G-01
Deterministic, not surprising
Our AI processes run in unambiguously defined workflows with clear limits and handover points. We operate no AI agents that find their own tasks or can act unforeseen.
VOLUNTARY STATEMENT · AS OF 6 JULY 2026
How we handle AI ourselves.
Whoever advises on AI governance must disclose their own. This statement voluntarily goes beyond the statutory transparency duties — it is our AI management system to ISO/IEC 42001, made public. The German version is authoritative.
THIS WEBSITE / 01
AI on ki-fuer-muenchen.de
No AI system on this website processes your data. In detail:
- There is no chatbot and no AI-based personalisation or profiling.
- The readiness check is a rule-based questionnaire. It runs entirely in your browser; your answers are neither transferred nor stored.
- The page content loads no resources from third-party servers (no external fonts, no tracking pixels, no third-party scripts). Delivery is directly from our server in Germany; Cloudflare provides DNS resolution only (no proxy, no CDN) — see the privacy policy for details.
- Content on this website is created with AI support — under human editing, technical review and the responsibility of the person named in the imprint. Technical claims, figures and certification details are checked and accounted for by humans.
- We use no photorealistic AI-generated images or deepfakes. Should we ever use AI-generated media deceptively similar to real people or events, we will label them pursuant to Art. 50 EU AI Act.
PRINCIPLES / 02
The rules we use AI by
G-02
Human accountability
Every AI application has a named human accountable for it. Decisions with external effect — quotes, contracts, publications, approvals — are always made by a human.
G-03
Data sovereignty
Self-hosted first: where sensitive data is processed, AI systems run on our own infrastructure. Customer data is not used to train third-party models.
G-04
Tested like a product
From 15 years of test engineering practice: every AI system passes an evaluation in our own operations before productive use — transparent, tested, perfected.
GOVERNANCE / 03
Our AI management system
ByteNubes GmbH (brand "KI für München") works to the principles of ISO/IEC 42001 (AI management) and ISO/IEC 27001 (information security). Concretely, that means:
- AI policy: binding internal rules on which data may enter which systems and which uses require approval.
- Named accountability: the AI Officer is Stephan Walkowiak (TÜV Süd certified AI Officer; ISO/IEC 42001 certification in preparation).
- Risk register: every AI application in use is recorded and classified per the EU AI Act risk categories. Under this classification we operate no high-risk AI systems and no practices prohibited under Art. 5 EU AI Act.
- Approval process: new AI tools and use cases pass a documented assessment and approval before use.
- AI literacy (Art. 4 EU AI Act): everyone working with AI systems at our company is verifiably trained.
- Continuous review: this statement and the underlying register are reviewed on every material change, and at least quarterly.
In client engagements
In client projects, additionally: client data remains in the agreed environment (preferably self-hosted at the client), is not used for other purposes and is not used to train models. The client's own governance rules — including works agreements — take precedence.
Questions
We answer questions about our AI use at [email protected]. Data protection rights are governed by the privacy policy.
TRANSFERABLE / 04
We build exactly this kind of statement for you too
This page is stage 1 of our approach, applied to our own company: policy, register, roles, training — publicly verifiable.