1 min read
AI Governance in Small and Medium-Sized Enterprises: Role Model and 4-Week Plan
41 percent of German companies use AI, but only 21 percent have a strategy. And only 37 percent have clearly defined responsibilities. Starting...
9 min read
Lisa Lokotsch
:
September 9, 2026
Table of Contents
Up to 83 percent of all AI projects fail. Not because of the technology, but because of the people who are supposed to use it. Only 27 percent of German companies provide AI training to their employees. And 45 percent see no need for it. Those who implement AI without considering employee training and change management end up paying twice: once for the tools, and once for the lack of benefits. This article explains why training on the tools alone isn’t enough and how companies can truly make AI enablement work.
At first glance, the figures from the Bitkom AI Study 2026 read like a success story. 41 percent of German companies are using AI productively—more than double the figure from just one year ago. Another 48 percent are planning to implement it. But a closer look reveals a different picture.
Fifty-three percent of the companies surveyed cite a lack of AI expertise within their teams as the biggest hurdle to AI implementation. And only 8 percent of companies actually provide training to all employees. As a result, AI is being purchased but not used effectively.
The 2026 TÜV Continuing Education Study provides further insight. Only 27 percent of companies with 20 or more employees are actively providing training in AI skills. Nearly half (45 percent) currently see no need for such training at all. The gap between large and small companies is striking: While 49 percent of large companies with 250 or more employees have already trained their teams, the figure is only 21 percent for companies with 20 to 49 employees.
In concrete terms, this means: tools are being rolled out, licenses are being distributed, and prompts are being tested. However, in many cases, no one on the team knows what a model is actually capable of, where it falls short, and how it can be safely integrated into their daily work.
A lack of competence is not a minor issue. It manifests itself on four levels, all of which have a direct impact on the bottom line.
1. AI projects are failing in droves. Analyses from 2026 unanimously put the figure at around 70 to 83 percent: that’s the rate of AI projects that either never go live or are discontinued after go-live. The main reason is rarely the technology itself. It’s resistance from the workforce, a lack of defined roles, unclear processes, and leaders who don’t support the implementation.
2. Shadow AI is escalating. Those who aren’t empowered seek out tools on their own. Recent surveys show that by 2026, 66 percent of all office workers will be using AI tools without official approval (PagerDuty/Wakefield 2026). Already, 27 percent have entered confidential company data into public AI services (Salesforce)—including customer lists, financial figures, and strategy documents. According to IBM’s Cost of a Data Breach Report, the additional cost per incident involving shadow AI amounts to $670,000.
3. Resistance is becoming apparent. Several surveys from 2026 paint a clear picture: A large proportion of companies report employee resistance to AI, yet only a minority has a genuine change management strategy to address it. Where leadership is lacking, fears fill the void: fear of losing one’s job, fear of losing control, and fear of one’s own ignorance.
4. Leadership is lacking. Only 2 percent of German companies have embedded AI at the executive board level. None of the other 14 countries compared in the Deloitte study ranks lower. And when AI isn’t on the leadership’s agenda, there’s no one to demand, prioritize, or allocate resources for it.
![]()
Anyone who still insists there is “no need” should take a look at the law. As of February 2, 2025, Article 4 of the EU AI Act requires all providers and operators of AI systems to ensure, “to the best of their ability,” that their employees and contractors have sufficient AI expertise. Starting August 2, 2026, national market surveillance authorities will actively enforce the AI Act.
It’s important to understand: Article 4 does not prescribe a fixed curriculum. It requires organizational responsibility. Training, internal guidelines, advocacy programs, clear usage instructions—it all counts, as long as it demonstrably contributes to competence. What is non-negotiable is that something must be done.
Training is mandatory for everyone who works with AI in a professional context. This includes full-time employees, working students, interns, freelancers, external service providers, and management, if they are responsible for AI-related decisions. The content must cover, at a minimum, how AI works, its limitations, risks, data protection, and safe use in one’s own daily work.
Anyone who does not yet have a documentation system in place should establish one by summer 2026. Not just because of the fines, but because documenting competence forces you to develop it in the first place.
The most common reaction after a management-led AI initiative: “Let’s book a Copilot workshop.” Two hours—everyone sees prompts and screenshots, and there’s a bit of a “wow” factor. And then? Usually, nothing. Three weeks later, usage has dropped off again.
