Germany

The Grundgesetz does not contain any explicit provisions regulating or restricting the state’s use of AI systems. However, as early as 1983, the Federal Constitutional Court (BVerfG) derived an independent fundamental right to informational self-determination from the principle of human dignity and the fundamental right to general freedom of action (Articles 1(1) and 2(1)). Since then, the BVerfG has further elaborated on this right in numerous decisions. Decisions of the BVerfG are binding on all constitutional bodies, as well as on all courts and authorities, and often acquire the force of law directly (section 31, Federal Constitutional Court Act (BVerfGG)). 

A decision of 10 November 2020 (Antiterrordateigesetz II 1 BvR 3214/15) indicates that the BVerfG continues to reinforce its established case law on the fundamental right to informational self-determination in the context of a possible state use of AI systems. The BVerfG nullified a federal law which purportedly allowed police authorities and intelligence services to make extended use of anti-terrorism files by way of automated data analysis and profiling. According to the court, it is constitutionally required that such state data mining must be held to protect particularly important legal interests and its usage must be bound to sufficient thresholds of intervention based on precisely defined and normatively clear regulations. The BverfG upheld its previous position, according to which human dignity requires that people are never made the mere object of state intervention, especially in the area of collecting and analysing information.

Other cornerstones of the case law on the fundamental right to informational self-determination are the purpose limitation of data processing by state agencies (in principle), the transparency of state interventions vis-à-vis the persons concerned, and the preservation of structurally and organisationally separate state units, especially in the area of intelligence and security agencies. This principle is of particular relevance for AI-driven decision-making systems that risk reducing individuals to statistical profiles or risk scores.

Patentability of AI

As a rule, it is not the AI system as such that is patentable, because AI methods are mostly mathematical solutions implemented in software, i.e. computer-implemented processes. These are only accessible to patent protection to a limited extent, since computer programs are not patentable per se (section 1(3) No. 3, Patent Act; the same applies to utility models (section 1(2) No. 3 of the GebrMG). Patentability requires a contribution to the solution of a concrete technical problem by technical means, such as the control of an autonomous vehicle, or the processing of measured values (e.g. if camera images from a vehicle are analysed to determine which traffic signs can be recognised on them, or if medical image data are being analysed for tumour detection in preparation for a medical diagnosis). In practice, patent offices increasingly scrutinise whether claimed AI-related features contribute to a technical effect beyond the mere execution of a trained model, particularly with regard to data preprocessing, training steps and deployment in a technical environment.

AI as inventor

The Legal Board of Appeal of the European Patent Office ruled on 21 December 2021 that only a human being can be an inventor within the meaning of Article 81 of the European Patent Convention. An AI could not be an inventor, and a human being cannot be regarded as the legal successor of an AI as the actual inventor of a patent (J 8/20 and J 9/20). Where AI systems are used as tools in the inventive process, inventorship must be attributed to the natural person(s) who made the relevant creative and technical decisions leading to the invention. In practice, the increasing use of generative AI tools in R&D raises additional risks regarding inventorship documentation and prior disclosure.

Copyright protection of AI

According to the established case law of the German Federal Court of Justice (BGH), algorithms as such are not amenable to copyright protection (Inkasso-Programm I ZR 52/83, judgment of 9 May 1985). However, the manner of implementation and assignment of different algorithms to each other may be protectable. Note that the calculation rule, the idea, and/or the mathematical formula are not the subject of protection here, but rather the “fabric” (Betriebssystem I ZR 139/89, judgment of 4 October 1990, BGH). Copyright protection of algorithms as computer programs under section 69a of the UrhG will therefore not generally exist in Germany.

Works created by AI

German copyright law is strongly influenced by the idea of the author as the creative head behind the work. The work is the expression and object of a moral right. This moral right permeates the entirety of German copyright law, particularly in areas that have not been harmonised under European law. The right to be named as the author (section 13, UrhG), the author’s rights of access to the original of his work (section 25, UrhG) or a right of recall due to changed opinion (section 42, UrhG) are only a few manifestations of this guiding idea. This basic conception of copyright law does not allow recognition of non-human systems as creators of works. Therefore, works created solely by AI systems are not amenable to copyright protection. If there is a sufficiently large human influence on the act of creation, only the natural persons behind the AI would be recognised as authors.

