The EU Artificial Intelligence Act (AI Act) has created the world's first comprehensive legal framework for AI. German companies are adopting generative AI in marketing and customer service, but must strictly respect copyright and data protection rules.

Risk categories under the EU AI Act

The regulation divides AI systems into four categories: unacceptable risk (banned systems for social scoring and manipulation); high risk (HR systems that screen CVs automatically, credit scoring – these require a conformity assessment, risk management and data quality controls); limited risk (support chatbots – users must be told clearly that they are talking to an AI); and minimal risk (generating text and code).

Public AI services and the GDPR

Entering the personal data of customers, partners or employees (names, phone numbers, health data, commercial contracts) into free consumer versions of ChatGPT, Claude and similar services usually happens without a legal basis or a data processing agreement and therefore risks breaching the GDPR. For work, use enterprise versions or API access with an agreement that the data will not be used to train the models.

Mandatory labelling of synthetic content

The regulation requires AI-generated images, audio and video (deepfakes or realistic depictions of people) to be labelled. Businesses must clearly inform users that content is synthetic if it could mislead consumers about the authenticity of services.

A company AI policy (AI governance policy)

Every company should draw up internal rules for working with AI: a list of permitted services, human fact-checking of generated answers (human in the loop), a ban on automatically making legally significant decisions and information security standards.

What to check

  • Prohibit staff from entering personal and confidential data into public AI tools.
  • Use only company APIs or enterprise accounts with a confirmed data processing agreement (DPA/AVV).
  • Inform users if an AI chatbot answers on your website.
  • Adopt internal rules on fact-checking and responsible use of generative AI.

Example situation

An agency introduced a private company instance of a language model with data stored in Germany and trained its team, eliminating the risk of client data leaking while writing code.

Next step

AI brings real benefits to German businesses only when the AI Act is respected and data confidentiality is protected.

Official information on this topic

Checklists and examples are organisational recommendations. Requirements depend on the procedure, the city and your situation; check them with the relevant office before you act. Please discuss legal and tax questions with an authorised professional.

This article was prepared with the help of AI. The example illustrates the approach and does not describe a client case.