The reason is well documented. McKinsey puts it unequivocally in its latest analysis, “Redefine AI Upskilling as a Change Imperative”: Training alone rarely brings about lasting behavioral change. It takes three levels working in tandem for AI to take root in an organization.
Level 1: Basic understanding of AI (Awareness). What is a language model? Why does it hallucinate? What can I enter, and what can’t I? Everyone who works with AI at all needs this foundation—not as a one-time event, but as an ongoing framework.
Level 2: Role-Specific Skills. A customer service representative needs different skills than a software developer. Management needs yet others. Role-specific training embeds AI in real-world work processes, not in sample prompts from the internet.
Level 3: Adoption and Behavior. Even well-trained employees fall back into old patterns without guidance. The team needs champions, systems to drive demand, visible successes, and leadership that demands and celebrates its use. That’s change management, not continuing education.
Omitting any of these levels wastes the investment in the other two. Pure tool training without change management fails at implementation. Change management without competence leads to frustration. Competence without a fundamental understanding produces the next wave of “shadow AI.”
A pragmatic model for German SMEs can be derived from the recommendations of McKinsey, Prosci, and Deloitte. It does not require a Chief AI Officer and can be integrated into existing training and communication structures.
Level 1: Basic AI Competency for Everyone.
A half-day introductory module for the entire workforce. Content: How generative AI works, common types of errors, data protection and handling of company data, and the company’s internal approved list of AI tools. Result: Everyone speaks the same language; everyone knows the red lines. Time commitment: 3 to 4 hours per employee, one-time session plus an annual refresher module.
Level 2: Role-Specific In-Depth Training.
Separate formats for business units, leadership, and engineering. Business unit sessions (e.g., for marketing, sales, HR, customer service) use specific prompts and workflows from everyday operations. Leadership sessions focus on strategy, governance, and ROI assessment. Developer sessions delve deeply into coding assistants such as GitHub Copilot, Claude Code, or Cursor. Time required: 4 to 8 hours per role, in person or remotely.
Level 3: Adoption and Support.
This is the part that almost everyone underestimates. What matters here: AI advocates within the teams (not as a full-time role, but as a 5–10 percent commitment alongside daily work), regular peer-learning sessions (30-minute slots every two weeks), visible leadership communication, in-house success stories, and an accessible way to ask questions. Time commitment per champion: about 2 to 4 hours per month.
Additional building blocks that determine success or failure in day-to-day enablement: an in-house prompt library with proven use cases from the company’s own context (not from the internet), a community of practice for sharing experiences across departmental boundaries, and an AI component in the onboarding of new employees, so that expertise doesn’t start from scratch with every staff change.
The key point: All three levels run in parallel, not sequentially. Anyone who completes the basic training first and then thinks about adoption months later has long since squandered the training’s impact.
Two models help with classification. The 70-20-10 rule from learning research states: Only about 10 percent of learning occurs in formal training, 20 percent through exchanges with colleagues, and 70 percent in real-world work situations. So, if you focus solely on Level 1, you’re addressing only one-tenth of the learning potential. And for those familiar with ADKAR (Awareness, Desire, Knowledge, Ability, Reinforcement) from change management: Level 1 provides awareness and knowledge, Level 2 provides ability, and Level 3 provides desire and reinforcement. Without the final stage, any investment in the previous stages remains ineffective.
A realistic approach for companies with 50 to 1,500 employees. It requires neither a full-time project team nor fundamental decisions from senior management. It does, however, require a sponsor who will approve the framework.
Weeks 1–2: Assess the current situation.
Brief assessment: Which AI tools are already in use (including unofficial ones)? Which roles are already working with AI today? Where are there real-world use cases that deliver value? Result: an honest roadmap, not a fantasy plan.
Weeks 3–4: Approved list and usage policy.
Before training begins, it must be clear what is actually permitted to be used. A brief usage policy (two pages) plus a list of approved tools lay the foundation. If you skip this step, you’ll be training employees on tools they won’t be allowed to use the very next day.
Weeks 5–8: Roll out basic training.
A half-day format for everyone. In larger organizations, conduct training in waves; in smaller ones, hold one or two sessions. Important: Conduct this training shortly after the first tools are approved; otherwise, the impact will be lost. At the same time, identify and train key advocates.
Weeks 9–10: Role-specific in-depth training.
