Do not let AI alone make big decisions about people
People have the right not to be subject to decisions made solely by automated processing, including profiling, with legal or similarly significant effects, such as automatically rejecting a job application. Such decisions are allowed only when needed for a contract, authorised by law or with explicit consent, and then people get human intervention, a way to contest and meaningful information about the logic.
Who must do it
Any organisation processing personal data in the EU, or of people in the EU, including employers and schools.
The law
GDPR (Regulation (EU) 2016/679), Article 22, with Articles 13 to 15
Who enforces it
National data protection authorities; fines up to €20 million or 4% of worldwide turnover, whichever is higher.
It applies in Germany because Germany is part of the European Union.
GermanyIn force
Tell the works council early about planned AI
If your workplace has a works council (Betriebsrat), inform it in good time, with the documents it needs, when you plan work processes that use AI. Discuss the effects on staff early enough that its suggestions can still change the plan.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act (Betriebsverfassungsgesetz), section 90(1) no. 3 and (2), as amended in 2021
Who enforces it
Labour courts; fines up to €10,000 for information that is missing, wrong, incomplete or late (section 121). Obstructing the works council is a crime (section 119).
When your works council has to assess the introduction or use of AI, the law treats calling in an outside expert as necessary, so you cannot refuse on the ground that one is not needed. You still agree on the details, and you can agree on a standing AI expert.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 80(3), as amended in 2021
Who enforces it
Labour courts. Obstructing the works council is a crime (section 119).
Get works council consent for AI-made selection rules
General rules for choosing whom to hire, transfer, regrade or dismiss need your works council’s consent, also when AI is used to draw them up. In businesses with more than 500 employees, the works council can demand such rules. If you cannot agree, a conciliation board decides.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 95(1), (2) and (2a), as amended in 2021
Who enforces it
A conciliation board (Einigungsstelle) settles disputes, and labour courts enforce.
Take steps to support the AI literacy of staff and others who operate or use AI for you, suited to their knowledge and to how the AI is used. Since July 27, 2026 you no longer have to guarantee a particular skill level.
Who must do it
Providers and deployers of AI systems in the EU, which includes any business using AI at work.
The law
AI Act, Article 4, as replaced by Regulation (EU) 2026/1744
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this duty, so penalties come from national law.
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Do not use biometrics to guess race, religion or union ties
AI that sorts individual people by biometric data, such as face or voice, to infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation is banned.
Who must do it
Anyone who provides or uses such AI in the EU, including employers.
The law
AI Act, Article 5(1)(g)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Explain decisions made with high-risk AI when asked
Some AI counts as high-risk, such as AI for hiring, managing staff, education, credit or essential services. If a decision based on it seriously affects someone, they can ask you to explain the AI’s role and the main reasons for the decision, and you must answer clearly. The AI Act’s other duties for this AI start on December 2, 2027.
Who must do it
Businesses and organisations in the EU that use such AI to decide about people. It applies where other EU law, such as the GDPR, does not already give this right.
The law
AI Act, Article 86, with Annex III
Who enforces it
National authorities; the AI Act sets no EU-wide fine for this right, so penalties come from national law (in Germany, up to €50,000).
It applies in Germany because Germany is part of the European Union.
GermanyIn force
Explain high-risk AI decisions, or Germany can fine you
Germany backs the EU right to an explanation with its own fine. If a decision based on high-risk AI, for example in hiring, staff management, education or credit, seriously affects someone and they ask, explain the AI’s role and the main reasons. Failing to do so can cost up to €50,000. The EU has moved most other high-risk duties to December 2, 2027.
Who must do it
Businesses and other private organisations using high-risk AI in Germany, such as employers, private schools and lenders. Public bodies cannot be fined.
The law
KI-MIG (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz), sections 15(2), 15(3) and 17, with AI Act Article 86
Who enforces it
Federal Network Agency (Bundesnetzagentur) in most cases, BaFin for finance and state authorities for the media; fines up to €50,000.
Platforms: keep humans in charge of algorithmic management
Gig-work platforms must explain their automated monitoring and decision systems to the people working through them, keep them under human oversight, and not use them to process data such as emotional state, private conversations or union activity. Only a human may decide to restrict, suspend or close a worker’s account. EU countries must put this into national law by December 2, 2026.
