ASML and ZEISS control the chip supply chain. Mistral runs on European servers. This is not sovereignty, but the infrastructure for it—provided the data stays where it belongs.

A nicely packaged API isn’t enough. Compliance checks, data transfer emergencies—these reveal that real products require their own infrastructure, a clean audit trail, and robust fault tolerance.

Document approvals in accounts payable in the DACH region, not who made them. Once an agent signs: liability is unclear, audit trail is missing, insurance hesitates.

Small and medium-sized enterprises document AI-driven decisions in auditing, but not who made them. This is not automation—it’s an audit trap that the auditor is the first to notice.

Small and medium-sized enterprises document invoice audits, not who approved them. GoBD requires exactly this. Those who ignore it pay twice later: first the fine, then the automation they should have built from the start.

Forensic observation: In mid-sized companies, AI rarely fails due to the idea, but due to the audit trail. Without traceable decision-making, automation becomes a liability issue.

Austrian SMEs are using AI agents for invoice verification but are not maintaining an audit trail, as required by GoBD. Who is liable for the decision made by the agent?

Labor shortages do not force automation—they force a decision about who works. Those who don’t automate pay overtime. Those who automate pay for governance. Both cost money.

Small and medium-sized enterprises review invoices but do not document who made which decisions. GoBD requires exactly that. The audit liability is quietly increasing.

Benchmarks reflect laboratory conditions. Audit judgments are only formed with real data, legacy systems, and control obligations. Integration gaps become visible that prior metrics did not capture.