Two to three pilot programs with specific target groups. For example: the marketing team, software development, and customer service. At the end of each session: a concrete use case that participants can implement in their daily work.
Weeks 11–12: Establish an adoption framework.
Schedule peer-learning sessions (every two weeks, 30 minutes). Collect success stories and share them internally. Provide a brief leadership update during team meetings. From this point on, this rhythm will ensure that AI is permanently embedded in everyday work.
After 12 weeks, you will have: a clear user base, everyone trained in the fundamentals, pilot projects with role-specific depth, and an adoption structure that continues to function. This isn’t perfection. It is a solid starting point that will suffice for compliance with the AI Act in August 2026 and lays the foundation for real benefits.
Just as important as the approach is measurement. After 12 weeks, you should see concrete indicators: the percentage of active AI users per week (target: at least half of the trained workforce), documented use cases per team, a measurable reduction in shadow AI usage compared to the baseline in weeks 1–2, and the activity of the influencers (participation in peer-learning sessions). Without these indicators, you won’t know whether your investment paid off or was wasted.
![]()
1. A workshop, then radio silence. The classic scenario. A kickoff workshop, a large group, lots of enthusiasm. Then nothing. Without follow-up support, usage drops back to the initial level within four to six weeks.
2. Training without authorization. Employees learn about ChatGPT but aren’t allowed to use it productively. The result: frustration and the next wave of shadow AI. Authorization and training must happen simultaneously.
3. Just technology, no role-based perspective. A prompt engineering course for everyone is of little use to the procurement clerk. She needs concrete use cases from her everyday work. Role-specific in-depth training is the key to making an impact.
4. Managers are left out. If you don’t include executive and middle management in the training, you create a two-tiered situation. Teams learn about AI, but their supervisors can’t evaluate the results. Adoption plummets because leadership isn’t on board.
5. No documentation, no accountability. Without documentation of who completed which training and when, organizations cannot justify their compliance with the AI Act or demonstrate accountability internally. A simple learning log is sufficient. Excel is enough if no LMS is available.
prodot has been active for over 20 years as a digital transformation partner for medium-sized and larger companies. To build an effective AI enablement program, we provide four building blocks that contribute to the 3-level model.
An AI workshop for businesses as a starting point. Before training begins, it must be clear where your company stands and which use cases offer the greatest impact. Our AI workshop for businesses provides exactly this foundation: one day of concrete use cases and a prioritized roadmap.
Role-Specific AI Training. Our role-specific AI training programs are deliberately structured around specific roles. We combine formats for employees in line-of-business departments, for executive management, and for software development. All formats are practical, compliant with the EU AI Act, and can be conducted on-site or remotely.
Tool-specific in-depth training. For companies that already rely on specific tools, we offer in-depth training on Microsoft Copilot and Claude Code. Hands-on, with real tasks from your day-to-day work.
Bringing governance and adoption together. Anyone designing training programs should consider governance as part of the process. We’ve described what a streamlined AI role model for small and medium-sized businesses looks like in our article on AI governance for SMEs. Both topics are intertwined: without governance, there’s no framework; without expertise, there’s no implementation.
Anyone who implements AI in their company in 2026 without simultaneously building expertise and supporting change will be part of the clear majority whose projects will fail. Not because the models are bad, but because people only use tools when they understand them, are allowed to use them, and are encouraged to do so.
The good news: This isn’t a massive undertaking. A well-structured, three-tiered enablement program can be launched in a single quarter. It requires an approval list, basic training, role-specific advanced training, and an adoption framework that runs alongside day-to-day operations. No more, but also no less.
And starting August 2, 2026, there will be a second reason not to wait: the active enforcement of the EU AI Act. Anyone who doesn’t have a compliance framework by then will face a regulatory problem. Those who do will have a documented head start over the majority of the market.
Do you want to implement AI training and change management for your company but don’t know where to start? Talk to us. In a free initial consultation, we’ll assess your current situation and outline the right roadmap for your team.
1 min read
41 percent of German companies use AI, but only 21 percent have a strategy. And only 37 percent have clearly defined responsibilities. Starting...
1 min read
In 2026, AI automation will be the key to not only speeding up processes but also fundamentally transforming them. While traditional workflow...
1 min read
95 percent of all generative AI projects do not deliver a measurable ROI. Among German small and medium-sized enterprises, only a few make the...