)
Last updated: November 11, 2026
What does BSI AI security guidance actually tell German enterprises to do with cloud and generative AI? Germany's Federal Office for Information Security publishes voluntary catalogs and short briefs, not a substitute for binding law. The useful move is to map AIC4, C5, and the 2025 generative AI documents to your own risk analysis before you buy.
TL;DR: Key Takeaways
- The BSI's AIC4 catalog is a 2021, 53-page, voluntary extension of C5 for AI cloud services. The BSI is not involved in audits and does not review the reports.
- The BSI recommends requesting AIC4 and C5 audit reports initially and then regularly, for example annually, and then doing your own risk evaluation.
- C5 was first published in 2016. C5:2026 is the current version, final since late March 2026. The BSI recommends C5:2026 for test periods ending on or after June 1, 2027, and C5:2020 stays valid until then. The BSI also says over a hundred attestations have been granted.
- Generative AI Models version 2.0, dated January 17, 2025, and running to 67 pages, says organizations should run an individual risk analysis before integrating generative AI.
- The BSI published Evasion Attacks on LLMs on November 10, 2025. A joint Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements document followed on May 12, 2026, and builds on a June 2025 G7 shared vision.
At a glance: BSI AI security guidance for enterprises
Quick Answer
What should German enterprises do with BSI AI security guidance?
Treat AIC4 and C5 audit reports as inputs to your own risk analysis, not as a certificate that the service is safe for your use case. Add the 2025 generative AI briefs, evasion-attack guidance, and SBOM expectations when you buy or integrate models and tools. Keep the EU AI Act in view, because it is binding and AIC4 is not.
| Document | Date | What it is | What it is not |
|---|---|---|---|
| C5 catalog | 2016; C5:2026 final late March 2026 | Current baseline; C5:2020 valid until then for earlier periods | A guarantee that a service fits your use case |
| AIC4 catalog | 2021, 53 pages | Voluntary AI-specific extension of C5 | A regulation, a certification, or a BSI-reviewed audit |
| Generative AI Models v2.0 | January 17, 2025, 67 pages | Risk and countermeasure guidance for industry and authorities | A legally binding checklist |
| Management briefing | July 2024 | Getting-started advice, including server location | A complete legal analysis |
| Evasion Attacks on LLMs | November 10, 2025 | Practical countermeasures for pre-trained LLMs | A test report on a named product |
| Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements | May 12, 2026, building on June 2025 | Voluntary G7 minimum elements, jointly published | A mandatory standard or law |
How we compared
We reviewed the BSI AIC4 and C5 pages, the AIC4 PDF (2021), and Generative AI Models version 2.0 (January 17, 2025). We also reviewed the July 2024 briefing, the November 10, 2025, evasion paper, the May 12, 2026, SBOM document, and the EU AI Act on EUR-Lex.
What AIC4 and C5 actually give you
AIC4 specifies minimum requirements for the secure use of machine learning in cloud services and is written as an extension of C5, not a replacement. According to AIC4 (2021), the catalog addresses security and resistance to attack, performance and functionality, reliability, data quality, data management, explainability, and bias, across development, testing, validation, and operation. Application is voluntary.
According to BSI AIC4 page (2026), the office does not select auditors, does not receive the reports, and does not review them. There is currently no certification that a provider meets AIC4. A report is an input to your risk analysis. Residual risk stays with the customer.
C5 remains the baseline for ordinary cloud security. The BSI says a customer usually needs both a C5 report and an AIC4 report, and that C5 is in principle a prerequisite of AIC4. C5:2026, final since late March 2026, is current. The BSI recommends it for test periods ending on or after June 1, 2027; C5:2020 stays valid until then. Ask for a current report, not a screenshot from an old deal cycle.
)
Generative AI briefs enterprises can use this year
The 67-page Generative AI Models guide, version 2.0 dated January 17, 2025, is aimed at industry and authorities. According to Generative AI Models (2025), organizations should run an individual risk analysis before they integrate generative AI into workflows. Developers and operators are in scope too, because many risks can only be addressed in development.
The four-page management briefing, dated July 2024, is a getting-started note. It tells organizations to inventory AI systems, set rules for who may use which system, and forbid shadow IT. It also says to choose data-minimizing settings, ban use of your data for training, set deletion periods, and watch server location when you select a provider. Do not take AI outputs unchecked into critical processes, or send personal or sensitive data without protective measures.
If a provider cannot tell you the server location, training use, or deletion settings, the briefing has already flagged a gap.
Evasion attacks, SBOMs, and the supply chain
On November 10, 2025, the BSI published Evasion Attacks on LLMs - Countermeasures in Practice. It is aimed at developers and IT security officers who use a pre-trained LLM in an application and want to harden it against evasion attacks. Use it to ask where countermeasures sit, not only whether a vendor offers a guardrail.
The Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements document was published on May 12, 2026. It is jointly issued by the BSI and six other G7 cyber authorities, with the European Commission. It builds on a G7 shared vision published in June 2025. According to SBOM for AI (2026), the minimum elements are not mandatory and do not create law. If a provider cannot describe the components in the system you will run, you cannot manage its vulnerabilities.
How BSI AI security guidance sits with the EU AI Act
BSI catalogs do not replace binding law. According to Management Briefing (2024), the EU AI Act was published in the Official Journal on July 12, 2024, and entered into force on August 1, 2024. It categorizes AI systems by risk class.
