Makes high-risk automated decisions, in Germany

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22; Bundesdatenschutzgesetz (BDSG) §§31, 37 · Read the law's page

• Where a decision based solely on automated processing about a person in Germany rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• If you are an insurer, you may make a solely automated decision about a person in Germany in performing an insurance contract where it grants their request in full, or where it applies binding fee rules for medical treatment and you let them obtain human intervention, state their view and contest the decision, telling them of these rights no later than when you tell them their request was not fully granted, under BDSG Section 37(1).
• Do not subject a person in Germany to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Germany on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Germany of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Betriebsverfassungsgesetz (BetrVG), §§ 80 Abs. 3, 90 Abs. 1 Nr. 3 and 95 Abs. 2a · Read the law's page

• If you are a private-sector employer with a works council, inform the works council in good time, with the necessary documents, about the planned use of artificial intelligence in work procedures and work flows (Betriebsverfassungsgesetz, section 90(1), point 3).
• Discuss the planned measures and their effects on the employees with the works council early enough that its proposals and concerns can be taken into account (section 90(2)).
• Obtain the works council's consent to guidelines on personnel selection for hirings, transfers, regroupings and dismissals, also where artificial intelligence is used in drawing them up (section 95(1) and (2a)).
• Accept that the works council may call in an expert where it must assess the introduction or application of artificial intelligence, which the Act treats as necessary (section 80(3)).

Gesetz zur Marktüberwachung und Innovationsförderung von künstlicher Intelligenz (KI-Marktüberwachungs-und-Innovationsförderungs-Gesetz, KI-MIG), §§ 2, 6, 8, 13, 15, 16, 20 · Read the law's page

• Provide the information or documentation, and give the access, that Article 21 requires of a provider of a high-risk AI system when a competent authority asks; carry out and update the fundamental rights impact assessment Article 27 requires and send the notification it requires; if you are a notified body, inform the notifying authority as Article 45 requires; and, if you operate a high-risk AI system under point 1, 3, 4 or 5 of Annex III, give an affected person the explanation Article 86 requires (Section 15).
• If you provide a high-risk AI system listed in point 2 of Annex III to the Regulation, you or your authorised representative must register you and the system in the Bundesnetzagentur's non-public register before you place the system on the market or put it into service, supplying the information that Annex VIII, Section A lists. This duty does not apply to a public body of a Land.
• If you are a federal public body that deploys a high-risk AI system listed in point 2 of Annex III to the Regulation, you must register yourself and the system in the same register before you put the system into service or use it, supplying the information that Annex VIII, Section C lists.for a public body

Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Germany as EU Member State

• Tell users they are interacting with an AI chatbot or voice agent.
• Mark generative AI outputs as artificially generated in machine-readable form.

Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).
• Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).
• Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).
• If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).
• If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).
• If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).
• If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).
• Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).
• You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).
• Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17).

Bundesdatenschutzgesetz (BDSG), § 30 Abs. 6 und 7 · Read the law's page

• This law takes effect on 20 November 2026 (Article 16(1) of the Act of 12 May 2026), so the duties below do not bind before that day.
• If your creditworthiness assessment for a general consumer loan involves automated processing of personal data, let the borrower demand human intervention by you, including a clear explanation of the assessment with its logic and risks, a statement of their own point of view and a review of the assessment and of the loan decision, and inform them of these rights once the automated processing is complete (section 30(6)).
• If you refuse a consumer loan on the strength of information from a credit information database, tell the consumer promptly of the refusal, the information received, the database consulted and the data categories taken into account; if you refuse on an automated assessment, say so and, for general consumer loans, tell the borrower of the right to review by a person and of the procedure for contesting your decision (section 30(7)).