Legally Compliant AI Use in the Workplace in Germany: A Guide for HR

From a legal perspective, AI law draws on several different areas of law, including data protection law, personality rights, copyright law, and civil law. Depending on the specific situation, companies must take provisions from these areas into account. In addition, companies must observe the AI Regulation, also known as the EU AI Act, which entered into force in 2024. The regulation aims to promote the adoption of AI while ensuring a high level of protection, as set out in Article 1 of the AI Regulation. To this end, AI systems are categorized into risk levels, corresponding requirements are placed on these systems, and obligations are established for providers and deployers.

The legal landscape surrounding AI and digitalization remains dynamic for the time being. Existing regulations affect different areas of law. EU laws such as the AI Regulation formally enter into force, but their provisions become applicable only gradually. Further legislative measures are in the planning stages. Many companies, therefore, face the challenge of implementing AI systems in a legally compliant manner. Our AI law lawyers are glad to support your company from a legal perspective and to outline, step by step, which regulations must be observed and what obligations they entail.

The use of AI systems often involves the processing of personal data. This is the case, for example, when AI is used in HR, such as to optimize job postings and the application process or for personnel development. In these situations, the provisions of the General Data Protection Regulation (GDPR), which protect natural persons in the processing of personal data, apply under Article 1 of the GDPR. The GDPR establishes, among other things:

• principles that must be observed when processing data,
• rights of the data subject, and
• obligations for controllers and processors.

The processing of personal data is lawful only if one of the conditions set out in Article 6 of the GDPR applies. These include consent, or processing necessary for the performance of a legal obligation, the performance of a contract, or the implementation of pre-contractual measures, as well as processing necessary to protect legitimate interests. If none of these conditions applies, a data protection violation occurs, and the affected individual may claim damages under Article 82 of the GDPR. To avoid this, your company should take the following steps regarding data protection:

1. Legal basis and purpose limitation: Before processing personal data, you must clarify the purpose of the processing and the legal basis on which it relies. Consent under Article 6 of the GDPR must be obtained from the data subject before the data is processed.
2. Data minimization, accuracy, and retention period: ensure that the principles set out in Article 5 of the GDPR are observed. This includes ensuring that the data is accurate and up to date, and that only the data necessary for the purpose is actually used. Data should also be stored for AI purposes only as long as necessary for the purpose or as required by law.
3. Data processing agreement: enter into an agreement under Article 28 of the GDPR with the processor, meaning the provider of the AI.
4. Duty to inform: comply with your duty to inform under Article 13 and Article 14 of the GDPR. You should also maintain a record of all processing activities. Under Article 30 of the GDPR, this includes information on which data is processed when using AI and for what purpose.
5. Data protection: implement technical and organizational security measures to protect the collected data. One possible measure under Article 32 of the GDPR is the pseudonymization and encryption of the collected data.
6. Data protection impact assessment: conduct a data protection impact assessment under Article 35 of the GDPR. This may be mandatory before using certain AI technologies.
7. Implementation of data subject rights: ensure that your company can respond promptly to the rights of individuals affected by data processing. These rights include the right not to be subject to a decision based solely on automated processing under Article 22 of the GDPR. This could apply in HR, for example, when candidates are evaluated using AI and the system alone decides whether to reject them.

You should also consider the risks associated with using AI. For example, the use of such systems in application processes can produce biased or discriminatory results. What matters most is which information the AI uses and how the results are handled. Employees should be trained and made aware of these issues accordingly.

When using AI, the content and data used to train the system are also relevant from a copyright perspective. AI systems typically train on internet data and can generate new content based on it. This raises the question of whether copyrighted content may be used at all. As a general rule, the author of a work has the exclusive right to decide how it is used. Section 44b of the UrhG, however, provides an exception that allows digital or digitized works to be analyzed and reproduced. Under Section 44b of the UrhG, reproduction can be prevented if the rights holder reserves this right in advance and makes the corresponding declaration in a machine-readable format. If you do not want a digital work to be reproduced, you must mark it accordingly, for example, through an explicit notice on your website. You should also ensure that you only use content for AI purposes that you are permitted to use from a copyright perspective.

Employment law also raises several considerations regarding the use of AI in the workplace. Many AI systems used in HR, including tools for recruitment, candidate screening, and performance evaluation, are classified as high-risk under the AI Regulation. This classification carries specific obligations for employers, among them ensuring adequate AI literacy among personnel under Article 4 of the AI Regulation, maintaining human oversight, and informing employee representatives before deployment. A further set of obligations under Article 26 and Article 27 of the AI Regulation takes effect starting August 2, 2026, under Article 113 of the AI Regulation.

You should also be mindful of the prohibition on discrimination under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz, AGG), as AI systems can produce results that unlawfully disadvantage individuals, even without discriminatory intent. If a company relies exclusively on AI-generated results or decisions, this can carry legal consequences.

For a detailed look at these obligations in the recruitment and HR context, including works council co-determination requirements and practical compliance steps for international employers, see AI applications in HR.

As already noted, AI is not infallible. The question is who is liable when AI makes an error. The answer depends on the specific circumstances. What is clear, however, is that AI itself cannot be held liable, since it has no legal personality of its own. In addition, it is often disputed who holds the rights to AI-generated works, and consequently against whom claims can be enforced. Under certain circumstances, liability may fall on the individuals or companies that develop, offer, or use the artificial intelligence. For example, your company could be held liable if legal or contractual obligations and requirements are disregarded during the use of AI or the subsequent use of the content it generates.

The legal landscape surrounding artificial intelligence is evolving rapidly. For companies, this means that anyone using AI systems must understand the legal risks involved and actively work to minimize them. Mistakes can result not only in financial damage but also in significant reputational harm. A well-thought-out strategy is therefore essential:

1. Review of AI systems: before deploying an AI system, review it to confirm that its use is generally permitted under the AI Regulation.
2. Careful contract drafting: a clear agreement with the provider forms the basis for legally compliant AI use. Only precisely defined license and usage rights can prevent third-party claims. You should specifically verify whether the generated content can be used exclusively.
3. Comprehensive risk assessment: A comprehensive risk assessment of the AI systems in use is essential. Gain a complete overview of all AI systems in use, evaluate the associated risks, and identify the legal obligations you must fulfill.
4. Legal review: ensure that all data protection and copyright regulations are observed when using AI. This also includes the future labeling requirement for AI-generated content, the obligations under Articles 26 and 27 of the AI Regulation, and the obligation to ensure a sufficient level of AI literacy under Article 4 of the AI Regulation.
5. AI guidelines and training: Implementing AI training and an internal AI policy is another important building block. Executives, department heads, and all employees should be trained in the responsible use of AI tools. A binding AI policy governs the appropriate use of these technologies across the company.
6. Minimizing liability risk: finally, liability risk can be significantly reduced through consistent compliance with legal regulations, such as the AI Regulation, and by fulfilling all due diligence obligations. A proactive compliance strategy protects companies from legal consequences while enabling the safe use of AI’s potential.