Apart from the conceptional question of whether AI can be considered an author, recent legal discussions have focused on the training of LLMs and similar AI tools. Under EU copyright law, storing training data in a corpus constitutes a relevant reproduction of the original work, even if it does not reach the public. AI vendors must ensure they have the right to collect and store such data, as direct licensing of terabytes of web-scraped training data is impracticable and unlikely to be achieved. The Digital Single Market (DSM) Directive (Directive (EU) 2019/790) introduced in 2019 allows text and data mining (TDM), i.e. reproductions necessary for automated analysis, unless the rights holder has expressly reserved this type of exploitation. This legal permission has been incorporated in German copyright law as sections 44b and 60d of the UrhG and is intended to facilitate large-scale data collection for creating training corpora. However, it is debated whether this exception applies to generative AI models, which were not foreseen when the DSM Directive was adopted. The applicability has become even more important with the advent of EU regulation of AI. Under Article 53(1)(c) of the AI Act, organisations using works for AI training must prove that the data was legally obtained. The AI Act also mandates that AI model providers have a policy to respect EU copyright law, specifically to identify and respect reservations of use expressed under the DSM Directive.

Since AI applications are regularly not subject to patentability or copyright protection, safeguarding the confidentiality of algorithms, data and their network of relationships is all the more important. In Germany, the protection of trade secrets is governed by the Act on the Protection of Trade Secrets (GeschGehG), which came into force in 2019 as an implementation of Directive (EU) 2016/943 ([2016] OJ L157/1). Associated with the GeschGehG was a paradigm shift from the traditional principles of trade secret protection in Germany. In contrast to the older case law, section 2 of the GeschGehG now requires the owner to apply reasonable secrecy measures to obtain statutory protection against unauthorised use of trade secrets. This requirement has become particularly relevant for AI-driven businesses, where value often lies in combinations of data, model parameters and optimisation techniques rather than in individual technical elements. The need-to-know principle is of central importance: information may only be disclosed to or made accessible to those persons, both within the company and to external parties, who absolutely require it for the performance of their duties. In addition, physical, technical and legal measures (in particular, the conclusion of non-disclosure agreements) must be used to prevent unauthorised access to or use of trade secrets (2 U 575/19, judgment of 19 November 2020, Stuttgart Higher Regional Court).

From a practical perspective, the increasing use of external AI tools and cloud-based AI services has sharpened the requirements for secrecy measures. German courts and legal literature increasingly emphasise that unrestricted input of confidential information into third-party AI systems — especially where providers reserve broad reuse or training rights — may jeopardise trade secret status if adequate safeguards are not in place. As a result, companies are expected to adopt internal AI usage policies, restrict permissible inputs and ensure contractual protections vis-à-vis AI service providers.

Recent EU-level regulation further affects the treatment of trade secrets in the AI context. Both the AI Act and the EU Data Act recognise the need to protect trade secrets but also introduce disclosure and transparency obligations in defined circumstances (e.g. towards regulators or users). Providers will increasingly have to balance transparency and documentation obligations with the need to preserve trade secrets, particularly when responding to regulatory inquiries or user information requests.

In recent years, German courts have begun to address how traditional copyright law applies in the context of generative AI systems, focusing on two key areas:

• the lawfulness of creating AI training datasets; and
• the question whether training and output generation can infringe copyright.

In the first German decision on AI training data, the Regional Court of Hamburg dismissed a claim by a photographer alleging that LAION infringed his copyright by downloading and using one of his images to create a publicly available AI training dataset (310 O 227/23, judgment of 27 September 2024). The court found that the activities in question were covered by the text and data mining copyright exception available for scientific research under section 60d of the UrhG, as the dataset served research purposes and was made freely available.

On appeal, the Higher Regional Court of Hamburg upheld this outcome (5 U 104/24, judgment of 10 December 2025). While it expressly recognised that downloading the image for dataset creation was a reproduction covered by the TDM exception under section 44b of the UrhG, the appellate court also clarified that a rights reservation must be declared in a machine-readable form to be effective under section 44b(3) of the UrhG. Natural-language usage restrictions (e.g. website terms prohibiting crawling) were held insufficient to exclude the TDM exception. In addition, the court confirmed that the scientific research exception under section 60d of the UrhG applied and that LAION, as a non-profit research organisation, fell within its scope.

