Corporate Governance 2026

Last Updated June 16, 2026

Germany

Law and Practice

Authors



POELLATH is an internationally operating German law firm of more than 180 lawyers and tax advisers in Berlin, Frankfurt and Munich, providing high-end legal and tax advice. The firm advises on all transaction-related areas, including corporate, M&A, private equity, funds, real estate, private clients, succession planning and tax-related matters. POELLATH’s corporate advice covers corporate law and group company law, reorganisations, capital market rules, corporate litigation and compliance. POELLATH advises publicly listed and private companies on preparing and conducting their general and shareholder meetings on all matters, including mergers, spin-offs, hive-downs and conversions of legal form, and on all corporate advisory matters related to corporate governance. A further core area is public takeovers with subsequent corporate integration. Key clients include Vodafone, Deutsche Telekom AG, shareholders of Porsche Automobil Holding SE, PUMA SE, Wacker Neuson SE, Eckert & Ziegler SE, Nemetschek SE, Münchener Hypothekenbank, BayWa, Giesecke+Devrient, Fiege Group, Groz-Beckert and STAEDTLER.

German law differentiates between capital companies and partnerships. The following chapter will focus on capital companies, as these are the most important and most regulated forms of companies in Germany.

Capital Companies

Capital companies are legal entities where the liability is limited to the assets of the company – ie, the shareholders’ liability is limited to what they have invested in the company. The most common legal forms of capital companies are the limited liability company (Gesellschaft mit beschränkter Haftung, or GmbH) and the stock corporation (Aktiengesellschaft, or AG). Other forms of capital companies are the European stock company (Societas Europaea, or SE) and the partnership limited by shares (Kommanditgesellschaft auf Aktien, or KGaA).

The KGaA is a capital company, but also has some elements of a partnership.

Partnerships

Partnerships are characterised by the personal liability of the partners. The most popular legal form of a partnership is the limited partnership (Kommanditgesellschaft, or KG), consisting of limited partners whose liability is limited to a certain amount agreed and disclosed in the commercial register, and general partners with unlimited liability. However, the general partner may have the legal form of a capital company, thereby limiting its liability.

German law also acknowledges the partnership under civil law (Gesellschaft bürgerlichen Rechts, or GbR) and the general partnership (Offene Handelsgesellschaft, or OHG), with unlimited liability of their partners.

The primary sources for corporate governance requirements for capital companies in Germany (GmbH, AG, KGaA, SE) are:

  • the German Limited Liability Companies Act (Gesetz betreffend die Gesellschaften mit beschränkter Haftung, or GmbHG);
  • the German Stock Corporation Act (Aktiengesetz, or AktG);
  • the European and German acts on SEs – in particular, the European SE-Verordnung (SEVO) and the German SE-Ausführungsgesetz (SEAG);
  • the German Commercial Code (Handelsgesetzbuch, or HGB);
  • the Reorganisation of Companies Act (Umwandlungsgesetz, or UmwG);
  • the German Securities Acquisition and Takeover Act (Wertpapiererwerbs- und Übernahmegesetz, or WpÜG);
  • the Market Abuse Regulation (Marktmissbrauchsverordnung, or MAR); and
  • the Securities Trade Act (Wertpapierhandelsgesetz, or WpHG).

Beyond this, the German Corporate Governance Code (Deutscher Corporate Governance Kodex, or DCGK) sets out further corporate governance rules for listed companies, which differentiate between recommendations and suggestions. In 2020, the DCGK introduced the category of principles, which precede the recommendations and suggestions regarding a certain subject matter and outline the fundamentals of the applicable law.

In 2022, the DCGK was amended, substantiating some ESG aspects as well as the guidelines on internal controlling in response to new legislation on financial integrity.

Non-governmental regulations such as applicable listing rules enacted by the stock exchanges also establish corporate governance requirements. Certain industry sectors (eg, banks) are subject to further regulation with respect to, inter alia, their corporate governance.

Shares of an AG, an SE and, less commonly, a KGaA may be listed on a stock exchange. The primary source for corporate governance requirements concerning listed AGs and KGaAs, as well as (to a lesser degree) SEs, is the AktG, as it differentiates between rules for listed and non-listed companies. Its requirements are mandatory. The HGB, the WpHG, the WpÜG, the European and German Securities Prospectus rules (the European WPVO and the German WpPG), the Stock Exchange Act (Börsengesetz, or BörsG) and the MAR provide further mandatory regulation in relation to, inter alia, listed companies’ corporate governance.

To promote a high corporate governance standard, the DCGK contains corporate governance standards in the form of recommendations and suggestions for listed companies with a two-tier corporate governance system; however, the rules of the DCGK shall also be applied correspondingly by listed companies with a single-tier corporate governance system (see 2.1 Principal Bodies or Functions). The DCGK is enacted not by the legislature, but by the German Corporate Governance Commission, and is therefore not a statute or an ordinance, but rather “soft law”, so the standards set in the DCGK are principally voluntary. Recommendations shall be complied with and, if not, deviations have to be explained and disclosed (the principle of “comply or explain”) in a declaration of compliance (Entsprechenserklärung), to be resolved upon annually by the responsible corporate governance bodies of the listed company.

The declaration of compliance is to be included in the declaration on corporate governance, which itself is part of the management report. The issuance of the declaration of compliance is obligatory. Deviations from suggestions are allowed without disclosure. In practice, listed companies seek to comply with the standards set out in the DCGK, in particular the recommendations.

Following the Standortfördergesetz (StoFöG) entering into force on 10 February 2026, it is now possible for an AG to issue shares with a par value of less than EUR1 (so-called penny stocks). Furthermore, the articles of association of stock corporations may permit multiple voting rights, although there are strict restrictions for listed companies, particularly regarding how long multiple voting rights may remain in effect following a stock exchange listing.

In addition, the StoFöG implements far-reaching changes to the regulations governing delisting from the regulated market. These changes primarily concern the expansion of the admissibility of a delisting application without a tender offer. In addition to the cases previously codified in the Stock Exchange Act, delisting is now also possible in the following cases:

  • if the securities continue to be traded on an SME growth market (in Germany, this refers exclusively to the “Scale” trading segment of the Frankfurt Stock Exchange) (so-called “downlisting”); or
  • if insolvency proceedings have been opened against the issuer’s assets.

Conversely, a delisting from an SME growth market – which was previously possible without a tender offer – will in future require such an offer.

Management Board

The predominant board structure of an AG and an SE follows the two-tier corporate governance system, with a management board (Vorstand) managing and representing the company, and a supervisory board (Aufsichtsrat) supervising the management board, in each case accompanied by the third corporate body, the general meeting (Hauptversammlung). The management board manages the company under its own responsibility and at its own discretion. It is not subject to any instructions from the supervisory board or the general meeting.

However, the management board is subject to the prior approval of the supervisory board for certain business transactions and measures, either foreseen in the articles of association of the company or by the supervisory board itself – eg, in the rules of procedure for the management board.

Administrative Board

A single-tier corporate governance system with one board, as primarily known in other jurisdictions, is only allowed in Germany within an SE. The board is called the administrative board (Verwaltungsrat), and consists of executive and non-executive board members. The administrative board is responsible for the management and supervision of all material company matters (Oberleitung) as well as the determination of guidelines for the SE’s business, and appoints managing directors (Geschäftsführende Direktoren), who are responsible for the day-to-day management of the company.

The managing directors may be members of the administrative board if and to the extent that the majority of the members of the administrative board continue to be non-executive. The administrative board is entitled to issue internally binding instructions to the managing directors.

General Partner

The peculiarity of a KGaA is that the general partner is responsible for the management. The general partner, being a shareholder of the KGaA, may be one or more natural persons or, more common in practice, a capital company itself – eg, a GmbH, AG or SE. The corporate governance system of such a capital company is to be differentiated from the corporate governance of the KGaA.

The corporate governance of the general partner company follows the principles applicable to the corporate form that company takes. In any case, the KGaA has a supervisory board that is responsible for the supervision of the management, but in the case of a capital company as general partner it is not responsible for the appointment, dismissal or service contracts of the management of the general partner, nor for the determination of the financial statements.

The general meeting of an AG, SE and KGaA has no corporate governance powers.

Managing Directors

A GmbH generally has managing directors (Geschäftsführer) and the shareholders’ meeting (Gesellschafterversammlung), but no statutorily required supervising body. The managing directors are responsible for the management and representation of the company. In principle, they decide autonomously.

However, the shareholders’ meeting is – in contrast to the situation in an AG – the supreme decision-making body of the GmbH, and has the authority to issue internally binding instructions to the managing directors. In a GmbH, a voluntary supervisory or advisory board may be implemented. Apart from this, a supervisory board is to be installed only in the case of codetermination (see 3.1 Board Structure).