The briefing is aimed at systems in the lowest risk category. The legal text is in Regulation (EU) 2024/1689. For a wider mapping, see EU AI Act Enterprise Compliance.
| Question | BSI guidance | Binding law |
|---|---|---|
| Is it mandatory? | Voluntary catalogs and briefs | The EU AI Act and GDPR apply |
| What should you file? | Current C5 and AIC4 reports | Your AI Act role and GDPR records |
| Does a report prove lawful processing? | No. AIC4 is silent on that | You still need a legal basis |
Do not treat an AIC4 report as an AI Act conformity assessment.
Security and governance: enterprise risks the guidance flags
Prompt injection, data leakage, and tool or system misuse are all in scope of the BSI corpus, even when the wording differs. AIC4 requires AI-specific attacks to be considered in risk management, including attacks that extract data from a model. The generative AI briefing tells you to limit system access and to validate outputs before they reach backend systems.
You still need one enforcement point, scoped access to tools, and evidence you can show an auditor. Agent Gateway (TrustGate) runs calls to models and tools through one control layer, with policy and a record of every call. Public pages describe US and EU data residency for SaaS, plus private and on-premises options so data can stay in your perimeter. German teams should still request current C5 and, where machine learning is material, AIC4 reports, then test the controls against their use case.
Which should you choose?
Choose the BSI documents that match how you buy and run AI, then file the evidence next to your legal obligations. A report you have not read does not reduce residual risk, and a slide is not a substitute for a report.
| Your situation | Start with | Then add | Decision rule |
|---|---|---|---|
| You buy an AI cloud service | Current C5 report | AIC4 report if ML is material, reviewed against your use case | No current report, or no review, is a finding |
| You use a hosted LLM via API | July 2024 briefing plus Generative AI Models v2.0 | Evasion-attack paper and SBOM questions | Training use, location, and output handling must be clear |
| You build on a pre-trained model | Evasion Attacks on LLMs (November 10, 2025) | SBOM for AI minimum elements | You can show where countermeasures sit |
| You operate in a regulated group | All of the above, plus your sector rules | EU AI Act role and GDPR records | BSI reports do not replace a legal duty |
Conclusion
BSI AI security guidance gives German enterprises a practical file of catalogs and briefs: C5, AIC4, the 2025 generative AI documents, evasion-attack countermeasures, and SBOM expectations. None of that is a substitute for the EU AI Act or your own risk analysis. Request current reports, read them against the use case, and test the controls in production-like traffic before scaling.
Secure Enterprise AI Workloads in Production with NeuralTrust
Book a demo to map gateway controls and audit evidence to the BSI documents on your table.
)
Related Comparisons
- EU AI Act Enterprise Compliance
- Data Sovereignty Requirements and the EU AI Act
- Sovereign AI: On-Prem vs Private Cloud vs Public Cloud
- AI Gateways and Data Sovereignty
FAQs about BSI AI Security Guidance
1. Is BSI AI security guidance mandatory for German enterprises?
No. The BSI states that AIC4 is not regulatory and that application is voluntary. C5 attestations are also a market practice, not a universal legal duty by themselves. German law requires a current C5 attestation for cloud processing of health and social data (§ 393 SGB V). Binding duties still come from law, including the EU AI Act and the GDPR.
2. Does an AIC4 audit report mean the service is safe for us?
No. The BSI is explicit: the existence of a report does not mean resistance to attack, performance, or data quality are adequate for your application. Customers must analyze the report themselves. Residual risk stays with you. The BSI does not review reports.
3. Do we need both C5 and AIC4?
The BSI says a customer usually needs a C5 report for ordinary IT security and an AIC4 report for AI-specific risks. Combining both is how you get a holistic view. C5 is in principle a prerequisite of AIC4, although AIC4 could be combined with another comparable cloud catalog.
4. How often should we request new reports?
The BSI recommends requesting AIC4 and C5 audit reports initially and then regularly, for example annually, and analyzing them in depth. There is no BSI-run certification cycle to watch instead. Put the request and the review date in the contract.
5. How does this guidance relate to the EU AI Act?
The Act entered into force on August 1, 2024, and is binding. AIC4 is voluntary and is not an AI Act conformity assessment. The BSI's AIC4 FAQ adds that an AIC4 audit makes no statement on whether personal data is processed lawfully.
6. What should we ask a vendor first?
Ask for current C5 and, where relevant, AIC4 reports, plus the countries used for processing, training use, and deletion settings. Ask for an SBOM or equivalent component list for the system. Then test evasion and access controls against your use case, rather than accepting a slide.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- BSI, Criteria Catalogue for AI Cloud Services (AIC4), accessed November 11, 2026.
- BSI, AI Cloud Service Compliance Criteria Catalogue (AIC4), 2021, 53 pages.
- BSI, Cloud Computing Compliance Criteria Catalogue (C5); C5:2026, final late March 2026; C5:2020 transition, test periods ending on or after June 1, 2027.
- BSI, Generative AI Models - Opportunities and Risks for Industry and Authorities, v2.0, January 17, 2025, 67 pages.
- BSI, Sichere generative KI in Organisationen und Unternehmen, management briefing, July 2024.
- BSI, Evasion Attacks on LLMs, November 10, 2025.
- BSI and G7 partners, Software Bill of Materials (SBOM) for Artificial Intelligence - Minimum Elements, May 12, 2026, building on the June 2025 G7 vision.
- Regulation (EU) 2024/1689 (EU AI Act), OJ July 12, 2024, in force August 1, 2024.
- § 393 SGB V, Cloud-Einsatz im Gesundheitswesen, gesetze-im-internet.de, accessed November 11, 2026.
- NeuralTrust, AI Gateway and Pricing, accessed November 11, 2026.
)
)
)
)