Speed is no longer the hard part of building software. Standing behind it when an auditor asks is. That gap was the starting point for the BVMW impulse on 8 June 2026 on AI agents, vibe coding and the EU AI Act: a checklist for responsible AI use in mid-sized companies, six decisions, each with its legal context.
You can download the slides and the full checklist, including the Lovable configuration guide, here:
Why rules: the checklist is what makes speed safe
For a pilot, a flight becomes safe through checklists, instruments and clear procedures; skill alone is not enough. The same holds for AI. The potential is large, the risk is real. The rules are the checklist that makes the potential usable.
Vibe coding: software described in plain language
With vibe codingVibe Coding: Karpathy 2025; Collins Word of the Year 2025 you describe in plain language what the software should do, and the AI writes the code. The downside is documented: around 45 percent of AI-generated code carries known vulnerabilitiesVeracode, GenAI Code Security Report 2025, and a Carnegie Mellon University benchmark rates only 10.5 percent of functioning code as secureZhao u. a., SUSVIBES, Carnegie Mellon University, 2026.
Functioning and secure are two different things. Speed without review is dangerous.
AI agents and the agentic organisation
Autonomy rises from the assistant through the agent to autonomous multi-agent systems. The higher the level, the more oversight, logging and an emergency stop are needed; responsibility stays in-house. For leadership this means: from command and control to coordination and oversight, building your own AI competenceISO/IEC 42001:2023, KI-Managementsystem, a human override and clear accountabilityGassmann, Wincent, California Management Review 2025.
Centaur, Cyborg, Self-Automator
A study by MIT Sloan and HBS distinguishes three modes of working: Centaur (deliberate division of labour, 14 percent), Cyborg (close interweaving, 60 percent) and Self-Automator (full handover, 27 percent)Kellogg, Lifshitz, Dell'Acqua, Mollick u. a., MIT Sloan / Harvard Business School, 2024. Choose the mode per task: important work as a Centaur, routine as a Self-Automator. The higher the risk, the more human involvement.
EU AI Act: risk classes and deadlines
The EU AI Act regulates by risk: prohibited, high, limited (transparency) and minimal, plus a separate, stricter track for general-purpose models (GPAI). The AI-literacy duty (Art. 4) and the prohibitions (Art. 5) have applied since February 2025EU AI Act, Verordnung (EU) 2024/1689 (Art. 4, 5, 12, 26, 50, 99). Following the provisional Digital Omnibus agreement, the marking duty for AI content (Art. 50(2)) moves to December 2026 and the obligations for standalone high-risk systems to December 2027Digital Omnibus on AI, vorläufige politische Einigung vom 7. Mai 2026. These dates become binding only on formal adoption. Fines reach up to 35 million euros or 7 percent of global turnover (Art. 99).
| Risk class | Meaning | Example / duty |
|---|---|---|
| Prohibited | Unacceptable risk, banned | Social scoring; manipulative systems |
| High | Strict obligations before and during use | AI in hiring or credit scoring |
| Limited | Transparency duty | Label chatbots and AI content |
| Minimal | No specific duties | Spam filters, AI in games |
| GPAI (general-purpose models) | Separate, stricter track | Large language models; documentation, copyright |
The wider rulebook
Beyond the AI Act, the GDPR applies (legal basis, data processing agreement, data minimisation, accountability)DSGVO, Verordnung (EU) 2016/679 (Art. 5, 6, 28, 32), NIS2 (in force in Germany since December 2025; management is personally liable)NIS2-Richtlinie (EU) 2022/2555; NIS2-Umsetzungsgesetz, § 38 BSIG, the new product liability rules (from December 2026 software counts as a product, liability without proof of fault)Produkthaftung, Richtlinie (EU) 2024/2853 and copyright law (Regional Court of Munich I, 11 November 2025)LG München I, Urteil vom 11.11.2025, 42 O 14139/24 (GEMA gegen OpenAI).
| Rule | What it covers |
|---|---|
| EU AI Act, Art. 4 (AI literacy) | Training duty for providers and deployers. Applies since 2 February 2025. |
| EU AI Act, Art. 5 (prohibitions) | Prohibited AI practices. Applies since 2 February 2025. |
| EU AI Act, Art. 50(2) (marking) | Marking of AI content. Provisionally moved to December 2026. |
| EU AI Act (high-risk) | Obligations for standalone high-risk systems. Provisionally moved to December 2027. |
| GDPR | Legal basis, data processing agreement, data minimisation, accountability. Applies on an ongoing basis. |
| NIS2 implementation act (Sec. 38 BSIG) | Cyber duties, personal liability of management. Applies since 6 December 2025. |
| Product Liability Directive (EU) 2024/2853 | Software counts as a product; liability without proof of fault. Applies to products from 9 December 2026. |
The six decisions of the checklist
A real decision is made at six points. The checklist walks through each:
| Decision | Key question | Legal reference |
|---|---|---|
| 1. Business case | Do you even want to build it yourself? | Cost-effectiveness (preliminary) |
| 2. Authority and capability | Are you allowed and able to build it? | EU AI Act Art. 4; ISO/IEC 42001 |
| 3. Tool and plan | Which tool, which plan? | GDPR Art. 28 and 6 |
| 4. Data and input/output | Which data, and does the app store anything? | GDPR Art. 5, 6, 28, 32 |
| 5. Hosting | Where does it run, where is the data? | GDPR Art. 32; AI Act Art. 12, 26 |
| 6. Operation and lifecycle | Who owns, maintains and ends the app? | Product Liability (EU) 2024/2853; NIS2 |
Duty of evidence
An auditor checks not only whether a policy exists, but whether the proof from requirement to evidence is complete. A requirement becomes a policy, then a control, then evidence. If the evidence is missing, the risk arises automatically.
GDPR Art. 5(2): the controller must be able to demonstrate compliance (accountability)DSGVO, Verordnung (EU) 2016/679 (Art. 5, 6, 28, 32).
Our Take
In practice the obstacle is rarely the tool and rarely the law. It is the missing ownership of the evidence layer. As long as no one in the company is responsible for turning requirement, policy and control into solid evidence, that evidence appears only once an incident forces it. Name that person before the first audit arrives, and half the checklist is already done.
Materials and contact
The slides and the full checklist are available for download above. For questions or support on responsible AI use, feel free to connect.