◉AI: law and labelling

The question is the same as with any other service provider: is there a legal basis, and is there a contract?

What you need:

• A data processing agreement with the AI provider — or with the operator who has in turn integrated it.
• A purpose that covers the processing.
• Data minimisation. Whatever the AI does not need does not belong in the request.

What you should not put in:

• Special categories — health, ethnic origin, religion — without an express legal basis.
• Complete records, if an extract is enough.
• Other people’s trade secrets that you received in confidence.

The practical filter: would you send this text to an external service provider by email? If not, it does not belong in an AI request either.

That depends on the contract with the provider, and it is the question you should ask before using an AI.

With business accounts, use for training is generally excluded; with free consumer accounts, often not. That is the essential difference between “I use it privately too” and “we use it in the business”.

What you should check:

• Does the contract expressly state that inputs are not used for training?
• How long are requests stored?
• Where are they processed?

And what follows from this: no copying of customer data into a private AI account. That is the most common unchecked data leak in small businesses — well meant and still a breach.

Not everywhere — the obligation is linked to certain situations, not to the use as such.

You have to label:

• When people interact with a system and it is not obvious — a chatbot must identify itself as such.
• When you publish artificially generated or altered images, videos or audio recordings that are meant to look real.
• For decisions that affect people, transparency obligations apply.

Not subject to labelling, as a rule: the fact that a text was produced with AI support, if a person has checked it and takes responsibility for it. A letter remains your letter.

What matters more in practice than the obligation: if you would not say it, perhaps you should not use it that way. A customer who discovers an invented reference does not ask about the legal position.

The AI Act names areas in which strict requirements apply. For most businesses, one of them is relevant in practice:

Employment and recruitment (Annex III no. 4). This expressly includes:

• the selection and filtering of applications,
• the evaluation of candidates,
• decisions on promotion, allocation and termination.

What this means if you use an AI to pre-sort applications: considerable obligations apply — risk management, documentation, human oversight, informing the people concerned.

The pragmatic approach: let the AI suggest and give reasons, never decide or reject. A person sees every application. That way the decision remains a human one — and that is exactly what matters.

You. A text you send is your text — regardless of who or what wrote it.

This applies to everything that can go wrong:

• False statements of fact in an advertising mail.
• Invented references and certificates. AI invents them convincingly, and it does not look like it.
• Copyright infringements, if a result takes over other people’s content.
• Wrong price information.

What follows from this: check every statement of fact. Figures, names, years, deadlines, references to laws — anything someone could look up.

The rule that has proved its worth: AI may phrase, not assert. The content comes from you; it may contribute the language.

Legally unclear in parts; in practice it means: do not rely on protection.

Under the German understanding, copyright requires a human creation. A purely machine-generated result therefore generally enjoys no copyright protection — you can use it, but if in doubt, so can others.

Conversely: the result can infringe other people’s rights if it comes too close to protected content. With images, that is a greater danger than with texts.

What you should do:

• Do not use AI-generated work for logos and trade marks if you need rights to them.
• For images, read the service’s terms of use. Some exclude commercial use.
• Do not rely on similarity. An image “in the style of” is legally risky.

Introducing AI tools is regularly subject to co-determination — especially if they are capable of monitoring the behaviour or performance of employees (§ 87 para. 1 no. 6 of the German Works Constitution Act, BetrVG).

That applies more quickly than you think: a system that logs who triggered which evaluation and when is capable of this — regardless of whether you intend to use it that way.

What you should do:

• Raise it early, not after the introduction.
• A works agreement on purpose, scope and evaluation.
• Expressly exclude what you do not want to do — for example evaluations by person.

The works council is also entitled to call in expert advice when AI is introduced.

Without a works council, co-determination does not apply — but transparency towards employees still does.

More than the obligation requires — because a lack of clarity costs more here than openness.

What the team should know:

• Where AI is involved and where it is not.
• What may be put in and what may not. That is the most important rule in practice.
• That suggestions have to be checked — and that nobody is criticised for rejecting a suggestion.
• That there is no evaluation by person, if that is the case.

And with customers: if you are asked, answer honestly. “We use AI for preparation; we check everything ourselves” is an answer nobody has a problem with.

Half a page is enough. It is also the basis if someone from outside asks.

Yes — but under conditions, and this is the most sensitive use in this entire chapter.

What is fine:

• Summarising an application so that a person reads it faster.
• Suggesting a match, with reasons.
• Helping to phrase a reply.

What we advise against:

• Automatically rejecting. That is the point at which a tool becomes a high-risk application.
• Rejecting without human review.
• Assessing personality traits — video analysis, voice analysis, personality profiles.

On top of that comes the AGG (the German General Equal Treatment Act): an AI based on historical hiring data adopts its patterns. If those patterns were discriminatory, the discrimination is continued — and the burden of proving otherwise lies with you.

The safe way: let it suggest, decide yourself, be able to give reasons for the decision.

Yes. There is no obligation to label every email as AI-supported, as long as a person has checked it and takes responsibility for it.

What you should still bear in mind:

• Check every statement of fact. Prices, deadlines, commitments, references.
• Do not promise anything you cannot deliver. An AI phrases things generously; a commitment in an email can be binding.
• Check the tone. AI texts sound friendly and impersonal — which can seem odd to an existing customer.

A chatbot is different: if people are talking to a system and it is not obvious, it must identify itself.

And the practical advice: the more personal the occasion, the less AI. You write a letter of condolence or an apology yourself.

Yes. The AI functions can be switched off, and the core of the programs works fully without them.

Without AI, these keep working: contacts, campaigns, templates, mailbox, inbox, contracts, websites, forms, evaluations.

These are no longer available: text suggestions, match assessments, AI column recognition during import, evaluation of search results, translation suggestions.

Anyone considering this should check the reason:

• Data protection concerns? These can usually be resolved through the contract and data minimisation.
• Costs? Then budgets help more than switching off.
• A decision of principle? Legitimate — then do it consistently, and document it.

What you should have in any case: a written rule that says what applies. Otherwise someone uses it anyway, and nobody knows.

Answer honestly and specifically — evasion comes across worse than any answer.

A sentence that almost always fits:

“We use AI for preparation — for text drafts and evaluations. Every output is checked by us and we take responsibility for it, and your data is not used for training.”

If they ask further, you should be able to say:

• Which services are involved (that is in your privacy notice).
• What is put in and what is not.
• That no automated decision is made about people.

If a customer wants to exclude its use — that happens in regulated sectors — it must be agreed contractually, and you must then be able to comply with it.