Management Board

In an AG and a two-tier system SE, the management board responsible for the management of the company decides on any and all business transactions and measures within and outside the ordinary course of business under its own responsibility and discretion. However, material measures within and measures outside the ordinary course of business are subject to the prior approval of the supervisory board. For this purpose, applicable law provides that a catalogue containing those approval rights has to be established, either by the general meeting in the articles of association or, alternatively and – in practice – more relevant, by the supervisory board itself in the rules of procedure for the management board, which is an important part of supervising the management board.

Besides the supervision of the management board, the supervisory board is responsible for:

  • the appointment and dismissal of the members of the management board;
  • their service contracts; and
  • the review and determination of the financial statements.

Administrative Board

In a single-tier system SE, the administrative board is responsible for fundamental management issues, such as long-term business goals, the organisational structure, and the strategy and general guidelines of the SE, as well as the budgeting, whereas the managing directors are “only” responsible for the day-to-day management. The administrative board has the authority to issue internally binding instructions to the managing directors.

General Meeting

Only selected decisions are reserved by law for the general meeting of an AG and an SE. With respect to the annual ordinary general meeting, such decisions include the appropriation of profits, the appointment of the auditor, the formal approval of action for members of both the management board and the supervisory board, and the vote on the annual remuneration report. Fundamental, extraordinary decisions include:

  • the election and removal of the supervisory board members;
  • amendments to the articles of association; and
  • resolutions on restructuring measures and the sale of substantially all of the corporation’s assets, and on corporate agreements (profit and loss pooling agreements).

Managing Directors

Managing directors of a GmbH can principally make day-to-day management decisions without consulting the shareholders. However, as the shareholders’ meeting is the supreme body, a broader catalogue of decisions is reserved by law for the shareholders’ meeting of a GmbH than for a general meeting of an AG: all decisions that the ordinary general meeting of an AG has to take plus the review and determination of the financial statements, and all fundamental, extraordinary decisions of the general meeting of an AG, as well as the right to instruct the managing directors.

Management Board

The management board of an AG and a two-tier system SE generally decides in physical or virtual meetings, if a certain quorum of – most of the time – more than half the members of the management board are present or represented, by way of resolution, generally to be passed by a simple majority. However, qualifying majority requirements can be set – eg, in the rules of procedure for the management board. In practice, it is recognised and common that members of the management board are allocated certain individual responsibilities as part of their department (Ressort).

Decisions within each department are made by the responsible, single member of the management board, unless such decision is of a material nature, in which case a resolution of the management board is necessary. This also applies where another member of the management board so requests. Finally, the management board may form committees for specific tasks, although this is not that common in practice.

The same decision-making process applies (more or less) to managing directors of a single-tier system SE and a GmbH.

Supervisory Board

The supervisory board of an AG, a two-tier system SE and a KGaA decide by way of resolution, generally with a simple majority. However, the articles of association or the rules of procedure for the supervisory board may foresee qualifying majority requirements. Supervisory board meetings shall be held as physical meetings from the statutory starting point.

Virtual meetings as well as hybrid forms are permissible. Supervisory board members not present in a meeting may not be represented by third persons or other supervisory board members, but can only give a written voting declaration (Stimmbotschaft). The meeting has a quorum if the majority of members are present – at least three.

The supervisory board is entitled to form committees from within itself – eg, an audit committee and a nomination committee. The DCGK expressly requires the formation of these two committees for listed companies. Committees are generally responsible for preparing supervisory board topics and consummating resolutions passed by the supervisory board. Sometimes, committees are also entitled to resolve instead of the supervisory board. However, this is not allowed in statutorily foreseen topics – eg, decisions concerning the remuneration and service contracts of members of the management board. Rules applying to the supervisory board in a two-tier system also have to be adhered to by the administrative board in a single-tier system SE.

Management Board

There is no legally predefined structure for the management board of an AG or two-tier system SE, nor for the managing directors of a single-tier system SE or GmbH. The management board can consist of one or more natural persons, unless the articles of association require a minimum number of members; the same applies to the number of managing directors.

Supervisory Board

The supervisory board of an AG, KGaA and a two-tier system SE, and the administrative board of a single-tier system SE, has to consist of at least three members, or a higher number up to nine, 15 or 21 members, depending on the registered share capital of the corporation, to be set in the articles of association.

If an AG, KGaA or GmbH exceeds the threshold of, generally, 500 German employees, one third of the supervisory board members of the company must be employee representatives – ie, the one-third participation (Drittelbeteiligungsgesetz, or DrittelbG). In this case, the number of supervisory board members must be divisible by three. If an AG, KGaA or GmbH and its controlled companies exceed, generally, 2,000 German employees in total, the supervisory board must consist of 50% employee representatives – ie, the parity codetermination (Mitbestimmungsgesetz, or MitbestG). In this case, the supervisory board must consist of at least 12 members, with the exact number increasing depending on the total number of German employees.

German codetermination rules do not apply to the SE. Instead, when incorporating an SE, an agreement on the participation of employees in the SE (the so-called employee participation agreement) has to be negotiated with the special negotiating body established particularly for such negotiation, representing employees from the German company, its subsidiaries and branches that are in EU and EEA member states other than Germany. The rules on codetermination are part of the agreement, with the general principle that the level of codetermination of the German company used to incorporate the SE shall be maintained (freezing of codetermination prior to and after principle) – eg, if no codetermination exists and needed to exist prior to the incorporation of the SE, then no codetermination would need to be agreed upon in the employee participation agreement for the SE.

The applicable law does not predefine roles for members of the managing bodies. One member of the management board can be and usually is nominated as the chair or spokesperson. Apart from this, it is common for the tasks and duties of the management board and managing directors to be divided between them in several departments, either functional or operational divisions. Thereby, names like CEO, CFO and COO are generally attached to the members on their business cards, the website and in the email footer; however, these are neither statutorily foreseen nor do they trigger any special further rights or obligations.

With respect to the supervisory board of an AG, and a two-tier system SE or an administrative board of a single-tier system SE, each member generally has the same rights and duties, and must be familiar with the relevant business sector of the company. However, according to applicable law, boards of listed companies must have two members with certain skills, one with accounting expertise and the other with auditing expertise.

Management Board/Managing Directors

Beyond the requirements set out in 3.1 Board Structure and 3.2 Board Members, there are no other statutory rules governing the composition of the management board of an AG or a two-tier system SE, nor the managing directors of a single-tier system SE or GmbH. However, if such a company is listed on a stock exchange as well as parity codetermined and consists of more than three members as of 1 August 2022, at least one new member must be female and one must be male.

With respect to the management board of an AG and to a two-tier system SE or an administrative board of a single-tier system SE that are listed on a stock exchange or codetermined, the supervisory board must determine a target percentage for women on the management board and the management boards for second/third line management, as well as deadlines for when such percentages are to be reached. If the set target is zero, the management board must justify this in a clear and comprehensive manner. If the percentage of women on the management board is below 30% at the time of the determination, the target percentage may not be lower than the present percentage.

These corporations must include a declaration on corporate governance in their management reports. The DCGK recommends taking diversity into account when composing the management.

Composition of Supervisory Boards

In AGs, SEs and KGaAs that are parity codetermined and listed on a stock exchange, the supervisory board (or, in the case of a single-tier system SE, the administrative board) must be composed of at least 30% women and at least 30% men. The minimum percentage must be complied with by the shareholder and employee representatives on the board in its entirety. Furthermore, corporations that need to fulfil the aforementioned gender criteria must include information on whether the company has complied with the portion requirements for the appointment of women and men as supervisory board members in their declaration on corporate governance.

With respect to the supervisory board of an AG and to a two-tier system SE or an administrative board of a single-tier system SE that are listed on a stock exchange or codetermined, the supervisory board must also set a target for women on the supervisory board, as well as deadlines for such target is to be achieved. With regard to a target of zero or below 30%, the same applies to the supervisory board as to the management board, as described above.

At least one member of the supervisory board must have expertise in the field of accounting, and at least one other member of the supervisory board must have expertise in the field of auditing. Sufficient expertise can, for example, be assumed for:

  • financial directors;
  • expert employees from the fields of accounting and controlling analysts; and
  • long-standing members of audit committees or works council members who have acquired this ability in the course of their work through further training.

The DCGK recommends, among other matters, that the supervisory board determines concrete objectives regarding its composition and prepares a profile of skill and expertise for the entire board, while taking diversity into account. The profile of skill and expertise shall also comprise expertise regarding sustainability issues.

It is recommended that both are taken into account for the supervisory board’s proposals to the general meeting. The DCGK further recommends that a certain number of members of the supervisory board as well as certain members – eg, the chairperson – are independent (see 3.5 Independence of Directors). The implementation status of the objectives and the profile of skill and expertise, as well as the number of independent members deemed to be appropriate by the supervisory board, are to be disclosed in the corporate governance report in the form of a qualification matrix.

In an AG and an SE, the respective supervisory or administrative board is responsible for appointing and generally dismissing the members of the management board or the managing directors. The maximum term of office is five years in an AG and six years in an SE; a reappointment or extension is principally permitted.

