Q1 Digitalization Review 2026: What German SMEs Learned in the First Quarter

8 min Read Time

AI adoption among German companies has more than doubled within twelve months. At the same time, 61 percent of firms subject to the NIS2 Directive failed to register – despite the fact that managing directors are now personally liable for noncompliance. This is the paradoxical balance sheet for Q1 2026: technologically faster than ever before, yet dangerously negligent on regulation.

AI Adoption: The Breakthrough Came Faster Than Expected

The first quarter of 2026 marks a turning point in Germany’s AI landscape. The Bitkom AI Study 2026, published in February, documents a leap few predicted just one year ago: 41 percent of companies with at least 20 employees actively use AI. That compares to just 17 percent the previous year. Another 48 percent are planning or discussing implementation. Germany is no longer lagging behind in AI adoption – at least when it comes to uptake.

The numbers behind this shift are equally compelling: 77 percent of AI-using companies report improved competitiveness. Fifty-two percent see measurable contributions to business success. Sixty-six percent plan to expand their AI usage further. Investment willingness has risen for the third consecutive year: 36 percent intend to invest more in 2026 than they did the year before.

Yet enthusiasm has its blind spots. The three most commonly cited barriers remain unresolved: legal uncertainty (53 percent), lack of technical expertise (53 percent), and insufficient personnel (51 percent). Over 106,000 IT positions in Germany remain unfilled – according to Bitkom, 85 percent of employers face an IT skills shortage. Seven out of ten employees received no AI-specific training last year. Fifty-three percent of companies say they struggle to manage their digital transformation – five percentage points higher than the previous year.

Adoption is accelerating while competence lags behind. In the SME sector, this gap is especially palpable: Companies introducing AI tools without involving their workforce risk not only productivity losses but also mounting internal resistance. Firms that implement verifiable AI training programs in 2026 simultaneously lay the groundwork for compliance with Article 4 of the EU AI Act – the “AI Competence Obligation” – a strategic investment that pays off twice.

The AI Factory: Munich as a Signal

On 4 February 2026, Germany’s first industrial-scale AI factory went live in Munich. Deutsche Telekom invested approximately €1 billion in an infrastructure comprising nearly 10,000 Nvidia Blackwell GPUs and delivering up to 0.5 exaFLOPS of computing power. As a result, Germany’s total AI computing capacity rose by 50 percent – all at a single location.

This project matters to SMEs for two reasons. First, it demonstrates that sovereign AI infrastructure is feasible in Germany – data stays within national borders, and value creation remains domestic. Second, early customers – including Siemens and Catena-X – are already using the factory for industrial AI applications. Thirty percent of its capacity was booked at launch. SAP is integrating the infrastructure into its Business Technology Platform, lowering the entry barrier for companies unwilling – or legally prohibited – from running AI workloads in U.S.-based hyperscaler clouds.

NIS-2: The Compliance Disaster of the Quarter

If Q1 2026 had a regulatory low point, this was it. The NIS-2 Implementation Act entered into force on 6 December 2025, expanding cybersecurity obligations from 4,500 to over 30,000 companies. Security measures under Section 30 of the German IT Security Act (BSIG) applied immediately – without transition period. Registration with the BSI (Federal Office for Information Security) expired on 6 March 2026.

The outcome is sobering: As of 20 March, only around 11,500 of the 29,850 affected companies had registered – a rate of just 38.5 percent. More than 18,000 companies thus reside in a grey zone: They are subject to NIS-2 obligations but remain unregistered with the BSI. This is no trivial oversight. Under NIS-2, managing directors face personal liability for gross negligence for the first time. Fines reach up to €10 million or two percent of global annual turnover.

Meanwhile, Check Point recorded an average of 1,345 cyberattacks per week against German companies in February 2026 – 11 percent more than the prior year. The threat is growing; preparedness is stagnating.Data source: Check Point Research, Cyberattacks February 2026

For SMEs, the message is clear: Treating NIS-2 implementation as a minor administrative task is a serious mistake. Personal liability for managing directors elevates cybersecurity to boardroom-level priority – regardless of whether the BSI conducts audits.

AI Act: Article 4 Is Already in Force – and Most Don’t Know It

While everyone watches the clock toward August 2026 – the date when the EU AI Act’s high-risk provisions take effect – many overlook what is already law. Article 4 – the AI Competence Obligation – has been in force since February 2025. Every company deploying, developing, or providing AI must ensure its staff possess adequate AI competence. This applies even to pure end users: Companies whose teams rely on ChatGPT or AI-powered recruitment tools fall squarely under this obligation.

