Risk Monitor 2026: From hype to billion-dollar threat – Why AI is now the biggest new business risk

Xpert Pre-Release

Available in 27 languages 📢

Published on: June 25, 2026 / Updated on: June 25, 2026 – Author: Konrad Wolfenstein

Risk Monitor 2026: From hype to billion-dollar threat – Why AI is now the biggest new business risk – Image: Xpert.Digital

Loss of control in the executive suite: The 5 biggest risks for the German economy

AI instead of climate protection: What DAX board members are really afraid of in 2026

Deceptive optimism: What German CEOs systematically conceal in their annual reports and why the largest German corporations suddenly feel powerless

The German corporate landscape in 2026 finds itself in a paradoxical state: While top managers exude unwavering confidence in their public appearances and prefaces, the actual risk reports of DAX, MDAX, and SDAX companies reveal an unprecedented loss of control. The new "Risk Monitor 2026" ruthlessly exposes how external threats such as cyberattacks, oppressive regulations, and geopolitical crises are increasingly driving companies forward – and operational control mechanisms are failing.

Particularly alarming is the dramatic shift in two global future issues: Artificial intelligence is mutating from a pure efficiency savior into a tangible, potentially ruinous balance sheet risk. At the same time, climate change is being almost silently banished from boardrooms – a dangerous maneuver that is more a product of the current political climate than of the actual physical and economic threat. The exclusive analysis of 138 annual reports reveals a deep communication gap between the leadership narrative of CEOs and the harsh reality in the engine room of the German economy. This finding must serve as a wake-up call for investors, regulators, and Germany as a business location alike.

Risk Monitor 2026: When uncertainty becomes strategy

How AI is remapping the risk landscape – and how climate change is quietly disappearing from boardrooms

Listed companies in Germany will communicate their business risks with a new level of detail in 2026. Risk reports from the DAX, MDAX, and SDAX indices will no longer read like perfunctory annual reports – they will reflect a fundamental shift in corporate self-perception: The perceived ability to act is diminishing, while dependence on external forces is growing. This diagnosis is the key finding of the Risk Monitor 2026, a scientific collaboration between the University of Hohenheim and the communications consultancy Crunchtime Communications, which analyzed the annual reports of 138 of the 160 companies listed in the DAX, MDAX, and SDAX.

What's remarkable about this year's report is that five risk categories have exceeded the 90 percent mark – compared to just two in 2025. This isn't a marginal statistical shift, but a structural signal. At the same time, artificial intelligence appears for the first time as an independent risk category in a quarter of all annual reports, while climate change plummets by 19 percentage points to 56 percent. Together, these two trends tell a story of changing political climates, accelerated technological advancements, and a business landscape operating under constant structural pressure.

Five risks that almost everyone mentions: The new consensus of loss of control

The risk reports from 2026 show a striking homogeneity. Regulatory changes and cyber incidents top the list at 96 percent each – unchanged from the previous year and thus at a level that leaves little room for further increase. Financial topics such as currency and exchange rate risks as well as interest rate changes have increased by 10 percentage points to also 96 percent – a development that is not surprising given ongoing monetary policy uncertainties and the lingering effects of global trade frictions.

Geopolitical developments climbed by 7 percentage points to 93 percent, while legal and compliance issues also rose by 10 percentage points to 93 percent – both categories directly linked to the tightening of regulatory requirements and the ongoing geopolitical crisis. The war in Ukraine, the Middle East conflict, and the unpredictable US foreign economic policy form a geopolitical triangle that burdens virtually all export-oriented companies in the German capital market. The German Economic Institute (IW) aptly describes this complex situation for 2026: The relatively positive economic outlook at the end of 2025 evaporated with the renewed outbreak of the Middle East conflict, blockades of key shipping lanes, and new price shocks at the production and consumption levels.