The members of the supervisory and administrative board are appointed by the general meeting, for a maximum term of office of approximately five years in an AG and six years in an SE. Reappointment is permitted. Dismissal could happen by resolution of the general meeting with a majority of at least three quarters of the votes cast, unless the articles of association provide otherwise. Employee representatives on the supervisory board in the case of codetermination are generally appointed by employee elections.

The appointment and dismissal of the managing directors of a GmbH is, in principle, the responsibility of the shareholders’ meeting. The term of office may be indefinite.

A person who has been convicted of certain criminal offences (eg, fraud) may not be a member of a management board nor a managing director.

Management Board

The members of the management board of an AG are subject to a duty of loyalty to the company, must observe the best interests of the company, and are bound by a non-compete obligation for the duration of office. They must disclose conflicts of interest to the supervisory board without undue delay. The DCGK also makes statements to that effect. In certain situations, members of the management board should thus either abstain from casting votes or not even participate in the meeting or the relevant topic.

Supervisory Board

The members of the supervisory board of an AG and a two-tier system SE and of the administrative board of a single-tier system SE are also bound by a duty of loyalty, but there are no mandatory statutory provisions that require and define independence. However, a few restrictions aimed at independence prohibit an individual from becoming a member of the supervisory or administrative board – eg, where the individual is part of the management of a subsidiary of the company. Nevertheless, the DCGK requires a certain degree of independence to avoid conflicts of interest.

In this respect, the supervisory board shall determine an appropriate number of independent members. The DCGK gives indicators for determining the independence of members of the supervisory board. These include personal or business relationships with the company, the management board, controlling shareholders and major competitors that may cause a substantial or not merely temporary conflict of interest.

Members of management bodies must conduct the company’s affairs with the due care of a prudent and diligent businessperson, in particular in accordance with the applicable laws and the articles of association (duty of legality, including the increasingly important duty to establish and maintain an effective compliance management system). In the case of entrepreneurial decisions, the so-called business judgement rule applies in order to eliminate hindsight bias when legally evaluating the management bodies’ past conduct. This means that members of the management board may be exempt from liability if they had reasonably assumed that they were acting on the basis of adequate information and in the best interests of the company.

The same applies to the members of the supervisory and administrative board. However, their differing tasks and roles in the corporate governance of the respective company lead to a different emphasis of duties.

In principle, members of management and supervising bodies owe their duties primarily to the company; they always have to act in the best interests of the company and its group. However, the interests of the company include, to a certain extent, the interests of all stakeholders (such as creditors and employees) of the company (the German “stakeholder model” in contrast to the Anglo-Saxon “shareholder model”).

In an AG and SE (with a few exceptions in special statutory rules – eg, in the event of an insolvency or in the context of wilful misconduct), creditors and shareholders cannot enforce a breach of duties of members of management and supervising bodies. The members of the bodies are rather jointly and severally liable in the internal relationship towards the company due to their joint responsibility. Thus, individual members of a management and supervising body may not absolve themselves from liability because a certain task or responsibility was delegated to a different member internally.

Furthermore, such a breach may lead to a dismissal and, with respect to the management members, a termination of their service contract.

In principle, the supervisory board is responsible and – according to case law – even has a duty to assert damage claims to the management board members. The company may waive its damage claims or enter into settlement arrangements on these claims only if three years have lapsed since the claim arose and the general meeting resolved thereupon without a minority of the shareholders (at least 10% of the share capital) raising an objection.

Where members of the supervisory board culpably breach their duties, the management board is responsible for pursuing possible damage claims against the supervisory board members jointly and severally.

Claims Against Members of Corporate Governance

The rights and obligations on asserting claims against members of corporate governance bodies in an AG, SE and KGaA are independent of whether or not the members of these respective bodies have been discharged. Another particular consequence of a breach of duty in a listed company is that the company may be obliged to disclose it to the capital market by way of ad hoc notification.

In the case of a GmbH, the consequences of a breach of the duties of managing directors are, to a great extent, comparable to an AG. In general, the managing directors, like the management board members, are not directly liable to the creditors of the company. The shareholders’ meeting has the right to pursue damage claims and to decide about the dismissal of managing directors and the termination of the service contract.

In contrast to the situation in the AG, if the shareholders’ meeting has discharged the managing director knowing the facts underlying such a breach, the discharge leads to an exclusion of liability.

Certain special law remedies and, in the case of wilful misconduct, general civil law remedies exist. From the company’s point of view, these do not generally extend claims any further than those under corporate law. Since shareholders do not have a direct claim against the members of management and supervising bodies under corporate law, in certain situations (eg, capital market fraud) general civil law remedies may provide an opportunity for claims of shareholders.

However, the courts have traditionally been cautious in recognising such claims.

Liability

The liability of a member of a management and supervising body in an AG, SE and KGaA cannot be limited, as this would qualify as an impermissible waiver by the company upfront – ie, prior to the expiry of the three-year period (see 3.8 Breach of Directors’ Duties). However, D&O insurance for the members of the management and supervising body is permissible and common in practice, in order to protect them against risks arising from their professional activities for the company. Premiums are generally paid by the company, although members of the management board of an AG, SE and KGaA are obliged to bear a deduction of at least 10% of the damage to one-and-a-half times their annual fixed salary at maximum.

Remuneration of the Management Board

The remuneration of the management board members of an AG and a two-tier system SE is resolved by the supervisory board and contractually agreed upon in the service contract.

In listed companies, the supervisory board has to determine the principles of the remuneration of the members of the management board in a remuneration system, which is subject to approval by the general meeting upon its introduction and any material changes thereto, at least every four years. However, the resolution on the approval is non-binding and thus has no effect on the legitimacy of the remuneration. Nevertheless, if the general meeting does not approve the remuneration system, a reviewed remuneration system has to be presented at the next annual general meeting for approval.

Contents

With respect to the contents of the remuneration system, the AktG only requires a few elements to be included in every remuneration system (eg, a maximum total remuneration of the management board) but provides for further rules with respect to its contents relating to different aspects of the remuneration of the management board if those aspects are foreseen in the remuneration system. However, the DCGK makes several recommendations with respect to criteria to be described in the remuneration system – eg, the ratio between the fixed remuneration and the variable remuneration based on short- and long-term incentives, as well as the performance and non-performance indicators for determining payment of variable remuneration.

The supervisory board then determines the actual remuneration of each member of the management board based on the remuneration system. The supervisory board and the management board have to prepare a remuneration report regarding the past financial year, which is subject to a non-binding approval by the annual general meeting. Neither the resolution on the remuneration system nor the resolution on the remuneration report can be objected to by means of a contesting action or an action for annulment by a shareholder.

Restrictions

As regards restrictions on the remuneration of the members of the management board, the AktG requires that the overall remuneration of individual members of the management board is appropriate in relation to their tasks and performance as well as the economic situation of the company. In addition, the supervisory board must ensure the customary remuneration is not exceeded. Further, the remuneration in listed companies has to be aimed at a sustainable and long-term-oriented development of the company, and variable remuneration should be granted based on long-term incentives accordingly.

If the supervisory board culpably disregards the statutory requirements when determining the remuneration for the management board, it may be held liable for damages.

Characteristics

The DCGK makes further recommendations with respect to the characteristics of the remuneration. For example, it recommends that the variable remuneration based on long-term incentives exceeds the one based on short-term incentives. Variable remuneration shall be predominantly invested in shares of the company or granted as share-based remuneration.

The DCGK further recommends that payments to members of the management board due to early termination of their activity do not exceed twice the annual remuneration (severance cap) and do not constitute remuneration for more than the remaining term of the contract. Another suggestion is that change-of-control clauses should not be agreed upon.

Supervisory Board

The remuneration of the supervisory board members may be specified in the articles of association or granted by the general meeting. It should be appropriate in relation to the tasks of the members of the supervisory board and the company’s economic situation. In listed companies, the general meeting has to resolve on the remuneration of the supervisory board members at least every four years, also in a non-binding manner, with the resolution including or referencing the same details that are to be included in the remuneration system of the management board with respect to the remuneration of the supervisory board members, if applicable. The DCGK further recommends taking into consideration the status as chair or deputy chair of the supervisory board or committee in this context. It is suggested that the supervisory board remuneration be a fixed remuneration.

Managing Directors and General Partners

In a GmbH, the remuneration of managing directors is the responsibility of the shareholders’ meeting, which must not adhere to any restricting rules.

In a KGaA, the general partners generally receive no remuneration for their activities, but are entitled to receive a fee for taking over the liability of the KGaA vis-à-vis third parties. In the case of a capital company as general partner, the remuneration of its management members is to be set according to the rules applying to the respective legal form of such a capital company.

All capital companies are required to disclose the total remuneration of the management board in the annual financial statements. An exception is made only for capital companies that fulfil at least two of the following criteria (small capital companies):

  • the balance sheet total does not exceed EUR7.5 million;
  • the sales revenues within the last 12 months amount to less than EUR15 million; and
  • the company employs, on an annual average, fewer than 50 employees.