In a contrasting development, the Regional Court of Munich I sided with the German collecting society GEMA in a copyright infringement action against OpenAI (42 O 14139/24, judgment of 11 November 2025). GEMA alleged that OpenAI’s generative language models had been trained on copyrighted song lyrics without a licence and that the models’ outputs reproduced those lyrics in ways that violated copyright. The court held that the memorisation of copyrighted works in the language model and the subsequent generation of outputs reproducing these works on user prompts amounted to copyright infringement. In doing so, the court rejected the defence that training data were merely reflected in model parameters and not “stored”, emphasising that both model memorisation and output reproduction could engage copyright exploitation rights under the UrhG. As a result, the court granted GEMA’s claims for injunctive relief, information and damages with respect to the unauthorised use of the protected works. The decision is subject to further appellate scrutiny and not settled case law in Germany.

In principle, only the provisions of the General Data Protection Regulation (GDPR) apply to the processing of personal data. Insofar as the EU Member States continue to have legislative competence for individual areas of law (e.g. in the area of employee data protection), Germany has little legislation in this space. The German regulations created in order to implement Directive (EU) 2016/680 ([2016] OJ L119/89) on data processing by police and judicial authorities also do not contain any special legal requirements for the use of AI systems.

However, since 2025, social security institutions have been permitted to use the social data they have collected to develop, train, validate and test AI models and systems if these serve to fulfil the statutory tasks of the institution under the section 67c paragraph. 3 SGB X of the German Social Code (SGB). This new provision vastly augments the scope of AI-based data processing compared to prior permission for health and long-term care insurance funds to conduct data-driven analyses to identify individual health risks (section 25b, SGB V).

AI and its use for processing personal data is in tension with fundamental principles of the GDPR, including lawfulness, transparency, purpose limitation and data minimisation. German data protection authorities have consistently adopted a cautious approach toward AI, particularly with regard to generative AI and LLMs.

This scepticism was first articulated in the Hambach Declaration of the Conference of Independent Data Protection Supervisory Authorities of the Federal Government and the Länder (Datenschutzkonferenz, DSK) of 3 April 2019 (see www.datenschutz-berlin.de/fileadmin/user_upload/pdf/publikationen/DSK/2019/2019-DSK-Hambach_Declaration_AI-en.pdf). While adopted before the widespread deployment of generative AI, the declaration remains influential and sets out seven core principles that continue to guide supervisory practice:

• AI must not turn human beings into objects, meaning that AI systems must not make decisions without the possibility of human intervention and only in a lawful and fair manner (Articles 5(1)(a), 22, GDPR);
• AI may only be used for constitutionally legitimate purposes and may not abrogate the requirement of purpose limitation (Articles 5(1)(b), 6(4), GDPR);
• AI must be transparent, comprehensible and explainable (Articles 5(1)(a), (2), 12, GDPR);
• AI must avoid discrimination, particularly through countermeasures applied before an AI system is being used with appropriate risk monitoring during the application of AI systems;
• the principle of data minimisation applies to AI (Article 5(1)(c), GDPR);
• AI needs responsibility, meaning that controllers of AI systems must ensure compliance with the aforementioned principles, provide clear and comprehensible information to data subjects, and ensure the security of the processing (Articles 12 et seq., 32, 35, GDPR); and
• AI requires technical and organisational standards for which best practices must be developed (Articles 24, 25, GDPR).

Since 2024, these abstract principles have been further operationalised. The DSK’s Guidance on Artificial Intelligence and Data Protection (Orientierungshilfe Künstliche Intelligenz und Datenschutz, Version 1.0 of 6 May 2024, at www.datenschutzkonferenz-online.de/media/oh/20240506_DSK_Orientierungshilfe_KI_und_Datenschutz.pdf)) has become the central reference document for AI compliance in Germany. The DSK has progressively elaborated guidance on AI and data protection and published further guidance. Most notably, the DSK’s Guidance on recommended technical and organisational measures for the development and operation of AI systems (Orientierungshilfe zu empfohlenen technischen und organisatorischen Maßnahmen bei der Entwicklung und dem Betrieb von KI-Systemen, Version 1.0 of June 2025, at www.datenschutzkonferenz-online.de/media/oh/DSK-OH_KI-Systeme.pdf) provides a lifecycle approach to GDPR compliance for AI. It sets out concrete technical and organisational expectations across four phases: design, development, deployment and operation/monitoring of AI systems. These expectations include early planning of lawful data sources, minimisation of personal data, documentation of training processes, privacy-friendly default settings and ongoing controls and reassessments. The guidance codifies principles such as data protection by design and by default for AI systems and treats them as central elements of lawful processing under the GDPR.