Implementation is deliberately open-ended – no minimum number of training hours is prescribed. But documentation is mandatory. Companies that have taken no action so far are building a compliance gap. And the Federal Network Agency (Bundesnetzagentur), designated as the central AI supervisory authority under the AI Market Surveillance Act (KI-MIG), will begin building inspection capacity this summer. Rather than waiting, it makes more sense to define an internal AI competence framework now – and document training efforts verifiably.

From 2 August 2026 onward, comprehensive transparency requirements for all AI systems – and full compliance obligations for high-risk AI – will apply. Data governance, technical documentation, and robustness verification will become mandatory. Companies using AI in HR, creditworthiness assessments, or safety-critical domains should use the remaining months to prepare. Fines may reach up to €30 million or six percent of global annual turnover.

Special Fund: Much Promised, Little Delivered

The €500 billion Infrastructure Special Fund was meant to accelerate Germany’s modernization. The business alliance “Made for Germany” pledged €631 billion in private investment by 2028. Forecasts for 2026 anticipate total investments exceeding €120 billion – including €58 billion drawn from the special fund.

Reality in Q1 looked different. The ifo Institute warns that 95 percent of the special fund’s planned 2025 new debt was used to plug ongoing budget shortfalls – not to finance investments. The structural modernization originally intended is progressing more slowly than hoped. For SMEs counting on state-backed digitalization funding, the implication is clear: Don’t wait for public stimulus – push forward your own projects. Growth forecasts reflect this: The IW Cologne Institute expects GDP growth of just under one percent for 2026; the IMK of the Hans Böckler Foundation forecasts 1.2 percent. Both see Q1 as the weakest quarter, expecting momentum only from Q2 onward.

The ifo Business Climate Index captures real-time sentiment: After a subdued start at 87.6 points in January and a slight rise to 88.6 in February, the index plunged to 86.4 in March – a drop of 2.2 points. Hopes for an economic turnaround in Q1 were dashed. Geopolitical uncertainty and sluggish rollout of investment programs are dampening confidence. The ifo Institute speaks of “collapsing expectations” – a signal SMEs cannot afford to ignore when making investment decisions.

CSRD and Insolvencies: Two Additional Headwinds

The CSRD reporting requirement faced its first true test in 2026: Large capital-market-oriented companies must report for fiscal year 2025 for the first time, using the European Sustainability Reporting Standards. The good news: The EU Omnibus Package raised the thresholds to 1,000 employees and €450 million in revenue – and postponed the second and third waves to 2028. Many SMEs thus gain breathing room. The bad news: Companies embedded in large corporations’ supply chains will still need to supply data – the requirements cascade down through customers and contractors.

Insolvency figures remain tense. 2025 closed with 24,064 corporate insolvencies – an increase of 10.3 percent year-on-year and the highest figure since 2014. Prognoses for 2026 diverge: Allianz Trade expects a modest rise to roughly 24,500 cases; the German Association of Cooperative Banks (BVR) forecasts a 3.7 percent decline to 23,100. The truth likely lies somewhere between. By contrast, the ITK market shows resilience: Bitkom forecasts €245 billion in revenue for 2026 – a 4.4 percent increase, driven primarily by Infrastructure-as-a-Service, which is set to grow by 21 percent.

What Q2 Will Bring

Q2 2026 will reveal whether the AI adoption surge translates into tangible productivity gains – or whether the 53 percent citing insufficient know-how will slow progress. Special fund resources are expected to flow more strongly into genuine investments starting in Q2. The AI Act will enforce its high-risk provisions seriously from August onward. And the BSI can no longer ignore the NIS-2 registration gap.

For SMEs, Q1 delivers a clear priority list:
1. Build verifiable AI competence – now.
2. Immediately complete NIS-2 registration and implement required security measures – if not already done.
3. Audit your own data foundation for AI-readiness – because adoption without data quality is a risky investment.
4. Don’t wait for the special fund – drive your own digitalization initiatives forward. Fiscal stimulus is coming – but regulation will almost certainly arrive faster.

Conclusion

Q1 2026 was the quarter of paradoxes. Germany is adopting AI faster than ever – but half its companies lack either the people or the competence to deploy it effectively. The special fund exists – but investment flows are stalling. NIS-2 is law – but most affected firms ignored the registration deadline. Companies resolving these contradictions – deploying AI with substance, not hype; treating compliance as a leadership responsibility; and moving ahead without waiting for state investment impulses – will stand markedly stronger in Q2 than the average firm.

Frequently Asked Questions

Header Image Source: Pexels / Yan Krukau (px:7794060)