Who must do it
Digital labour platforms, such as ride-hailing or delivery apps, organising work in the EU. The data and human-review rules also protect self-employed platform workers.
The law
Platform Work Directive (EU) 2024/2831, Articles 7 to 15 (deadline for national laws)
Who enforces it
Under each country’s national law; data protection authorities can fine breaches of the data rules at GDPR levels.
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2027
AI for hiring and managing staff becomes “high-risk”
Employers using AI to recruit, manage or evaluate workers must follow its instructions, have trained people oversee it and keep its logs for at least six months. They must inform workers and their representatives before using it, and tell candidates and staff when it is used in decisions about them. AI types already on the market before then are covered only after a significant design change.
Who must do it
Employers and other organisations that use such AI in the EU.
The law
AI Act, Article 26 and Annex III (date moved by the 2026 Digital Omnibus)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2027
Check HR AI against the high-risk rules before you sell it
If you sell AI for recruiting, promotion, firing, task allocation or monitoring workers, it must meet the high-risk requirements: risk management, data quality, documentation, logging, human oversight and accuracy. It must also pass a conformity assessment, carry the CE mark and be registered in the EU database.
Who must do it
Providers placing such AI on the EU market, including companies that sell it under their own name or substantially change it.
The law
AI Act, Articles 6(2), 8 to 17, 43 and 47 to 49, and Annex III point 4 (date moved by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
GermanyIn force
Agree with the works council before AI that tracks staff
You need your works council’s agreement before you introduce or use technical systems designed to monitor how employees behave or perform, which includes AI tools that log or analyse staff activity. If you cannot agree, a conciliation board decides.
Who must do it
Private employers in Germany that have a works council.
The law
Works Constitution Act, section 87(1) no. 6 and (2)
Who enforces it
A conciliation board settles disputes, and labour courts can stop a system introduced without agreement. Obstructing the works council is a crime (section 119).
AI systems that infer people’s emotions are banned in workplaces and in schools and universities, except for medical or safety reasons.
Who must do it
Anyone who provides or uses such AI in the EU, including employers and schools.
The law
AI Act, Article 5(1)(f)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Do not use AI social scores to treat people unfairly
AI that scores people over time on their social behaviour or personal traits is banned when the score leads to unjustified or disproportionate harm, or to harm in a context unrelated to where the data came from. Ordinary performance reviews are usually not social scoring.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(c)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Do not use AI to predict crime from profiling alone
AI that assesses or predicts the risk that a person will commit a crime based solely on profiling, or on their personality traits, is banned. AI that supports a human assessment already based on objective, verifiable facts is allowed.
Who must do it
Anyone who provides or uses such AI in the EU, including private companies.
The law
AI Act, Article 5(1)(d)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Tell people when you use emotion or biometric AI on them
If you use AI that recognises emotions or sorts people into categories from biometric data, inform the people exposed to it and handle their data under the GDPR. Emotion recognition at work or school is banned anyway, except for medical or safety reasons.
Who must do it
Businesses and organisations that use such systems in the EU.
The law
AI Act, Article 50(3)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2027
Treat face recognition and emotion AI as high-risk
This covers AI that identifies people remotely from their face or other biometrics, sorts them by sensitive or protected traits, or recognises emotions, where such uses are not banned. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs and tell the people exposed to it. Simple ID checks that only confirm a person is who they claim to be are excluded.
Who must do it
Businesses and organisations using such AI in the EU, such as shops, venues and security firms; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 1 and Article 26 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2027
Treat AI credit scoring and insurance pricing as high-risk
If you use AI to judge people’s creditworthiness or set their credit score, or to assess risk and set prices for life or health insurance, first assess its impact on people’s rights. Then follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell people it is used in decisions about them. AI used only to detect fraud is excluded.
Who must do it
Banks, lenders, insurers and other businesses using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change.
The law
AI Act, Annex III point 5(b) and (c) and Articles 26 and 27 (date set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
GermanyIn force
Label automated bot posts on social networks
If you run a social media account that looks like a person but posts automatically through software, clearly mark each automated post as sent by a program. Social networks must also take care that such posts are labelled.
Who must do it
Anyone offering content on social networks in Germany, such as businesses, publishers and campaigns, and the networks themselves.
The law
Interstate Media Treaty (Medienstaatsvertrag), sections 18(3) and 93(4)
Who enforces it
State media authorities (Landesmedienanstalten); fines up to €500,000 for unlabelled bot posts.