What these five top risks have in common is their structural uncontrollability from a corporate perspective. They are not operational bottlenecks that could be remedied through process optimization or investment. Regulations originate in Brussels and Berlin, geopolitical escalation from Moscow, Tehran, or Washington, and cyberattacks from the digital underground. Companies are subjects of these forces, not their shapers. This realization—however trivial it may sound—has profound consequences for strategic management and, in particular, for communication with stakeholders.

The Allianz Risk Barometer 2026, which is based on surveys of over 3,300 risk experts from 97 countries, largely confirms this picture: Cyber incidents lead the risk ranking worldwide for the fifth time in a row, while regulatory changes in Germany have moved up to third place – evidence of the particular regulatory sensitivity of German SMEs and listed corporations.

The retreat from what is feasible: Operational risks lose weight

While external systemic constraints dominate, the figures for risks over which companies have direct control are declining. Skilled labor shortages fall from 81 to 74 percent, production and supply bottlenecks decrease from 73 to 60 percent, and changing customer behavior drops from 73 to 58 percent. At first glance, this might sound like good news – but on closer inspection, it's a mixed bag.

The decline in the skilled worker shortage is not primarily due to successful recruitment strategies or improved employer attractiveness. KfW Research shows that the proportion of companies affected by the skilled worker shortage has fallen to 21 percent – mainly because the ongoing economic weakness is dampening the demand for personnel. Structurally, the problem remains unresolved: Demographic trends, a lack of immigration capacity, and insufficient training capacity in critical technology sectors continue to have an impact. The statistical easing is a cyclical phenomenon, not a structural improvement.

A similar situation exists with supply bottlenecks: The 13 percentage point decline is less a success story of supply chain optimization than a reflection of subdued demand. The ifo Institute and the German Economic Institute have repeatedly pointed out that in a stagnant economy, bottlenecks naturally resolve themselves – without the underlying structural vulnerabilities being addressed. Supply chain resilience has therefore not been strengthened; it is simply less in demand at present.

The growing gap between externally driven and internally controllable risks is therefore not merely a statistical artifact. It is a symptom of a business landscape that increasingly perceives itself as driven by external forces. This finding has significant implications for strategic positioning, capital market communication, and ultimately for the political narrative surrounding Germany as a business location.

AI in risk reporting: From buzzword to accounting reality

The fact that artificial intelligence is explicitly mentioned as an independent corporate risk in 26 percent of the annual reports examined marks a turning point in corporate communications. During the 2024 and 2025 reporting seasons, AI reporting was dominated by opportunities – efficiency gains, automation potential, and new business models. Now, a paradigm shift is underway: AI is no longer just being presented as a tool, but also as a risk factor.

The communicated AI risks are remarkably multifaceted. Operational risks from faulty or malfunctioning AI systems exist alongside legal uncertainties due to unclear regulations. Reputational risks from AI-generated misinformation or deepfakes are just as apparent as structural dependencies on AI systems and the shortage of AI specialists. AI is therefore not an isolated risk, but a cross-cutting issue that expands and intensifies existing categories such as cybersecurity, compliance, and reputational risks.

As expected, a comparison of industries reveals a leading position for IT and finance-related sectors: 64 percent of software, IT services, and internet companies cite AI as a risk, compared to 57 percent of financial companies. Industrial sectors that utilize AI-embedded production control or predictive maintenance but communicate less digitally are likely to catch up in future reporting years. The Allianz Risk Barometer confirms this trend with even greater force: Globally, AI has risen from 10th to 2nd place, with 32 percent of respondents worldwide viewing it as a key business risk.

This gap between global perception (ranked 2nd) and the 26 percent mention rate observed in German annual reports suggests a tendency toward underreporting. A study by the Institute for Infrastructure and Communication Services, which analyzed annual reports of the DAX index family from 2022 to 2024, found that companies often describe AI risks only abstractly, if they address them at all, and instead focus on the opportunities. Awareness is growing, but the communicative discussion of AI as a systemic business risk is still in its infancy.