In a listed company, the features of the remuneration system must be described. The remuneration system has to be published on the company’s website for the duration of the application of the remuneration system, and for ten years at least. In addition, the management board and the supervisory board of a listed company must disclose certain information in the annual remuneration report, such as the fixed and variable remuneration paid to each member of the management and the supervisory board. The remuneration report is also published on the company’s website for at least ten years. The AktG requires the remuneration report to be audited.

The AktG also requires ad hoc and annual disclosure of related party transactions, including transactions of the company with its various members of corporate bodies.

The purpose of the company is determined by its shareholders in the articles of association. The shareholders can only exert influence on the decision-making process by way of resolutions. The general meetings of an AG, SE and KGaA have fewer rights and powers than the shareholders’ meeting of a GmbH, in particular due to their ability to instruct the managing directors (see 2.2 Types of Decisions).

Furthermore, the shareholders have fiduciary duties towards the company and the other shareholders, so have to promote the purpose of the company and may not act to its detriment.

The involvement of the shareholders in the management of a company differentiates according to the legal form of the company.

AGs, SEs and KGaAs

In an AG, SE and KGaA, the general meeting is entitled to appoint the members of the supervisory and administrative board, generally by simple majority, and to dismiss them by 75% of the share capital represented. However, the members of the management board and the managing directors in a single-tier system SE are appointed by the supervisory board or the administrative board, respectively. The general meeting cannot instruct the supervisory or administrative board, nor the management board.

If the management board so requires, the general meeting is entitled to resolve upon management affairs. In practice, such requests do not happen often. Apart from this, the general meeting does not have any influence on the management.

Listed Companies

Listed companies also do not engage with their shareholders, particularly not outside the general meetings. In preparing such meetings, the CEO has calls with shareholder representatives and potential proxy voters, but abstains from providing them with any information that has not already been disclosed in the invitation or that the CEO does not intend to disclose in the general meeting to all other shareholders. However, the DCGK suggests that the chair of the supervisory board should, to an appropriate extent, be in regular conversation with investors on supervisory board-related issues.

Non-Listed Companies

Conversely, non-listed companies typically do engage with their shareholders.

GmbH

In a GmbH, the involvement of the shareholders in the management is also statutorily more extensive. In contrast to the AG, the shareholders’ meeting resolves upon the appointment and dismissal of the managing directors and on the conclusion of their service agreements. The shareholders of the GmbH are also able to direct the managing directors to take or refrain from taking certain actions in the business by way of internally binding instruction.

Annual General Meetings

An annual general meeting is mandatory in an AG and KGaA within the first eight months of a financial year, and in an SE within the first six months of a financial year. The annual meeting has to resolve upon the ordinary topics (see 2.2 Types of Decisions) and upon the remuneration system, with the latter resolution being non-binding (see 3.10 Payments to Directors/Officers). Further extraordinary topics on fundamental decisions can also be put on the agenda of the annual general meeting, or can be passed in an extraordinary general meeting.

Apart from this, general meetings are to be convened if necessary for the welfare and going concern of the company. The general meeting has to be convened no later than 30 days prior to the date of the general meeting, or no later than 36 days prior to the meeting if shareholders are required to register for the general meeting. In an AG and a two-tier system SE, the convening is generally the obligation of the management board, or exceptionally the supervisory board. Within a single-tier system SE, the administrative board is responsible for the convening.

However, shareholders whose share is equivalent to at least 5% of the registered share capital may also demand the convening of a general meeting. Shareholders whose share in the share capital is that high or corresponds to a nominal stake of EUR500,000 may demand that certain additional items are put on the agenda. The demand has to be received by the company 24 days prior to the general meeting at the latest, or no later than 30 days prior to the general meeting for listed companies.

Virtual General Meetings

In August 2022, the German Parliament passed a new law introducing virtual general meetings – ie, meetings without the physical presence of the shareholders or their proxies at the location of the general meeting – as a permanent option and alternative to the physical general meeting. However, pursuant to the new provisions, virtual general meetings require a corresponding provision or authorisation in the articles of association as of 31 August 2023. Such provision or authorisation may only be set for a maximum term of five years.

Annual General Meeting Invitation

The invitation has to fulfil several formalities, such as setting out the business name and seat of the company, the time and place of the general meeting, and the agenda. For listed companies, the invitation has to provide further information – eg, about the rights of the shareholders in respect of the general meeting.

Votes and Resolutions

Unless stipulated otherwise in the articles of association, the general meeting should be held at the seat of the company. Resolutions may not be taken by written consent, but the articles may provide that shareholders can cast votes in written form. Shareholders may be represented by a proxy/proxy voter at the general meeting, or may exercise their rights via electronic communication; the latter option is only available if the articles of association allow this form of attendance and voting.

In listed companies, each resolution adopted by the general meeting is to be recorded in the minutes of the meeting prepared by a notary public. For non-listed companies, it is sufficient to have the minutes signed by the chair of the supervisory board, as long as no resolutions are adopted for which applicable law requires a majority of 75% of the votes cast or a greater majority.

GmbHs

In a GmbH, the regulations in respect of the shareholders’ meeting are not as strict as in the AktG for AGs, SEs and KGaAs. Resolutions generally have to be passed in a meeting of the shareholders, but can also be made in writing based on a corresponding provision in the articles of association, or provided that all shareholders agree in text form. The shareholders’ meeting generally has to be convened by the managing directors by registered letter.

In the case of a meeting, the invitation must be sent at least one week before the meeting, and the agenda of the shareholders’ meeting has to be announced in the invitation. However, these formalities on the invitation can be waived or amended in the articles of association.

There are no special requirements for the holding and conducting of shareholders’ meetings. Shareholders may submit their vote in writing or may grant proxy. It is also permissible to hold virtual meetings via electronic communication based on a corresponding provision in the articles of association, or provided that all shareholders agree in text form.

Shareholders generally do not have any direct claims against members of corporate governance bodies (see 3.8 Breach of Directors’ Duties and 3.9 Other Claims/Enforcement Against Directors/Officers).

Appealing Resolutions

Any shareholder who holds only “one” share may appeal resolutions (Anfechtungs- und Nichtigkeitsklage) of the general or shareholders’ meeting for breach of law or the company’s articles of association. Another objection shareholders can try to bring forward in such lawsuits is the violation of the (majority) shareholder’s duty of good faith. As these duties are not statutorily defined, the chances of success are based on case law. The defendant is the company, not the other shareholder/shareholders who has/have voted in favour.

By filing such objection and voidance claims in court, minority shareholders can block the completion (ie, entry into the commercial register) of, for example, corporate and integration measures. Registration will take place when the minority shareholders’ court challenges are overcome by a so-called release proceeding, which the company must file (Freigabeverfahren). In particular, the company will prevail in the release proceeding and thereby achieve registration in the commercial register if minority shareholders cannot prove that they hold more than a nominal value of EUR1,000 of the registered share capital of the company since the announcement of the convocation of the general meeting.

If in the context of a resolution the company or a majority shareholder has to offer to acquire shares of minority shareholders at fair value based on an IDW S1 valuation, those resolutions cannot be objected to (any more) with the argument that the valuation is too low. However, minority shareholders are entitled to challenge the adequacy of the price in court in a special shareholder compensation proceeding (Spruchverfahren).

Appointing a Special Auditor

Shareholders can request (by demanding either an invitation of an extraordinary general meeting or the adding of a topic on the agenda – see 4.2 Role of Shareholders) that the general meeting shall – with a simple majority of the votes cast – appoint a special auditor (Sonderprüfer) to analyse statutorily specified decisions of the executive and supervisory board. If the general meeting rejects the motion to appoint a special auditor, and if facts and circumstances justify severe breaches of tasks and duties by the management, minority shareholders who together hold 1% of the registered share capital or a nominal value of at least EUR100,000 can file for the appointment of the special auditor in court.

Damage Claims

Minority shareholders may influence the assertion of damage claims against management and supervisory board members following breaches of tasks and duties if, in a first instance, the general meeting resolves with a simple majority to assert such claims. Minority shareholders who together hold 10% of the registered capital or a nominal value of at least EUR1 million can then judicially file for the appointment of a special representative (besonderer Vertreter) to assert these claims. Minority shareholders who together hold 1% of the registered share capital or a nominal value of EUR100,000 or more can also apply in court for admission to assert these claims of the company in their own name.

Shareholders of listed companies have to notify the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, or BaFin) and the issuer if their direct and/or indirect holdings exceed or fall below certain thresholds (3%, 5%, 10%, 15%, 20%, 25%, 30%, 50%, 75%) and if their positions in financial instruments relating to shares exceed or fall below these thresholds (except for the 3% threshold). The notification is to be published by the issuer and can be viewed on its website at any time. Shareholders of listed companies who directly or indirectly hold at least 10% must notify the issuer of the objectives pursued with the acquisition and the origin of the funds used within 20 trading days of reaching or exceeding this threshold.

