BSI/TÜV study: only 11% have dedicated AI incident processes

AI has entered everyday business operations, but dedicated incident processes are less common. The 2026 AI security study by BSI and TÜV-Verband finds that just 11% of companies using or planning to use AI have dedicated processes for AI-related security incidents.

Published on 7 October 2026, the study adds an organisational perspective to a discussion often dominated by new attack tools.

What the figures actually describe

The study overview also reports that 17% of all surveyed companies described confirmed or suspected AI-related cyberattacks or fraud attempts in the preceding twelve months.

These figures use different populations. The 11% figure concerns companies using or planning AI; the 17% figure covers all respondents and includes suspected cases. Saying one in six companies was conclusively hacked using AI would therefore misrepresent the findings.

How the research was conducted

For the study, forsa interviewed representatives of 505 companies by telephone between 22 June and 31 July 2026. The findings describe survey responses and assessments, rather than a forensic census of attacks.

The absence of a dedicated AI process does not automatically mean that an organisation has no incident management at all.

Our view: connect new uses to existing processes

The useful management question is whether new use cases reach existing operational processes. Who recognises a suspicious output or possible data leak? Where do they report it? Who decides on the response and records the result?

This does not require every organisation to build a completely separate emergency structure. Responsibilities, assessment and response need to fit the services actually used. That is a governance and risk-management issue, extending beyond model selection.

Our SME incident-management article covers organising reports and disruptions. The ISMS guide explains the connection to ongoing management.