The EU AI Act marks a regulatory turning point, further pushing the topic into the risk columns in the coming reporting years. From August 2026, EU supervisory authorities will have full enforcement powers. In Germany, the Federal Network Agency, as the central AI supervisory authority, has already initiated preliminary investigations. Fines of up to €35 million or 7 percent of global annual revenue for the most serious violations make AI compliance a tangible financial risk. The fact that, according to current analyses, 78 percent of medium-sized companies still lack a formal AI governance structure and 83 percent do not maintain an AI register further exacerbates the discrepancy between regulatory reality and corporate preparedness.

For risk reporting, this means that in the coming years, AI will not only be included as an explicit category in the risk reports of more companies, but will also have to be described with increasing precision and legal specificity. Those who are already doing this today demonstrate governance maturity and build trust with investors, regulators, and the public.

Climate risk in free fall: Political salience as a driver of risk perception

The most significant decline in the 2026 Risk Monitor concerns the issue that is actually associated with the longest time horizon and the deepest structural relevance: climate change. While the mention rate rose steadily between 2023 and 2025, it plummeted by 19 percentage points to 56 percent in 2026. The topic has virtually disappeared from CEO prefaces: only 2 percent of CEOs mention climate change as a risk – a figure that is more of a footnote than a strategic leadership issue.

This decline correlates with a cooling of political pressure on companies regarding climate issues. The European Commission withdrew its proposal for the Green Claims Directive in the summer of 2025 after political opposition from the EPP group dominated the debate. The implementation deadlines for the EU Supply Chain Directive were postponed, and the CDU and SPD agreed in their current coalition agreement to significantly weaken the Supply Chain Due Diligence Act. The political signal is clear: climate regulation is being rolled back, slowed down, or renegotiated. CEO communication follows this political salience with remarkable directness.

This is economically explainable, but strategically risky. Climate risks don't follow a political calendar. The physical risks – extreme weather events, supply disruptions, location risks due to flooding or heat stress – are growing regardless of whether they are mentioned in risk reports. At the end of 2025, Handelsblatt's analysis of the DAX 40 companies showed that almost all companies anticipate increasing burdens from the climate crisis, but hardly reflect these risks in their balance sheets. A Union Investment study on climate risks in the DAX documented similar findings: Awareness exists, but financial representation is largely lacking.

The crucial analytical question is: Does the decline in the 2026 risk monitor reflect a genuinely lower climate risk or a politically driven shift in attention? All available climate science and macroeconomic data clearly point to the latter. The fact that, according to PwC, 82 percent of companies nevertheless maintained or even tightened their climate targets in April 2026 demonstrates that a different risk assessment prevails at the operational level than in executive communications. The gap between actual strategic practice and public communication is widening – a credibility problem that could have long-term repercussions for companies.

Furthermore, ESG reporting is by no means a thing of the past from a regulatory perspective: The EU taxonomy, the sustainability reporting obligations of the CSRD (Corporate Sustainability Reporting Directive), and the requirements of the EU supply chain law remain operational realities – albeit with altered timelines. Companies that downplay climate issues in their communications risk not only credibility but also compliance gaps in what remains a dense regulatory landscape.

Our EU and German expertise in business development, sales and marketing

Our EU and German expertise in business development, sales and marketing - Image: Xpert.Digital

Industry focus areas: B2B, digitalization (from AI to XR), mechanical engineering, logistics, renewable energies and industry

More information here:

Expert Business Hub

A thematic hub offering insights and expertise:

Knowledge platform covering global and regional economies, innovation and industry-specific trends
A collection of analyses, insights, and background information from our key areas of focus
A place for expertise and information on current developments in business and technology
A hub for companies seeking information on markets, digitalization, and industry innovations

Why CEOs conceal risks — and how transparency builds trust

The CEO's selective lens: Between leadership narrative and risk report

Perhaps the most structurally significant finding of the Risk Monitor 2026 is the massive discrepancy between what risk reports document and what CEOs address in their forewords. On average, CEOs mention just 1.4 of the 12 analyzed risk categories. 32 percent of CEOs do not mention a single risk in their foreword.