According to the Money Laundering Act (Geldwäschegesetz, or GWG), which implements the EU Anti-Money Laundering Directive, companies need to disclose their beneficial owner(s) in the transparency register, irrespective of whether their shares are publicly traded or not.

All companies except small partnerships have to prepare an annual financial statement. Capital companies also have to prepare a management report, unless the company is a small company (based on the criteria set out in 3.10 Payments to Directors/Officers). The annual financial statements and the management report differ in that the annual financial statements are primarily for presentation purposes, whereas the management report is more of an analysis and commentary.

The management report includes information on the risk profile of the company and its risk management system. For large, listed companies, the HGB requires a declaration on corporate governance and a non-financial declaration, including statements on environmental, social and labour-related concerns, among other matters.

In addition to preparing the annual financial statements and the management report, listed companies are also required to prepare and publish a half-year report. Some stock exchanges may require further reporting with respect to a certain market segment.

Certain industry sectors – for example, banks and other financial institutions – are subject to further reporting requirements.

The declaration on corporate governance includes information on how the management board and the supervisory board conducted their duties, and also has to address other issues, such as whether quotas for female members of the management and supervisory board have been met, and whether or not the company has a diversity concept (see 3.3 Board Composition). Furthermore, listed companies have to publicly declare each year whether they comply with the DCGK (see 1.3 Companies With Publicly Traded Shares). The declaration is part of the declaration on corporate governance and must be published on the website.

The remuneration system and the remuneration report must be published on the company’s website for at least ten years. Furthermore, the principal features of the management remuneration system and the remuneration of the management board and the supervisory board must be disclosed in the annual financial statement and in the management report thereto.

The annual financial statement also has to include information on related party transactions that were not at arm’s length. Certain related party transactions must also be disclosed on an ad hoc basis.

A company must file the following in particular with the commercial register (Handelsregister):

  • the articles of association, including the company’s business name and legal form, registered seat, purpose of the enterprise and registered share capital;
  • the names of the legal representatives, their place of residence and their dates of birth;
  • if existent, the name and place of residence of authorised officers (Prokurist);
  • in an AG and SE, a list of supervisory and administrative board members;
  • in a GmbH, a list of shareholders; and
  • subsequent amendments to the above-mentioned points.

Those filings are publicly available at www.handelsregister.de, which contains all entries in the commercial register filed since 2007.

The entry in the commercial register is constitutive in certain cases (eg, foundation, mergers or changes of legal form of the company), which means the measure will only become effective upon its entry in the commercial register. In other cases, failures to make filings may result in a fine from the registry court.

Businesses covered by anti-money laundering regulations must file a Suspicious Transaction Report (STR) with the Financial Intelligence Unit (FIU) whenever they have reasonable grounds to suspect money laundering or terrorist financing, and are strictly prohibited from tipping off the subject of that report. In addition, cash transactions above certain thresholds (eg, EUR10,000 in the EU or USD10,000 in the USA) must be reported regardless of whether any suspicion exists, and more than EUR10,000 in cash carried across EU borders must be declared under EU Cash Controls Regulation No 2018/1672.

In the financial sector, BaFin is the key AML supervisory authority.

Board oversight follows the general management and supervision framework, overlaid by applicable AML rules. A member of the management shall be designated as being responsible for risk management and for compliance with AML provisions. More generally, boards are expected to ensure an appropriate AML organisation and oversight framework. Personal exposure for the members of the management arises primarily through ordinary duty of care liability, administrative fines and supervisory measures and, in serious cases, criminal liability.

A company has to appoint an external auditor unless it is a small company (based on the criteria set out in 3.10 Payments to Directors/Officers). The key requirements governing the relationship between the company and the auditor are set out in the HGB. The auditor is appointed by the general or shareholders’ meeting. In an AG and two-tier system SE, the supervisory board is responsible for issuing the actual audit mandate, while in a single-tier system SE it is the administrative board, and in a GmbH it is the managing directors.

In an AG, SE and KGaA, the management board must install a system to detect and monitor risks to the continued existence of the company. However, it is best practice to maintain several systems and refined rules (for example, through reporting lines and codes of conduct) to ensure internal compliance and effective risk management. Specifically, the management board of a listed company is required by law to establish an internal control and risk management system. The supervisory board will review the existence and effectiveness of such measures. Managing directors of a GmbH are also expressly obliged to take measures for the early detection of a crisis.

According to German case law, effective compliance management systems are also required in order to fulfil the duty of care owed to the company.

The topics of sustainability and social and environmental responsibility have become increasingly significant in both German and global corporate governance, resulting in more specific and extensive expectations and legislation on this matter, at both national and EU level. In particular, the EU Corporate Sustainability Reporting Directive (CSRD) and the German Supply Chain Act came into force in January 2023. The Act on Corporate Due Diligence Obligations in Supply Chains (CSDDD), which aimed to implement the UN Guiding Principles on Business and Human Rights throughout the global supply chain, came into force in July 2024.

HGB

Under the HGB, larger listed capital companies with more than 500 employees are under a duty to issue a non-financial declaration that expands their management report. This declaration has to briefly describe the business model of the company. Moreover, it has to refer to other aspects of corporate social responsibility – at least to environment-related, employee-related and social matters, as well as to the respect shown for human rights and the efforts made to fight corruption and bribery.

CSRD

Following the adoption of the Omnibus I Package (approved by the Council of the European Union on 24 February 2026 and published in the Official Journal of the EU on 26 February 2026), the scope of application of the CSRD has been significantly reduced. In the future, only companies or groups with more than 1,000 employees and annual turnover of more than EUR450 million will be required to report on sustainability in accordance with the CSRD. This will also apply to non-EU companies with net turnover in the EU of more than EUR450 million, and to their subsidiaries and branches generating turnover of more than EUR200 million in the EU.

Reporting in accordance with the European Sustainability Reporting Standards (ESRS) will remain in place, but its application will be simplified. The use of sector-specific standards will be voluntary. In addition, smaller companies will no longer be required to provide additional information beyond the voluntary standards to larger business partners (the so-called value chain cap).

The German Federal Cabinet approved a first draft bill in September 2025, aiming to transpose the CSRD into the German Commercial Code (HGB) by the end of 2025. The German government has announced that it will incorporate the CSRD amendments adopted at European level into the current legislative process. The existing reporting requirements will continue to apply for the 2025 financial year. Furthermore, with the publication of the new delegated regulation on EU taxonomy disclosure requirements – (EU) 2026/73, which came into effect in January 2026 – materiality thresholds were introduced and reporting obligations were simplified.

In June 2021, the federal government passed the so-called Supply Chain Act (Lieferkettensorgfaltspflichtengesetz), which obliges companies to respect human rights and the environment throughout the global supply chain, and to remedy violations. For this purpose, companies must establish an appropriate risk-management system and conduct a risk analysis for themselves and suppliers. The first is ensured by the appointment of an internal officer for monitoring the system. Companies must also establish a procedure for filing complaints concerning human rights violations. Finally, companies must publish an annual report on their compliance containing fulfilment of their obligations under the Supply Chain Act. The law came into force on 1 January 2023 for companies in Germany with at least 3,000 employees. As of 1 January 2024, the new regulations apply for companies with at least 1,000 employees.

The EU Corporate Sustainability Due Diligence Directive (CSDDD) came into force in July 2024. Following the adoption of the Omnibus I Package, the scope of the CSDDD has been substantially narrowed. In future, due diligence obligations will only apply to companies or groups with more than 5,000 employees and a net annual turnover of more than EUR1.5 billion, with the same thresholds applying equally to non-EU companies provided that the relevant net annual turnover threshold is met within the EU. Affected companies will be required to carry out scoping exercises to identify risks in their chain of activities, and shall only request information from business partners with fewer than 5,000 employees where the information required for an in-depth assessment cannot be obtained in any other way. The obligation to submit transformation plans for compatibility with the Paris Climate Agreement has been dropped.

All affected companies must comply with the requirements of the CSDDD as of 26 July 2029, with the application deadline having been set as a uniform date to allow companies sufficient time to take into account the practical guidance and best practices included in the Commission's due diligence guidelines, which are to be adopted by 26 July 2027.

The implementation of the CSDDD into German law will take place, in line with the coalition agreement (Koalitionsvertrag) published on 9 April 2025, by replacing the existing Supply Chain Due Diligence Act with a new law on international corporate responsibility, which is intended to implement the CSDDD in a low-bureaucracy and enforcement-friendly manner. It is further intended to abolish the reporting obligation under the Supply Chain Act. Furthermore, violations of the existing statutory due diligence obligations – with the exception of massive human rights violations – are not to be sanctioned until the new law comes into force.

There is no standalone corporate law regime specifically governing board oversight of AI. There is no requirement to appoint AI specialists or establish dedicated AI committees. Instead, oversight follows general corporate governance rules: the management board is responsible for running the company on an informed basis and for setting up monitoring systems, while the supervisory board oversees these activities.

