Ahead of the Next AI Act Phase: Transparency Gaps at Germany’s Largest Companies
How do German companies disclose their rules for the use of artificial intelligence? In our recent study, we analyzed 48 companies from three groups – DAX-40, online shops, and credit agencies – using a 10-point criteria catalogue for publicly documented AI governance. The assessment did not evaluate how well companies actually use AI, but exclusively how transparently they communicate their AI governance rules to the public. The result: 13 of the 48 companies surveyed do not publicly communicate their AI governance at all. On average, the companies examined scored 4.1 out of a possible 10 points.
Online shops communicate most openly, credit agencies the least
With an average score of 4.6 points, the online shops examined perform best in the group comparison, closely followed by the DAX-40 companies with 4.2 points. The credit agencies bring up the rear with an average of 1.3 points: of the three credit agencies examined, Schufa Holding AG and Creditreform Boniversum GmbH show no publicly findable AI governance documentation whatsoever, while only CRIF Bürgel GmbH achieves a solid average with 4 points. Among the online shops, Amazon leads with 9 points, followed by eBay with 8 and Otto with 6 points. About You and MediaMarktSaturn, by contrast, score 0 points.
Technology sector and telecommunications lead the way, logistics scores zero transparency points
On average, technology & software and telecommunications perform best with 8 points each, though only one company (Deutsche Telekom) is included in the telecommunications rating. These are followed by healthcare (5.7 points, 3 companies), automotive & suppliers (5 points, 5 companies), and finance & insurance (4.7 points, 6 companies). At the lower end are consumer goods & retail (0.5 points, 4 companies) and logistics & transport, where the only company examined (Deutsche Post DHL) scored zero transparency points. At the company level, Infineon and SAP share the top spot with 10 out of 10 possible points each. They are followed by Allianz, Bayer, Commerzbank, GEA Group, and Amazon with 9 points each. A total of 13 of the 48 companies examined – including Adidas, Deutsche Post DHL, Zalando, Rheinmetall, as well as About You, MediaMarktSaturn, Schufa Holding AG, and Creditreform Boniversum GmbH – scored 0 points.
Human oversight is often emphasized, the right to complain rarely
Looking at the individual criteria: over half of the companies (27 of 48) publicly state that a human retains final control over AI decisions, and 26 companies have publicly accessible AI guidelines. Concrete processes are described far less often: only 18 companies detail their AI governance structure in depth, and just eleven publicly differentiate between different AI risk levels. The biggest gap is in the complaints and review process: only two of the 48 companies publicly explain how affected individuals can challenge or have automated decisions reviewed.
“What’s striking is how differently the topic of AI governance is communicated among German companies: from a dedicated AI principles page to the complete absence of any public information,” comments Dr. Okan Tansu, Communications and technology expert at the BSBI School of Business and Innovation. “It’s hardly surprising that the technology sector communicates most transparently on average. What’s more interesting is the gap in the complaints and review process, which runs through almost all industries. While many companies emphasize that humans retain control, it remains unclear to customers and employees how they can actually challenge an automated decision. Given the phased implementation of the EU AI Act, this is exactly where companies should sharpen their approach.”
About the study
The study examined 48 companies from three groups: 40 DAX-40 companies, five online shops (Amazon, eBay, Otto, About You, MediaMarktSaturn), and three credit agencies (Schufa Holding AG, CRIF Bürgel GmbH, Creditreform Boniversum GmbH). The basis was exclusively publicly accessible communication on official company websites (including blogs, news, and trade articles), with no external sources or third-party press releases. Based on ten criteria (1 point for “yes,” 0 points for “no”), an overall score of 0 to 10 was calculated for each company. For the industry comparison within the DAX-40, an average score per industry was calculated; since the number of companies per industry ranges from one (telecommunications, logistics & transport) to six (finance & insurance, chemicals & pharmaceuticals), the values for smaller industries should be interpreted with corresponding caution. General explanatory or use-case content (e.g., descriptions of where AI is used within the company) was only counted if it specifically related to the company’s own governance or implementation; mere statements of intent or general references to the EU AI Act without reference to the company’s own compliance did not count. Only public documentation was assessed, not the actual internal implementation of AI within the company. Survey period: July