The selectivity follows a recognizable pattern. Geopolitics—the abstract, narratively accessible, and politically relevant topic—dominates CEO prefaces, with a mention rate of 54 percent compared to 37 percent the previous year. This is the only substantial increase in preface communication. All other risk categories remain dramatically underrepresented: Cyber incidents, despite being mentioned in 96 percent of risk reports, are only mentioned in the preface by 4 percent of CEOs. Legal and compliance, appearing in 93 percent of risk reports, are mentioned in only 2 percent of prefaces. These are not marginal differences; this is a fundamental communication gap.

Why do CEOs communicate so selectively? The answer likely lies in a combination of role definition, reputation management, and the inherent political logic of the CEO format. Forewords are leadership texts, not risk assessments. They are meant to provide orientation, build trust, and portray the company as capable of action. Geopolitics serves as a suitable narrative framework: it explains external difficulties without implying internal failure. Cyber incidents and compliance issues, on the other hand, are operationally specific and could raise questions about responsibility and preparedness.

The problem, however, is a communication one: The credibility gap that arises when the CEO's foreword systematically omits the company's own risk landscape undermines precisely the trust that CEOs seek to build with personal introductions. Stakeholders—investors, analysts, journalists, lenders—read both parts of an annual report. A company that exudes optimism in the foreword and then documents dozens of structural risks in the risk report doesn't inspire confidence in its leadership, but rather skepticism. Research on risk communication consistently shows that stakeholders cope much better with clearly identified uncertainties than with the impression that risks are being actively concealed or downplayed.

The communication vacuum: When risks are buried in business reports

The biggest communication gap in business reports: Foreword vs. Risk Report

The findings of the 2026 Risk Monitor reveal a structural pathology in German corporate communications that extends beyond individual cases. Risk reports are gaining in depth and breadth – five categories exceeding the 90 percent mark, new topics such as AI, and more nuanced descriptions. In contrast, board prefaces are consolidating around an increasingly narrow narrative: geopolitics as an external burden, leadership optimism as the response, and operational and legal risks met with communicative silence.

This dualism is problematic because it fragments the actual informational value of the annual report. Professional capital market participants will read the risk reports and notice the difference between them and the CEO's communication. Less specialized stakeholders—employees, customers, and the general public—generally consume the board's communication, not the detailed sections. The resulting information asymmetry negatively impacts the public perception of transparency and accountability in German business.

Furthermore, there is the institutional dimension. The risk report is not a voluntary communication tool, but a legally mandated component of the management report according to Section 289 of the German Commercial Code (HGB). Its quality is required by regulations and is assessed by auditors and increasingly by the German Federal Financial Supervisory Authority (BaFin). CEO communication is not subject to these requirements to the same extent. This structurally perpetuates the gap between mandatory communication and voluntary leadership communication.

A strategically minded management team would actively close this gap – not because it's required by regulations, but because it's more effective in terms of communication. CEOs who openly address risks, not as a sign of weakness but as an expression of strategic clarity, demonstrate precisely the leadership quality that stakeholders expect in volatile times. This isn't just a soft PR recommendation, but strategic reputation management.

What the risk landscape says about Germany as a business location

The 2026 Risk Monitor is ultimately also a document about the state of Germany as a business location. The fact that almost all listed companies identify the same external risks and feel powerless in the face of structural conditions is not just a communication problem. It is a signal about the country's economic standing.

Regulatory overload is among the most discussed burdens facing German SMEs and large corporations. The coalition agreement of the new federal government addresses this with promises of deregulation, but implementation has so far been limited. At the same time, the European regulatory landscape is becoming increasingly dense and complex: AI Act, NIS2, DORA, CSRD, CSDDD – the list of compliance requirements, which will come into force gradually from 2025 and 2026 onwards, is long and expensive.