In its Guidance on data protection issues specific to generative AI systems with retrieval augmented generation (RAG) (Orientierungshilfe zu datenschutzrechtlichen Besonderheiten generativer KI-Systeme mit Retrieval Augmented Generation (RAG), Version 1.0, October 2025, at www.datenschutzkonferenz-online.de/media/oh/DSK_OH_RAG.pdf), the DSK targets systems where LLMs are combined with controlled access to internal organisational data (e.g. internal chatbots or knowledge assistants tied to enterprise repositories). It emphasises that controllers must: ensure purposes and legal bases are clearly defined and documented, implement tenant separation, access controls and deletion mechanisms for personal data in vector databases, maintain data subject rights (access, rectification, deletion) in the context of RAG responses, and instruct models to answer only from referenced sources to avoid uncontrolled use of personal data.

In addition, state Data Protection Authority’s (DPAs), such as the Baden-Württemberg DPA, have published discussion papers on AI that further underline supervisory concerns about transparency and lawful processing in training and operation of models. These papers echo the DSK’s lifecycle approach and highlight that data protection assessments must be documented and incorporated into governance frameworks (see www.baden-wuerttemberg.datenschutz.de/rechtsgrundlagen-datenschutz-ki). Lately, the Hamburg DPA used another approach stating that the mere storage of an LLM does not constitute processing within the meaning of Article 4(2) of the GDPR because no personal data were stored in LLMs (see www.datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Datenschutz/Informationen/240715_Discussion_Paper_Hamburg_DPA_KI_Models.pdf). DPAs across Germany have not found common ground, and a uniform interpretation of EU laws has yet to emerge, creating residual legal uncertainty for providers of LLMs.

In 2017, Germany laid the foundation for open administrative data with the first Open Data Act. Section 12a of the eGovernment Act (EGovG) obliged numerous federal authorities to publish the “raw data” they collect. At the same time, central criteria for open data were specified, such as making the data available to access free of charge and specifying further criteria as to machine readability. The Second Open Data Act, which came into force on 23 July 2021, significantly expanded its applicability to further federal authorities and federal agencies collecting research data.

Similar laws also exist at the level of the Länder (German States). The GovData portal is a central online platform for retrieving administrative data from the federal, state and local governments. Open data laws have been criticised because, although government agencies are obliged to make data available, citizens have no individual right to publication. In this respect, citizens are referred to transparency laws, which have been enacted separately at the federal and state levels.

With the EU Data Act having come into force in 2025, the open data regime has been complemented by horizontal data-sharing regimes, which indirectly increase the availability of data for AI use cases. Users of connected products and related services have the right to access the data generated by these products and services.

Biometric data, including voice data and facial recognition data, is classified as a special category of personal data under Article 9 of the GDPR. The use of AI systems in this context is therefore subject to particularly strict legal requirements. In Germany, the deployment of biometric technologies remains highly sensitive and continues to be closely scrutinised by data protection authorities, courts and legislators. The guidelines of the European Data Protection Board on virtual voice assistants contain valuable information on the use of voice assistance systems (both in consumer electronics devices and in driver assistance systems) and remain a key reference point in Germany.

The introduction of the EU AI Act significantly reshapes the legal framework for facial recognition. The AI Act classifies remote biometric identification systems as high-risk AI systems (Article 6(2)) and, in certain cases, prohibits their use altogether, particularly where real-time biometric identification in publicly accessible spaces is concerned (Article 5). These prohibitions are subject only to narrowly defined exceptions, mainly for law enforcement purposes and under strict statutory safeguards. In addition, the AI Act significantly restricts emotion recognition systems in workplace and educational settings, an area where German data protection authorities have historically taken a particularly critical stance.

The use of facial recognition systems is regularly the subject of much criticism in Germany. Plans to introduce nationwide video surveillance systems with biometric facial recognition (for example at train stations), were scrapped after protests from data protectionists. So, it remains that this technology is only used by largely voluntary projects.

The use of biometric technologies by police and security authorities continues to be governed by specific national legislation implementing Directive (EU) 2016/680. German courts have consistently stressed that biometric processing by state authorities requires a clear statutory basis, strict proportionality, and effective safeguards against misuse. While earlier case law, such as the Hamburg Administrative Court’s 2019 decision on biometric analysis of image material following the G20 riots (17 K 203/19, judgment of 23 October 2019), allowed certain forms of retrospective biometric analysis under section 48 of the Federal Data Protection Act, more recent discussions focus on tightening legal thresholds and improving oversight mechanisms, particularly in light of advances in AI-supported facial recognition.

