beforehand that this is a stocktake and that nobody needs to fear sanctions. Otherwise you will be missing exactly the entries you most urgently need to talk about.

Document 2: AI literacy, documented as well as trained

Many companies have run an AI training session. If someone asks, though, what helps more is being able to show who learned what and why exactly that fits their work.

The AI Act's literacy rule is in Article 4 and was revised by the AI Omnibus (Regulation (EU) 2026/1744). The Bundesnetzagentur makes clear that neither an AI officer nor certified training is mandatory. It does, however, explicitly recommend documenting the measures thoroughly.

What goes in the folder

Literacy matrix. Rows: roles or departments. Columns: the tools from your register. Each cell holds what this group should know about this tool: its limits, how to handle customer data, when a result gets checked. Accounting, which has AI extract data from invoices, needs different knowledge from marketing, which generates images.
Training content per row. One slide deck for everyone won't do. Think instead: how do I check an AI summary for errors? Which customer data must not go into a public tool?
Attendance list. Who completed which module and when. New employees and new tools trigger a new entry.
Usage policy. Two pages: which tools are approved, which data is off limits, who approves new tools, how results are checked.

Training is connected to everything else. Whether a team configures an AI notice in the chat correctly or checks a generated image before approval depends on whether it knows what to look out for. A dated training session and a written policy show that. "We talked about it once" does not.

Document 3: Where customers encounter AI

This document is the closest to the customer: website, marketing, service. Our position is simple. Customers should know when they are writing to a machine and when an image or a voice has been artificially generated. The notice in the chat itself is the subject of the article on the AI notice in customer service.

For each touchpoint, we ask three questions:

Where does your company show AI content externally? Chatbot, generated images and videos, synthetic voices, AI-assisted texts in the blog, newsletter or press releases.
Who approves it? One named person per channel, with a documented review: who read the content and who is accountable for it.
What does the vendor say about labelling? In writing, filed in the folder.

How labelling should look in detail is described in the European Commission's guidelines on Article 50. In addition, there is a Commission code of practice on labelling AI-generated content, published in June 2026. Both are worth a look before you go through your touchpoints. Whether and how a rule applies to a particular channel is for your legal counsel to clarify.

Questions for every vendor

Your customer sees your company, and the vendor of the tool stays invisible to them. So check for yourself before a tool goes live, and clarify in writing:

How is the AI notice in the chatbot implemented, and is it visible to your customers?
Whether, and from when, generated images, audio and texts are labelled in a machine-readable way.
That the vendor will inform you if anything changes in these functions.

File the answers in the folder. If you use AI in recruitment or in decisions about credit and payment terms, you should also have that use legally clarified early and note the result in the register.

A well-ordered folder in four weeks

The work is not small. With a fixed sequence, though, it can be done in four weeks. The folder is a working state and does not prove full legal compliance. Data protection, employment law and competition law need to be checked separately.

Week 1: register. Survey all business units, including AI features in existing software and privately created accounts. Every tool goes into the register with all eight columns, and every tool gets the entry question. Everything marked "legal review" goes to legal counsel as a list. Result: a first version that management has seen.

Week 2: literacy matrix and usage policy. A matrix of roles and tools, training based on actual use, an attendance list with date and content. Management signs the policy.

Week 3: touchpoints. Go through each customer touchpoint one by one: website, chatbot, newsletter, automated emails, social media, support. For each one, the three questions from document 3. In parallel, the enquiries go out to your vendors.

Week 4: folder and responsibilities. The folder holds the register, matrix, training content and attendance list, the policy, the touchpoint check and the vendor correspondence. Each document gets a status, a responsible person and a next review date.

Role	Responsibility
Management	Approves the plan, names the people responsible, arranges legal review of open points, signs the policy.
IT	Technical view of the register, AI features in existing software, vendor correspondence.
Data protection	Alignment with the data protection documentation, coordination on tools that analyse voice, facial expressions or mood.
Business unit	Reports the tools it uses, names people responsible, checks its own touchpoints.

Keeping the folder from going out of date

A register that is correct in March already has gaps by September. New tools arrive through trial accounts, and vendors switch on AI features with updates. Maintenance therefore needs a fixed place in the calendar, just like the initial build.

For this, we set out:

An owner for the register. One person who accepts entries, follows up and calls the review meeting. The business units remain responsible for their rows, but the whole thing needs a name.
Fixed triggers. A new tool, a new AI feature in existing software, a new purpose for an existing tool. Each of these leads to a new or changed entry before the use starts.
A fixed review date. One recurring date in the calendar, for all rows at the same time: is the purpose still right? Is the responsible person still with the company? Is the tool in the literacy matrix? Is the vendor's answer on file? You set the frequency yourself. It should be in the calendar and should not depend on goodwill.

No second layer of administration

If you keep a record of processing activities under the GDPR, some AI tools are probably already listed there. The data protection record is organised by processing activity, the AI register by system. We keep the two separate but linked: with cross-references, the same responsible people and the same review cycle. That way, AI documentation hangs on a framework the company already has.

For questions you cannot resolve internally, the Bundesnetzagentur's AI service desk can help. It is explicitly aimed at SMEs as well (in German).

The self-test

The test is short. Take your register and go through each row: is the entry question answered? Is there a responsible person? Is the tool in the literacy matrix? Is the touchpoint documented, including the vendor's answer? Is there a next review date? Every no is a work step.

If business units use their own solutions, or nobody in the company can drive the register, we build the register and responsibilities together with you in the AI Diagnostic. Legal review of individual cases stays with your legal counsel.

How long would it take you today to say which AI is running in your company and who is responsible for it?

Frequently asked questions

Who is responsible for supervising the AI regulation in Germany? According to the KI-MIG, in principle the Bundesnetzagentur, since 29 July 2026. Specialist authorities remain responsible for certain areas.

Who should maintain the AI register? A named person as owner, who accepts entries and calls the review meeting. An obvious choice is whoever already keeps the data protection record or the software inventory. The business units remain responsible for their own rows.

How often should we review the register? On a fixed date for all rows, and additionally at every trigger: new tool, new AI feature, new purpose. How often the fixed date comes round is your decision, based on the size and pace of change of your set of tools.

What do we do with tools that business units introduced themselves? Add them to the register, without blame. The survey only works if nobody needs to fear sanctions. After that, the responsible person decides whether the tool is approved, replaced or switched off.

Where do we get a binding answer to a legal question? From your legal counsel. For general questions about the AI regulation, the Bundesnetzagentur offers an AI service desk, which is also aimed at SMEs.

This article describes our practical perspective. It does not contain a legal assessment; for that, we refer you to the linked primary sources and your legal counsel.

AI documentation in mid-sized companies: three documents that let you answer questions at any time