The geopolitical dimension further complicates matters. As an export-oriented economy, Germany is particularly exposed: energy price shocks due to geopolitical conflicts, trade disputes with the US, strategic dependencies on China in critical value chains – all of this coalesces in the risk reports into a picture of persistent structural vulnerability. The German Economic Institute (IW) succinctly describes the current situation: what was still expected as a moderate upswing at the end of 2025 darkened once again with the renewed outbreak of the Middle East conflict in February 2026.

On the skilled worker side, the decline in the skilled worker risk in the risk reports from 81 to 74 percent signals one thing above all: the economic slowdown is masking a structural problem. According to KfW Research, the proportion of companies affected by the skilled worker shortage at the beginning of the second quarter of 2026 was 21 percent – historically low, but structurally unresolved. When the economy picks up again, the problem will return with renewed force. AI as a substitute for missing skilled workers is indeed a real trend – one that, in turn, creates new risks of AI dependency and skills loss, as the risk reports themselves document.

Corporate communications as a strategic lever in uncertain times

The overarching message of the Risk Monitor 2026 lies not only in the individual diagnosis of risk categories. It lies in the recognition that the communicative management of risks has itself become a core competency. In a world where external shocks are the norm, companies differentiate themselves less through their ability to completely avoid risks than through their ability to manage them transparently and competently.

This insight is not trivial. It changes how investor relations must be conceived, how CEO communication should be structured, and how risk reports can fulfill their true function as trust-building instruments. International comparisons show that companies that communicate proactively and with nuance during crises pay significantly lower reputational premiums than those that resort to reactive strategies of silence or appeasement.

The finding from the risk monitor that CEOs address an average of only 1.4 risks in their forewords is therefore not just a finding about a lack of transparency. It is a finding about a missed strategic opportunity. In an environment where stakeholders can recognize and accept uncertainty, but do not forgive cover-ups and naivety, a new model of proactive risk communication would be a genuine competitive advantage.

The five risk categories exceeding the 90 percent mark, the emergence of AI as an independent risk factor, and the notable retreat of climate change from boardroom forewords are not merely snapshots of a single reporting year. They are indicators of deeper shifts in corporate perception, the political climate, and technological transformation. Understanding these signals provides an analytical advantage – both as investors and as managers.

Outlook: What will be in the risk reports in 2027

Based on current developments, reliable trend predictions can be made for the upcoming reporting cycle. AI as a risk category will continue to gain traction – not least because the EU AI Act will come into full effect in August 2026, making AI compliance a strict regulatory requirement. The reporting rate is expected to rise from 26 percent to between 40 and 50 percent, with increasingly specific descriptions of the risk types.

Whether climate change experiences a reversal or continues to decline will depend largely on whether extreme weather events with a direct impact on the supply chains or production sites of listed companies increase their political salience again – or whether regulatory adjustments such as the CSRD force a structural return of the issue. Regulatory pressure for climate risk reporting remains considerable, even if the political momentum for it has waned.

Geopolitical risks are expected to remain at a high level. As long as the conflicts in Ukraine and the Middle East persist, transatlantic trade policy remains unpredictable, and strategic competition between the US and China escalates, the geopolitical risk level is unlikely to fall below 90 percent. For risk management and corporate communications, this means that the ability to communicate effectively in the face of ongoing uncertainty is not a temporary crisis management tool. It is the new normal for corporate leadership.

🎯🎯🎯 Data-driven B2B industry hub as a quasi-in-house solution

The quasi-in-house solution: How Xpert.Digital closes operational gaps in B2B marketing and sales – Smart Content-Driven Business - Image: Xpert.Digital

Xpert.Digital is a data-driven B2B industry hub led by Konrad Wolfenstein . The company acts as an external, quasi-in-house solution for industrial partners, closing operational gaps in marketing, content, and sales – without requiring additional resources on the client side.

More information here: