AI Watch: Global regulatory tracker – Germany | White & Case LLP

Status of the AI Regulations

The EU AI Act is addressed separately here: AI watch: Global regulatory tracker – European Union

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, except for references to AI in the Works Constitution Act (as described above).

Other laws affecting AI

There are various laws that do not directly seek to regulate AI but may affect the development or use of AI in Germany. A non-exhaustive list of key examples includes:

• The German Civil Code (BGB)
• The Product Liability Act (ProdHaftG)
• The Copyright Act (UrhG), in particular Sections 44b and 60d concerning text and data mining
• Intellectual property laws that may affect several aspects of AI development and use

Definition of “AI”

As noted above, there are currently no specific laws or policies in Germany that directly regulate AI, except for the minor references to AI in German labor law, which do not define AI. As such, no definition of AI is currently recognized through German national legislation.

The German government’s 2018 National AI Strategy, the Strategy’s 2020 Update and the 2023 AI Action Plan also do not commit to a definition, with the 2018 National AI Strategy stating that the strategy is aimed at “weak/narrow” AI (i.e., AI that focuses on solving specific practical problems).³ However, in April 2023, in response to a parliamentary enquiry, the German government acknowledged the AI definition set out in the EU Council’s December 2022 mandate for the EU AI Act. As the German government has recently approved the now finalized EU AI Act, the definition of an AI system contained in Art. 3(1) of the EU AI Act will likely be the key and most relevant definition in Germany.

Territorial scope

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than minor references to AI in German labor law that concern works councils in certain companies that maintain operations in Germany. Beyond that, there is no specific territorial scope at this stage.

Sectoral scope

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. Accordingly, there is no specific sectoral scope at this stage.

Compliance roles

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. Accordingly, there are currently no specific or unique obligations imposed on developers, users, operators and/or deployers of AI systems, other than the limited duties of employers toward works councils described above.

As broad political agendas, the 2018 National AI Strategy and its 2020 Update focus on all actors along the AI value chain, as well as on society as a whole. The strategy papers emphasize the responsibilities of AI hardware and software manufacturers and deployers, but also address the interests of affected persons. Since these plans were published before the legislative process for the EU AI Act was initiated with the EU Commission’s April 2021 proposal, the EU AI Act will likely address many of these concerns. The 2023 AI Action Plan does not highlight any specific compliance roles in the context of potential future national AI regulation.⁵

Core issues that the AI Regulations seek to address

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. Nevertheless, Germany’s Independent Federal Anti-Discrimination Commissioner has highlighted discrimination risks posed by AI systems as a core issue, and called for improved statutory protections,⁶ while Germany’s Federal Commissioner for Data Protection and Freedom of Information has called for the need to protect personal data and the rights established under the GDPR.⁷

Discrimination and data protection issues are also a core concern addressed by the 2018 National AI Strategy and its 2020 Update.⁸ Political discussions have been underway to enact a German national law on employee data protection in addition to the EU GDPR, which could also contain dedicated provisions on AI. However, it remains unclear whether such a law will be passed. Both the 2018 National AI Strategy and its 2020 Update emphasize that the development and use of AI must be based on human rights and fundamental rights. They identify IT and cyber security, product safety, transparency and the availability and quality of data as further key issues. The 2023 AI Action Plan stresses that a balance must be struck between regulating AI risks and over-regulation, which could inhibit innovation and result in unexploited potential.⁹

Risk categorization

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. These provisions and the aforementioned policy plans do not set out an AI-related risk categorization. However, the 2023 AI Action Plan welcomes the risk-based approach of the EU AI Act.¹⁰

Key compliance requirements

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. Therefore, with the exception of the limited duties of employers toward works councils described above, there are no specific AI-related national compliance requirements.

Regulators

In Germany, various ministries of the federal government are addressing AI and are participating in international regulatory processes. This includes:

• The Federal Ministry for Economic Affairs and Climate Action and the Federal Ministry of Justice, which were involved in negotiations on the EU AI Act
• The Federal Ministry for Digital and Transport, which is, inter alia, engaged in the G7 Hiroshima Process on Generative Artificial Intelligence
• The Federal Ministry of Education and Research, which has recently published the 2023 AI Action Plan as well as significantly increased public funding for AI initiatives

In addition, there are ongoing discussions as to which German authority will be designated as the national supervisory authority required under the EU AI Act. Potential candidates include the Federal Network Agency, the Federal Office for Information Security and the federal and state data protection authorities.¹¹

Furthermore, regulators at the level of the German states have been dealing with AI as well. In fact, every German state has published at least one AI-related document.¹²

Enforcement powers and penalties

As noted above, there are currently no specific laws or regulations in Germany that directly regulate AI, other than the minor references to AI in German labor law concerning works councils. As such, enforcement and penalties relating to the creation, dissemination and/or use of AI are governed by: (i) the EU AI Act; and (ii) related violations in non-AI specific regulation. The detail of the EU AI Act is not discussed here.

_{1 An English translation of the Works Constitution Act is available here.
2 See, for example, a statement on the National AI Strategy website: “The Federal Government will review the legal framework for algorithm- and AI-based decisions, services and products and possibly adapt it to ensure that effective protection against bias, discrimination, manipulation or other misuse is possible.” (our translation), available here; see also the National AI Strategy (2018) itself, page 9, II, j.: “”We want to […] examine whether the regulatory framework needs to be further developed to ensure a high degree of legal certainty […]”, available here. 
3 The 2018 National AI Strategy is available here; the 2020 Update is available here; and the 2023 AI Action Plan is available here.
4 The German government’s April 2023 response to the brief parliamentary enquiry is available here.
5 The 2018 National AI Strategy is available here; the 2020 Update is available here; and the 2023 AI Action Plan is available here.
6 Germany’s Independent Federal Anti-Discrimination Commissioner’s comments are available here.
7 The Federal Commissioner for Data Protection and Freedom of Information’s comments are available here.
8 The 2018 National AI Strategy is available here; the 2020 Update is available here; and the 2023 AI Action Plan is available here.
9 The 2018 National AI Strategy is available here; the 2020 Update is available here; and the 2023 AI Action Plan is available here.
10 The 2018 National AI Strategy is available here; the 2020 Update is available here; and the 2023 AI Action Plan is available here.
11 An article by Tagesspiegel Background on this issue is available here.
12 See an article on the Digital Society Blog of the Alexander von Humboldt Institute for Internet and Society (HIIG), available here.}

_{White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.}

_{This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.}

_{© 2024 White & Case LLP}

Timo Gaudszun (Legal Intern, White & Case, Berlin) contributed to this publication.