Do not build AI that manipulates or exploits people
AI that uses subliminal, manipulative or deceptive techniques, or exploits people’s age, disability or social or economic situation, to distort their decisions in a way that causes or is likely to cause significant harm is banned.
Who must do it
Anyone who provides or uses such AI in the EU.
The law
AI Act, Article 5(1)(a) and (b)
Who enforces it
National authorities, enforcing since August 2, 2026; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Tell people when they are talking to an AI
If you provide an AI system that talks directly with people, design it so they are told they are interacting with AI, unless that is obvious.
Who must do it
Providers of AI systems used in the EU.
The law
AI Act, Article 50(1)
Who enforces it
National authorities, or the EU AI Office for chatbots built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Explain how your platform’s recommendations work
If your online platform recommends content, explain in your terms, in plain language, the main factors your recommender systems use and how users can change them. Very large platforms and search engines must also offer at least one feed option not based on profiling.
Who must do it
Online platforms serving people in the EU, except micro and small companies; the extra option applies to services with more than 45 million monthly users in the EU.
The law
Digital Services Act (Regulation (EU) 2022/2065), Articles 27 and 38
Who enforces it
National Digital Services Coordinators, or the European Commission for very large platforms; fines up to 6% of worldwide turnover.
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Mark AI-generated content so machines can detect it
Providers of AI that generates audio, images, video or text must mark the output in a machine-readable way as AI-made. Systems already on the market before August 2, 2026 have until December 2, 2026. Tools that only assist standard editing are exempt.
Who must do it
Providers of generative AI systems in the EU, including general-purpose AI.
The law
AI Act, Article 50(2)
Who enforces it
National authorities, or the EU AI Office for generative AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionIn force
Label deepfakes and AI-written news-style text
If you use AI to create or alter a deepfake image, audio or video, disclose that it is AI-made or manipulated; for obvious art, satire or fiction a light disclosure is enough. If you use AI to write or alter text published to inform the public on matters of public interest, disclose it, unless it went through human review or editorial control and someone holds editorial responsibility.
Who must do it
Businesses and organisations that use AI to make such content in the EU; purely personal, non-professional use is exempt.
The law
AI Act, Article 50(4)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2026
Do not offer or use AI that makes sexual deepfakes
AI systems that create or alter realistic sexual or intimate images, video or audio of an identifiable person without their explicit consent, or child sexual abuse material, are banned. Providers are covered when this is the intended purpose or a foreseeable result their safeguards do not reliably prevent; users are covered when they use AI for this.
Who must do it
Anyone who provides or uses such AI systems in the EU.
The law
AI Act, Article 5(1)(ba) and (bb) and 5(1a) to (1b), inserted by Regulation (EU) 2026/1744 (Digital Omnibus on AI)
Who enforces it
National authorities, or the EU AI Office for AI built on the provider’s own general-purpose AI model or in very large online platforms; fines up to €35 million or 7% of worldwide turnover, whichever is higher (for SMEs, whichever is lower).
It applies in Germany because Germany is part of the European Union.
European UnionFrom December 2, 2027
Treat AI for admissions, grading and exams as high-risk
This covers AI that admits or places students, grades their work, decides what level of education they can reach, or watches for cheating in tests. If you use it, follow the maker’s instructions, have trained staff oversee it, keep its logs for at least six months and tell students it is used. Public bodies, and private bodies providing a public service, must first assess its impact on people’s rights.
Who must do it
Schools, universities, training providers and exam bodies using such AI in the EU; the makers must pass a conformity assessment before selling it. AI on the market before then is covered only after a significant design change, except that AI for public authorities must comply by August 2, 2030.
The law
AI Act, Annex III point 3 and Articles 26, 27 and 111(2) (dates set by Regulation (EU) 2026/1744)
Who enforces it
National authorities; fines up to €15 million or 3% of worldwide turnover, whichever is higher (whichever is lower for SMEs and small mid-caps).
It applies in Germany because Germany is part of the European Union.
Good to know in Germany: In Germany, the Federal Network Agency (Bundesnetzagentur) enforces the EU AI Act, under the KI-MIG law in force since July 29, 2026. BaFin covers finance, and state authorities cover the media. KI-MIG (Gesetze im Internet)