Boards may use AI as a support tool – for example in research, drafting or analysis – but not as a substitute for human judgement. Core management and oversight functions remain non-delegable.

There is neither a general obligation nor a prohibition to use AI; deciding whether and how to use it is itself a business judgement requiring due care and consideration of the company’s best interests.

Germany manages AI risks through a layered framework rather than a single law, combining the EU AI Act, corporate law duties, data protection, employment rules and sector-specific regulation. Data protection authorities have issued guidance on AI, and works councils’ rights may be triggered where AI affects employees.

In 2025, developments were mainly driven by the EU AI Act, which introduces a risk-based system covering prohibited, high-risk, transparency and minimal-risk AI. Since February 2025, organisations must ensure staff have sufficient AI literacy (Article 4 of the AI Act) and avoid certain prohibited practices (Article 5 of the AI Act). Financial entities are also subject to the Digital Operational Resilience Act (DORA), requiring management to oversee Information and Communication Technology risk.

In practice, AI strategy is led by management, supported by legal and technical functions, with supervisory boards providing oversight. Using AI is a business decision under the ordinary duty of care and business judgement rule. Once adopted, companies must implement controls such as monitoring, validation, safeguards and documentation.

In Germany, liability exposure for boards and officers using AI is not governed by a separate regime but by general corporate law duties. For stock corporations, Sections 93, para 1, and 116 of the AktG apply, meaning that responsibility remains with human decision-makers.

Risks typically arise where AI is introduced or relied on without proper assessment, safeguards or oversight. In practice, this may lead to liability for discriminatory outcomes, data protection breaches, confidentiality violations, misleading AI-assisted communications, product-related harm or failures in disclosure.

At EU level, the AI Act introduces additional regulatory exposure, while the revised Product Liability Directive extends product liability rules for new technologies, including AI systems.

There is no general legal principle or specific single obligation to disclose AI use or strategy. Instead, disclosure requirements arise from specific AI rules, data protection law, general reporting duties and capital markets regulation. AI-related matters must be disclosed when required by law or when they significantly affect the company’s business, risk profile or governance.

At the AI-specific level, Article 50 of the AI Act will introduce transparency duties from August 2026. These apply in situations where individuals must be informed they are interacting with AI, or where synthetic content is used (eg, deepfakes). Where personal data is involved, GDPR information and transparency duties may also apply.

In corporate reporting, there is no dedicated AI section, but companies are required to disclose their business development, position, likely future development, and material opportunities and risks. This can include AI-related strategy, dependencies or incidents, where relevant. Similarly, under the CSRD/ESRS framework, companies must report material sustainability risks, which may include AI-related impacts on workforce, consumers or business conduct.

In capital markets, AI-related risks must be disclosed in prospectuses if they are material to the issuer or the securities (Article 16 of the Prospectus Regulation). For issuers subject to MAR, AI-related incidents may also trigger ad hoc disclosure under MAR if they qualify as inside information under Articles 7 and 17 of MAR.

POELLATH

Hofstatt 1
Munich, 80331
Germany

+49 892 424 0280

+49 892 424 0999

eva.nase@pplaw.com www.pplaw.com
Author Business Card

Trends and Developments


Authors



Freshfields PartG mbB has a corporate governance practice defined by its international reach and its ability to provide consistent expert advice on all aspects of corporate governance law across Europe’s major jurisdictions. In Germany, the practice advises public and private companies, as well as supervisory and management boards, on a broad range of governance matters, including board responsibilities, regulatory compliance and the structuring of governance frameworks. It is regularly involved in significant corporate events, such as mergers, strategic transactions, leadership changes, internal investigations and crisis response. With extensive cross-border experience, the practice supports clients in navigating governance issues across jurisdictions, ensuring consistency with both German and international legal standards. It also advises on shareholder engagement, activism-related matters and disclosure obligations. The practice’s work is grounded in legal and regulatory analysis, with a focus on enabling sound governance structures and informed decision-making in complex and evolving regulatory environments.

In 2026, corporate governance in Germany continues to be reshaped by a combination of regulatory, geopolitical and technological disruptions, although the nature and intensity of these challenges have shifted considerably compared to just one year ago. At the same time, scrutiny of business judgement decisions has increased. For boards, this demands not only strategic foresight and adaptability, but also the capacity to act decisively in a landscape where the rules themselves are in constant motion.

  • Legal and strategic uncertainty: regulatory volatility and geopolitical instability are making long-term planning a minefield. EU sustainability standards have undergone major changes, with most still awaiting national transposition. Global conflicts and shifting alliances are altering trade flows, with sanctions imposed or lifted and new economic blocs emerging. In this environment, boards must not only preserve strategic clarity, but also engage in robust scenario planning to test assumptions, prepare for alternative outcomes and support resilient decision-making.
  • Artificial intelligence disruption: AI governance has moved beyond the stage of mere adoption. Boards now face the challenge of governing increasingly autonomous AI agents, integrating AI into their own decision-making processes, and keeping pace with a regulatory environment in rapid flux. As AI capabilities grow, the failure to leverage AI tools might itself become difficult to justify under the Business Judgement Rule (BJR).
  • Data and cybersecurity risks: cyber threats are more sophisticated than ever, making data both an asset and a risk. Boards must treat cybersecurity not as an IT issue, but as a central governance priority.
  • Complex business judgements: the rate of business failure is increasing due to inadequate due diligence, poor risk management and poor decision-making. In an increasingly risk-prone and complex business environment, such failings can have far-reaching consequences. To benefit from the protections of the BJR, board members must act on an adequate information basis, avoid or deal with conflicts of interests, and pursue the best interests of the company. Boards that fail to meet this standard risk not only legal exposure, but also a loss of stakeholder trust.

2026 will test the resilience and adaptability of executive leadership. With Germany at the centre of global regulatory and technological shifts, and geopolitical tensions multiplying, boards must be equipped with the insight and agility to navigate a highly complex and unpredictable landscape. In practice, the most significant personal liability risks for board members arise from business decisions made on an inadequate information basis or without adequate scenario planning, and from deficiencies in compliance systems or in the investigation and response to possible compliance incidents or mismanagement.

Legal and Strategic Uncertainty

Increasingly diverging regulatory requirements, shifting societal norms and geopolitical volatility are creating a landscape of legal and strategic uncertainty. Boards must navigate polarised sustainability debates and evolving geopolitical instabilities with heightened caution and clarity.

Sustainability

The sustainability agenda is increasingly fragmented. While some advocate climate-first policies, others question the economic impact of heavy regulation. In Germany, corporate sustainability efforts face revisions to become less bureaucratic and costly.

Supply chain regulation

Germany’s Supply Chain Act (Lieferkettensorgfaltspflichtengesetz, or LkSG) has been in force since 1 January 2023 and was initially welcomed as a milestone in promoting human rights and environmental standards in global supply chains. However, it has since faced criticism, particularly from the business community, for being overly complex and burdensome, affecting several thousand companies.

In response, the German government adopted a draft bill on 3 September 2025, which went through its first parliamentary reading on 16 January 2026. The bill introduces interim adjustments (notably the removal of the annual reporting obligation and a tighter focus on sanctioning of serious breaches) as Germany prepares to replace the Act and align with the EU-wide Corporate Sustainability Due Diligence Directive (CSDDD – Directive (EU) 2024/1760). The CSDDD establishes a corporate due diligence duty requiring in-scope companies to identify and address adverse human rights and environmental impacts in their own operations and in their subsidiaries, and, where relevant, along their chain of activities.

Against this background, and even ahead of the draft bill’s formal adoption, the German government has already taken administrative steps affecting enforcement practice under the LkSG. On 26 September 2025, the Federal Office for Economic Affairs and Export Control (BAFA) was instructed to discontinue the review of corporate reports under the LkSG. Where the draft bill envisages the deletion of specific administrative offence provisions, BAFA is to discontinue pending proceedings based on those provisions and refrain from initiating new ones. For remaining offences, administrative fines are to be imposed only under strict conditions – in particular, in cases of severe violations involving especially serious human rights abuses. BAFA is to pursue such proceedings only in narrowly defined and specifically substantiated circumstances, which it must demonstrate on a case-by-case basis.

At the European level, the CSDDD has likewise undergone regulatory amendments after the EU Parliament and Council adopted the “Omnibus I” package, which came into effect on 18 March 2026. The Omnibus packages follow the EU Commission’s proposals to simplify EU rules, reduce administrative burdens and enhance competitiveness. Member states are required to transpose the amendments by 26 July 2028, with the due diligence obligations expected to apply from 26 July 2029, and reporting obligations starting in 2030. The amendments include:

  • significantly raised applicability thresholds for companies with cumulatively at least 5,000 employees and a net worldwide turnover of at least EUR1.5 billion;
  • a more structured, risk-based approach to due diligence obligations along the chain of activities;
  • limiting the extent to which due diligence obligations and information requests are passed down the value chain to small and medium-sized enterprises (SMEs), also referred to as the “trickle-down effect”;
  • removing the obligation to adopt and implement a transition plan for climate change mitigation;
  • extending the monitoring interval from at least annually to at least every five years; and
  • removing the standardised civil liability provision.

The German government has stated that it intends to transpose the CSDDD into national law in a streamlined and business-friendly manner. For now, companies should remain compliant with applicable requirements in Germany while preparing for the transition to the revised EU framework. Close monitoring of legislative and regulatory developments remains essential, particularly during the transition period.

Sustainability reporting

Sustainability reporting has transitioned from a voluntary initiative to an increasingly expected practice aimed at fostering corporate accountability and supporting risk management. However, as it becomes more widespread, so does the risk of greenwashing, where companies may present an exaggerated or misleading picture of their environmental and social performance. Amid this shifting environment, debates around the effectiveness and burden of sustainability reporting continue to evolve.

Germany has not yet transposed the EU Corporate Sustainability Reporting Directive (CSRD – Directive (EU) 2022/2464 as amended by Directive (EU) 2025/794). In September 2025, the government published a draft bill based on the CSRD as in force at the time, proposing that so-called “Wave 1” entities (including large public interest entities and issuers on an EU-regulated market with more than 500 employees) report for the 2025 financial year. Anticipating changes at the EU level, the draft also includes a temporary exemption for companies with fewer than 1,000 employees for the 2025 and 2026 reporting years. The bill has not yet been debated in the German parliament.

At the EU level, the newly adopted “Omnibus I” package has narrowed the CSRD’s scope in response to concerns about excessive bureaucracy. For financial years starting on or after 1 January 2027, the CSRD’s scope is determined exclusively by the new Omnibus thresholds of more than 1,000 employees and net turnover exceeding EUR450 million, effectively replacing the previous phased roll-out. According to the EU Commission, these changes exempt around 80% of companies previously within scope. The German government has announced that it will adapt its CSRD transposition draft bill to reflect these changes.

While awaiting Germany’s national transposition law, companies may voluntarily apply the European Sustainability Reporting Standards (ESRS), in whole or in part. The ESRS are uniform EU reporting standards that specify the content, structure and methodology of sustainability reporting under the CSRD, covering environmental, social and governance matters. Voluntary application may enhance transparency and build stakeholder trust. However, it also entails risks, including increased scrutiny and potential allegations of greenwashing. Companies must therefore carefully weigh these considerations. Despite these challenges, many German firms are already choosing to align with the ESRS framework, at least partially, as part of their sustainability reporting strategy.

Companies considering this approach should note that the standards are undergoing significant revision. Under the Omnibus I package, the EU Commission is required to adopt a delegated act within six months of the Directive’s entry into force (ie, by 18 September 2026 at the latest), to substantially reform the first set of ESRS.

Geopolitical risks

Rising geopolitical tensions have become a defining feature of the global economy, reshaping global trade and investment. For German companies, anticipating disruptions to supply chains, market access and competitive positioning has become a constant strategic imperative. Boards should therefore prioritise resilience and robust risk management to adapt to these external pressures.

Since 2022, the EU has progressively expanded its sanctions against Russia. The 18th sanctions package, issued in July 2025, included a lower oil price cap, a transaction ban relating to the Nord Stream pipelines and the listing of more than 100 additional vessels. The 19th package, of 23 October 2025, further tightened the regime, notably by introducing a phased import ban on Russian liquefied natural gas starting in 2026 and targeting Russia’s alternative payment systems. Although a 20th package planned for February 2026 stalled, the overall trajectory remains one of increasing economic pressure and intensified efforts to prevent sanctions circumvention.

Beyond Russia, the EU has also significantly expanded its restrictive measures against Iran. In September 2025, the EU Council reimposed broad sanctions targeting Iran’s nuclear proliferation activities following findings of non-compliance. These measures include asset freezes, an investment ban, restrictions on payment transfers and wide-ranging trade restrictions covering crude oil, natural gas and petrochemical products. In early 2026, the EU further extended its Iran sanctions, citing human rights violations and Iran’s support for Russia’s war against Ukraine.

The legal landscape for sanctions enforcement has also tightened significantly. Following the transposition deadline for Directive (EU) 2024/1226, Germany passed legislation that came into force on 6 February 2026, substantially reforming its sanctions criminal law under the Foreign Trade and Payments Act (Außenwirtschaftsgesetz, or AWG). Under the new framework, numerous breaches previously treated as regulatory offences are now criminal acts, and the maximum corporate fine has been increased to EUR40 million. These changes significantly raise liability risks and necessitate more robust internal sanctions compliance systems.

More broadly, the geopolitical risk landscape has become increasingly fragmented. Strategic competition between the US and China, particularly in relation to Taiwan and technological sovereignty, is forcing German companies to reassess critical dependencies and navigate complex export control regimes. At the same time, persistent instability in the Middle East continues to pose immediate risks to supply chain reliability and energy costs.

For energy-intensive industries in particular, this environment requires a fundamental reassessment of energy security as a core governance responsibility. Boards must actively oversee energy needs, supplier dependencies and exposure to further supply disruptions or price shocks. Developing concrete back-up strategies, such as diversifying energy sources, securing long-term supply agreements and preparing for emergency scenarios, forms an integral part of the board’s duty of care.

At the same time, current conflicts are accelerating a broader trend towards the instrumentalisation of regulation for geopolitical purposes. For globally active companies, this creates a structural tension: the obligation to comply with all applicable laws becomes increasingly difficult where regulatory regimes across jurisdictions not only diverge but directly contradict one another.

Where such normative conflicts arise, boards cannot assume that domestic law will automatically prevail. Courts have begun to adopt a more pragmatic approach, increasingly requiring companies to exhaust available mechanisms to resolve regulatory conflicts before determining, on the basis of a carefully documented assessment, which obligations to prioritise. In this context, effective navigation requires companies to closely integrate public affairs, stakeholder engagement and strategic risk management into their compliance frameworks.

In this volatile and high-stakes geopolitical environment, boards must treat geopolitical risk mitigation as a proactive strategic discipline rather than a reactive compliance exercise. Key measures include:

  • diversifying supply chains;
  • strategically reviewing and adapting international contracts;
  • conducting structured scenario planning and “What if?” analyses, including political and security related scenarios;
  • developing contingency and exit strategies; and
  • enhancing reporting on geopolitical risks to meet the expectations of investors, regulators and business partners.

More broadly, boards should aim to make their organisations security-resilient by strengthening internal capabilities in areas such as geopolitical analysis, public affairs, risk management and operational security, and by ensuring that these functions have direct reporting lines to board level.

AI Disruption

The integration of AI into corporate operations and decision-making continues to transform how companies operate, compete and strategise. While AI creates significant opportunities, it also introduces new uncertainties, challenging business models, disrupting entire sectors and raising complex ethical and legal questions. The core principles for AI governance outlined last year – legality, careful decision making, non-delegable responsibility, human supervision, technical competence and appropriate organisational safeguards – continue to form the baseline that boards must uphold.

Within the span of a single year, however, the practical landscape has shifted markedly. The central question is no longer whether or in what form AI should be adopted. Instead, boards must determine how to embed specialised AI solutions, how to implement safeguards and redundancies for critical AI systems, how to govern increasingly autonomous AI agents, and how extensively AI should be integrated into the board’s own work. All of this must be achieved against the backdrop of a regulatory environment that remains in rapid flux.

Productivity effects and workforce implications

Empirical evidence suggests that AI adoption can deliver measurable productivity gains. A study of over 12,000 European firms found that AI adoption increases labour productivity by 4% on average, with no evidence of reduced employment in the short run. The effects are, however, contingent on complementary investments in AI expertise: according to a 2026 CEPR discussion paper based on firm-level data collected by the European Investment Bank, each additional percentage point invested in workforce training amplifies AI’s productivity effect by 5.9% (CEPR Discussion Paper No. 21082, Aldasoro et al., AI Adoption, Productivity and Employment: Evidence from European Firms). AI implementation, therefore, should be accompanied by adequate investment in human capital. As a result, the Chief Human Resources Officer (CHRO) is becoming increasingly strategic, spanning AI integration, talent transformation and the management of regulatory complexity at the interface of employment, data protection and technology law.

Agentic AI

One development of growing significance is so-called agentic AI: systems that do not merely respond to prompts but autonomously perform tasks, such as negotiating or settling transactions without direct human involvement. As software begins to assume such functions, traditional regulatory and governance concepts are placed under strain. At the same time, the more capable, autonomous and operationally central these systems become, the stronger the case for elevating AI oversight to the highest level of corporate governance.

To make AI governance tangible and auditable, boards should consider defining concrete metrics and key performance indicators, such as the number of AI use cases deployed, AI-related incidents, or employee training coverage. Quantifiable oversight enables boards to track progress, identify gaps and demonstrate governance maturity to regulators and investors. In parallel, boards should ensure that appropriate redundancies and fall-back procedures are in place so that governance and decision-making can continue if critical AI systems become unavailable due to technical failures, cyber incidents or third-party outages.

