AI risks and challenges

Risk landscape

What risks does AI pose for companies?

AI risks include erroneous results, legal violations and reputational damage. The Allianz Risk Barometer 2026 ranks AI second among global business risks, up from tenth place the year before.

3,338 risk management experts from 97 countries rate AI as one of the biggest business risks (32 percent). At the same time, according to the Bitkom study 2025, 41 percent of companies in Germany already actively use artificial intelligence.

Operational risks

Hallucinations, faulty data analyses and a lack of system reliability directly endanger business processes. Wrong AI results in customer advice, contract drafting or quality control cause financial damage.

Added to this is the creeping loss of internal expertise. Teams that rely too heavily on AI output unlearn the critical review of results.

Legal risks

The EU AI Act obliges companies to comprehensive documentation and risk assessment from August 2026. Violations carry fines of up to €35 million.

The GDPR additionally covers data protection violations by AI systems. AI applications in human resources, in lending and in automated decisions place high demands on AI and data protection.

Reputational risks

Discriminatory AI decisions damage a company's image for a long time. A recruiting tool that systematically disadvantages female applicants, or a chatbot giving wrong health advice, destroys the trust of customers and the public.

Deepfakes further intensify the reputational risk: faked videos of executives or manipulated corporate communications influence share prices and business relationships.

Misinformation

What are AI hallucinations and why are they dangerous?

AI hallucinations occur when language models generate false information that sounds correct and convincing. According to current surveys, 76 percent of data leaders struggle with such erroneous results.

What exactly are hallucinations?

Language models such as ChatGPT or Claude generate text based on statistical probabilities. They do not check whether a statement is true; they calculate the most likely sequence of words.

That is why AI systems cite non-existent sources, give wrong figures or present completely invented facts as true.

What damage do they cause?

In one documented case, a legal adviser used ChatGPT for contract drafts. The AI invented three non-existent court rulings, and the SME paid €180,000 in damages.

68 percent of data leaders in Germany expect a CEO to lose their job because of an AI-induced crisis by the end of 2026. Standard cyber insurance policies generally do not cover AI hallucinations.

How can the risk be reduced?

Human control remains indispensable: specialists check every business-critical AI output. Automated workflows without a review step carry the greatest risk.

Progress is nevertheless visible: some models reduce hallucinations by up to 64 percent compared with the previous year. Companies therefore establish clear review processes and build AI competence in their own team.

Distortions

How does AI reinforce discrimination and bias?

AI bias arises when training data contains systematic distortions and AI systems reproduce these patterns in their decisions. That affects recruiting, lending and public benefits alike.

How does AI bias arise?

Machine learning models learn from historical data. If this data reflects social inequalities, the AI adopts them as a basis for decisions.

A well-known example: one company trained its recruiting system on the CVs of existing employees. Because the workforce was predominantly male, the AI rated the gender “male” as a success factor and systematically disadvantaged female applicants.

Which areas are particularly affected?

• Recruitment: AI-supported pre-selection can structurally exclude groups of applicants
• Lending: algorithms based on historical repayment data disadvantage people who have been affected by structural discrimination
• Public benefits: risk assessment systems classify families in poverty as risk cases more often, not because of objective danger but because of greater visibility in the system

What does the AI Act require?

The EU AI Act classifies AI in human resources and lending as high-risk. Companies must prove that their systems work fairly and without discrimination.

Violations of the fairness requirements can result in fines of up to €35 million or seven percent of global annual turnover.

Security

What cyber risks arise from AI?

AI-supported cyberattacks are measurably increasing: 62 percent of organisations experienced at least one deepfake attack in the past twelve months. Social engineering fraud cases rose by 60 percent in 2025.

Deepfakes and social engineering

Deepfake technology enables attackers to imitate the voices and faces of executives deceptively well. Losses from deepfake fraud have already reached €900 million since 2019.

Particularly dangerous: in fake president attacks, attackers pose as the management via deepfake video or audio call and trigger transfers. The financial losses from this form of attack rose by 81 percent in 2025.

