Widespread AI-Related Cybersecurity Risks Prompt Calls for Stronger Safeguards in German Companies

A recent study conducted by TÜV-Verbands and the Federal Office for Information Security (BSI) reveals that artificial intelligence (AI)-driven cyberattacks are an increasing threat to German businesses. One in six companies reported experiencing cyberattacks or fraud attempts involving AI in the past year. Of these, 17% confirmed attacks, including 4% confirmed and 11% suspected incidents. Phishing emails manipulated by AI were the most common attack vector, affecting 90% of targeted companies. Additionally, 40% encountered automated attack scripts exploiting IT vulnerabilities, and 11% reported the use of AI-generated deepfakes to impersonate executives in fraudulent financial transactions.

Despite the rising dangers, security preparedness remains inadequate: only 31% of AI-using companies employ AI to bolster IT security, and merely 11% have established AI-specific protocols for incident response. Most companies maintain conventional IT security processes without dedicated AI-related measures, leaving them vulnerable to evolving threats. Nearly half (49%) of German companies currently utilize AI technologies, while 9% expect to adopt AI within a year. Concerns about data protection (53%) and insufficient perceived benefit (58%) deter the remaining 42% from AI use.

The study underscores the urgency for companies to adapt their cybersecurity frameworks to address AI-specific challenges. Dr. Dirk Stenkamp of TÜV-Verbands emphasized the importance of integrating AI scenarios into security protocols, warning that current protections are insufficient. BSI Vice President Thomas Caspers highlighted the strategic significance of AI and the necessity for all businesses, irrespective of AI use, to proactively manage the risks from AI-enhanced cyberattacks. Training for employees on secure AI usage is provided by 56% of companies, and 67% enforce quality assurance for AI outcomes.

Simultaneously, regulatory developments are shaping the AI security landscape. The European Digital Omnibus, effective since July 27, 2026, amends the AI Regulation by postponing high-risk system obligations to December 2, 2027, and August 2, 2028, depending on application areas. Annex III covers sensitive sectors like personnel management, credit assessment, and critical infrastructures. Notably, the amendment narrows the definition of safety components that trigger high-risk classification. This evolving regulatory framework aims to strengthen oversight as German companies navigate the complex interplay of AI innovation and cybersecurity risks.

To support these efforts, the German government has initiated the creation of a national competence and evaluation institution dedicated to AI security, reinforcing the need for robust defenses against AI-based cyber threats. Many companies acknowledge the value of independent audits and certifications, with 69% expecting these to enhance AI security practices and trust.

This confluence of rising AI-driven cyberattacks and evolving regulatory measures highlights a critical juncture for German enterprises to elevate their cybersecurity strategies to effectively counter AI-related threats while complying with forthcoming legal requirements.