AI as a strategic tool for the board itself

Boards are no longer merely overseeing AI use across the enterprise – they are becoming users themselves. According to a 2026 PwC survey of board members on corporate governance trends, 35% of directors report that their boards have already integrated AI, including generative AI, into their oversight activities (PwC, 2026 Corporate Governance Trends: Five Priorities for Directors). This trend is likely to accelerate. Boards and directors can use AI to digest information in preparation for meetings, identify trends from complex or vast data, or enable scenario planning, and use AI for strategic reflection.

Although AI expertise is not a requirement for supervisory board membership, all directors should have a shared understanding of the AI models used by the board and the company, including their capabilities and limitations. Ultimately, AI remains a decision support tool and cannot substitute the board’s duty to make informed business judgements, including the critical examination of assumptions and data sources.

Boards whose members actively use AI should treat AI usage policies and targeted training as priorities. Boards that do not yet use AI should nonetheless place the topic on their agenda. Adoption should be deliberate and organic, allowing space for experimentation and skill development rather than forced or disruptive implementation.

Regulatory environment

Mirroring the technology itself, the regulatory environment surrounding AI is highly dynamic. Most of the EU AI Act (Regulation (EU) 2024/1689) will become applicable in August 2026, introducing a binding risk-based classification system. High-risk AI systems, which are common in enterprise settings, will be subject to stringent requirements relating to transparency, data governance and human oversight.

In parallel, the EU Commission proposed the “Digital Omnibus” in November 2025 – a comprehensive package aimed at simplifying parts of the EU digital regulatory framework, including targeted amendments to facilitate implementation of the AI Act. Beyond the EU, AI regulation is becoming increasingly fragmented, with major jurisdictions pursuing structurally different policy approaches. Boards must therefore embed AI Act compliance into their governance and compliance architecture, closely monitor the Digital Omnibus process and ensure that their organisations are equipped to manage AI compliance across divergent and, in some cases, conflicting regulatory regimes.

Data and Cybersecurity Risks

In the digital economy, data serves as both a strategic asset and a critical point of vulnerability. As digital integration deepens, cybersecurity has become a governance priority. Greater interconnectivity exposes companies to an expanding threat landscape, including data breaches, ransomware attacks and industrial espionage.

Cyber threats have intensified significantly in recent years. Distributed Denial of Service (DDoS) attacks, which overwhelm systems with excessive traffic and disrupt operations, have more than doubled against European businesses. These risks are amplified by the geopolitical dynamics outlined above. Hybrid warfare, including state-sponsored cyber-attacks, espionage and sabotage, has become a defining feature of the current security environment. As audit and risk committees increasingly integrate geopolitical scenarios into their agendas, boards must treat cyber resilience as inseparable from geopolitical risk management.

At EU level, this evolving threat landscape has prompted a substantially enhanced regulatory framework under Directive (EU) 2022/2555 on measures for a high common level of cybersecurity (the NIS2 Directive). NIS2 significantly expands the scope of regulated entities across 18 critical sectors and introduces stricter reporting obligations, as well as direct accountability at board level.

After a delay of more than two years, Germany adopted its NIS2 Implementation Law, which entered into force on 6 December 2025. The law expands the number of regulated entities from approximately 4,500 to around 30,000 organisations. Core obligations include mandatory registration with the Federal Office for Information Security (BSI), a three-stage incident reporting regime and comprehensive cybersecurity risk management measures covering all IT systems operated by the entity. Responsibility is expressly placed on management bodies, with breaches subject to fines of up to EUR10 million or 2% of total worldwide annual turnover for so-called particularly important entities.

Boards should ensure that they:

  • enhance IT literacy among their members to ensure informed oversight of digital risks;
  • integrate redundancy and back-up protocols to maintain operational continuity;
  • implement and regularly test incident response plans to ensure preparedness; and
  • facilitate close co-ordination between IT, legal, compliance and risk functions to enable a unified response.

At the same time, the EU’s broader simplification agenda also extends to cybersecurity regulation. The “Digital Omnibus” proposed by the EU Commission in November 2025 includes targeted adjustments to the NIS2 Directive and the Cyber Resilience Act, aimed at streamlining incident reporting and reducing administrative burdens. Boards should actively monitor these developments in order to anticipate and appropriately leverage potential compliance relief.

Cybersecurity must be a standing board agenda item, supported by regular reporting, sustained investment and clear accountability. Failure to act entails significant legal, financial and reputational risks. Boards must therefore clearly allocate responsibilities across both management and supervisory levels.

Complex Business Judgements

The accelerating complexity of global markets, regulatory frameworks and technological disruption has elevated the stakes of board-level decision-making. Strategic decisions are increasingly made in contexts where information is incomplete, risks are multilayered and interdependent, and outcomes are difficult to predict.

Complexity, however, does not mitigate responsibility; on the contrary, it demands a more structured and disciplined approach to decision-making and compliance oversight. In such an environment, personal liability risks may arise not only from business judgements made on an insufficient information basis or without adequate preparation for plausible alternative scenarios but also from deficiencies in compliance systems and from inadequate investigation and response where there are indications of compliance incidents or mismanagement.

Over the past decade, there has been a significant increase in cases where both compliance incidents and board-level business judgements have been retrospectively investigated following (significant) losses to the company. In parallel, the expectations regarding engagement and supervision by supervisory boards have increased, effectively tightening the duties of their members.

Against this backdrop, board members must address both business judgement and compliance-related risks. In relation to business decisions, the BJR shields board members from liability where decisions are made (i) on an adequate information basis, (ii) in the best interests of the company and (iii) in good faith and free from conflicts of interest. Beyond this, board members must also ensure that the company has an adequate compliance framework and a credible process for investigating and addressing indications of misconduct or control failures.

To meet this standard, boards should systematically embed the following questions into their decision-making processes.

  • Is our business judgement based on adequate information?
  • Where AI-generated inputs are used, have we observed the applicable AI governance principles?
  • Have underlying assumptions been critically reviewed and checked for plausibility?
  • Is external (independent) professional advice required to ensure the adequacy of the information basis or to provide guidance on an unclear legal framework?
  • Have all relevant business opportunities (including alternative scenarios) and risks for each of the relevant decision options been adequately assessed and balanced against each other?
  • Are board members subject to potential conflicts of interest?
  • Are we aware of the burden of proof and, if so, is there a proper documentation process in place, laying out that the BJR requirements are met (also taking into account the aspects mentioned in the aforementioned points)?

In a high-stakes environment, governance is measured by action, not intention. Boards that can clearly demonstrate how and why decisions were made are not only better protected under the law, but also more effective in practice. Embedding disciplined decision-making processes, robust compliance structures and credible investigation and response mechanisms is essential to managing liability risks, maintaining credibility and ensuring that board decisions stand up to scrutiny.

Freshfields PartG mbB

Große Gallussstraße 14
60315 Frankfurt am Main
Germany

+49 172 240 2929; +49 173 52 40 057

Stephan.Waldhausen@freshfields.com; Moritz.Pellmann@freshfields.com www.freshfields.com
Author Business Card

Law and Practice

Authors



POELLATH is an internationally operating German law firm of more than 180 lawyers and tax advisers in Berlin, Frankfurt and Munich, providing high-end legal and tax advice. The firm advises on all transaction-related areas, including corporate, M&A, private equity, funds, real estate, private clients, succession planning and tax-related matters. POELLATH’s corporate advice covers corporate law and group company law, reorganisations, capital market rules, corporate litigation and compliance. POELLATH advises publicly listed and private companies on preparing and conducting their general and shareholder meetings on all matters, including mergers, spin-offs, hive-downs and conversions of legal form, and on all corporate advisory matters related to corporate governance. A further core area is public takeovers with subsequent corporate integration. Key clients include Vodafone, Deutsche Telekom AG, shareholders of Porsche Automobil Holding SE, PUMA SE, Wacker Neuson SE, Eckert & Ziegler SE, Nemetschek SE, Münchener Hypothekenbank, BayWa, Giesecke+Devrient, Fiege Group, Groz-Beckert and STAEDTLER.

Trends and Developments

Authors



Freshfields PartG mbB has a corporate governance practice defined by its international reach and its ability to provide consistent expert advice on all aspects of corporate governance law across Europe’s major jurisdictions. In Germany, the practice advises public and private companies, as well as supervisory and management boards, on a broad range of governance matters, including board responsibilities, regulatory compliance and the structuring of governance frameworks. It is regularly involved in significant corporate events, such as mergers, strategic transactions, leadership changes, internal investigations and crisis response. With extensive cross-border experience, the practice supports clients in navigating governance issues across jurisdictions, ensuring consistency with both German and international legal standards. It also advises on shareholder engagement, activism-related matters and disclosure obligations. The practice’s work is grounded in legal and regulatory analysis, with a focus on enabling sound governance structures and informed decision-making in complex and evolving regulatory environments.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.