AI-supported phishing

Hyper-personalised phishing is becoming a constant threat in 2026: 61 percent of European companies rate it as a top risk. AI analyses publicly available information about target persons and generates tailored messages.

Unlike conventional phishing, AI-generated messages contain no typical spelling mistakes or grammatical anomalies. Recipients therefore find them much harder to detect.

How do companies protect themselves?

• Zero-trust frameworks: every access is verified, regardless of the sender
• Multi-factor authentication: especially for payment instructions and system access
• AI-supported detection systems: automated detection of deepfakes and anomalies in network traffic
• Training: regular training of all employees for social engineering scenarios

Regulation

What does the EU AI Act mean for companies?

The EU AI Act is the world's first comprehensive AI law and obliges companies to transparency, risk assessment and documentation. The rules apply regardless of company size.

Which deadlines apply?

Since February 2025, the AI Act has banned certain AI practices, including social scoring, manipulative systems and real-time biometric surveillance in public spaces.

From August 2026, the full requirements for high-risk AI systems apply. For AI in regulated products such as medical devices or vehicles, the deadline is extended to August 2027.

What must companies document?

Companies that use high-risk AI, for example in HR management, lending or critical infrastructure, establish a risk management system and demonstrate the data quality of their training data.

All employees who operate AI systems or interpret results complete documented AI training. This obligation has applied to all AI applications since February 2025.

What penalties apply?

• Prohibited practices: fines of up to €35 million or 7 percent of global annual turnover
• High-risk violations: up to €15 million or 3 percent of turnover
• False information: up to €7.5 million or 1 percent of turnover

Sustainability

How does AI affect energy consumption and the environment?

The electricity consumption of AI data centres is rising massively: according to the Öko-Institut, the energy demand of data centres will double to 945 terawatt hours by 2030, equal to the entire electricity consumption of Japan.

How high is the electricity consumption?

AI-specific hardware accounts for a growing share of total consumption. The share is rising from 14 percent in 2023 to an estimated 47 percent by 2030.

In 2025, data centres already account for about two percent of global electricity consumption. AI training, fine-tuning and inference push this figure further up.

What environmental consequences does that have?

The CO₂ emissions of data centres are rising from 29 million tonnes in 2023 to an estimated 166 million tonnes by 2030, a fivefold increase.

Water consumption also drives the environmental impact: cooling the servers is expected to use 664 billion litres of water in 2030, four times as much as today.

What does the law prescribe?

The Energy Efficiency Act (EnEfG) obliges data centres in Germany to cover at least 50 percent of their electricity needs with renewable energy from 2024 and all of it from 2027.

Especially for AI in mid-sized companies, the choice of AI provider also becomes a sustainability decision. Providers that rely on renewable energy reduce the ecological footprint of a company's own AI use.

Sovereignty

How do companies avoid AI dependency?

Vendor lock-in with AI platforms is one of the underestimated risks: the deeper companies integrate into proprietary systems, the more difficult and expensive a later switch becomes.

What is vendor lock-in in AI?

Vendor lock-in arises when companies tie their processes so closely to one AI provider that a switch becomes disproportionately laborious. In AI this risk is particularly large.

The reasons: pricing models change frequently, training data and fine-tuning results sit with the provider, and because of the rapid pace of development there are hardly any stable standards for portability.

Which dependencies arise?

• Technological dependency: proprietary APIs and data formats make switching providers harder
• Loss of competence: teams that work exclusively with one tool lose the ability to evaluate alternatives
• Cost risk: price increases hit dependent companies disproportionately
• Operational risk: system outages without manual fallback solutions lead to standstill

Which strategies help?

A multi-vendor strategy spreads the risk across several providers. Companies should design critical workflows so that they do not depend on a single AI system.

Equally important: retain core competences in-house. Employees evaluate AI results and continue processes manually in the event of outages. An AI strategy that plans for governance, costs and dependencies from the outset protects against later surprises.

FAQ

Frequently asked questions about AI risks