With respect to the use of AI systems, the provisions of the General Equal Treatment Act (AGG) must also be taken into account (see the large-scale study conducted by the Karlsruhe Institute of Technology at www.antidiskriminierungsstelle.de/SharedDocs/downloads/DE/publikationen/Expertisen/studie_diskriminierungsrisiken_durch_verwendung_von_algorithmen.pdf). The AGG prohibits discrimination in numerous areas of private legal transactions on the grounds of race or ethnic origin, gender, religion or belief, disability, age or sexual identity (section 1, AGG). Employment relationships or application procedures for filling a position are also affected (section 2(1) No. 1, AGG). Pursuant to section 22 of the AGG, it is not the person affected by discrimination who must provide proof of actual discrimination, but the party accused of discrimination must justify the non-discriminatory nature of their decision once unequal treatment has been plausibly demonstrated.

In employment contexts, the use of AI systems is frequently subject not only to anti-discrimination law but also to co-determination rights of works councils, particularly where algorithmic systems influence hiring, evaluation or termination decisions.

At the same time, the EU NIS2 Directive has finally been formally transposed into German law through the NIS2 Implementation Act (NIS2UmsG), which entered into force on 6 December 2025. This Act modernises and expands the Act on the Federal Office for Information Security (BSIG) and enshrines a more comprehensive cybersecurity regime for Germany. Under the revised BSIG, a much wider set of organisations — including essential and important entities across multiple sectors — are subject to risk-based security, incident reporting, and organisational governance obligations. Entities must register with the BSI portal and implement robust cybersecurity risk management and incident reporting processes. Company management bodies bear direct responsibility for compliance, making cybersecurity a board-level and governance issue rather than solely an IT function.

From a practical perspective, AI models themselves increasingly constitute critical attack surfaces, particularly where model poisoning, data exfiltration or prompt injection can undermine system integrity. Consequently, in January 2026, the BSI published guidance on countermeasures for prompt injections, jailbreaks and adversarial attacks (www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/KI/Evasion_Attacks_on_LLMs-Countermeasures.pdf).

Though the CRA and the novated BSIG do not specifically regulate AI, both laws have significant implications for AI deployment where systems constitute digital products, interact with networked infrastructure, or process critical information. The CRA’s lifecycle obligations and NIS2’s mandatory governance and risk management measures will influence how AI systems are evaluated for security and resilience across their lifecycle.

In a joint study, the German Federal Cartel Office (BKartA) and the French Autorité de la concurrence concluded in 2019 that the use of algorithms could increase existing threats to free competition. Nevertheless, the existing legal framework was found sufficient to counter market abuse based on the use of algorithms (see Working Paper – Algorithms and Competition at www.bundeskartellamt.de/SharedDocs/Publikation/EN/Berichte/Algorithms_and_Competition_Working-Paper.pdf).

Over the last years, the focus has shifted from abstract risks to concrete enforcement and market oversight involving AI-enabled services. At EU level, the Digital Markets Act (DMA) has become a central enforcement instrument. Several large technology companies whose ecosystems increasingly incorporate AI functionalities — including Alphabet (Google), Amazon, Apple, Meta and Microsoft — have been designated as “gatekeepers”. Although AI systems are not themselves classified as “core platform services”, many AI features are tightly integrated into search engines, operating systems, app stores and social networks that fall within the DMA’s scope. As a result, DMA obligations such as prohibitions on self-preferencing, requirements on data access and restrictions on tying or bundling can apply indirectly to AI-driven services.

Section 19a of the Act against Restraints of Competition (GWB) provides the BKartA with a special option: companies which, due to their strategic position and resources, are of particular importance for competition across markets can be prohibited by the BKartA from certain conduct as a preventive measure. Examples of such conduct include self-preferential treatment of the group’s own services or obstructing the market entry of third parties by processing competition-relevant data. Since 2021 major digital companies like Alphabet/Google, Amazon, Apple, Meta and Microsoft have been designated under this provision.

Sections 5 and 5a of the German Unfair Competition Act prohibit misleading statements or statements which are misleading by omitting certain information. Personal price calculations or dynamic prices can be misleading according to these standards if information is not provided about the individual price calculation. If there are discrepancies between the prices stated in advertising and the actual, personally calculated prices, further competition violations could be possible due to infringements of the Price Indication Ordinance, which focuses on price clarity and price truth. The processing of personal data necessary for personal pricing can also be punished under competition law if a legal basis is missing or exceeded.

German law does not recognise AI systems, including agentic AI, as legal persons. Only natural persons and legal entities established by law are capable of bearing rights and obligations. Consequently, AI agents cannot hold legal personality, cannot be holders of rights or duties, and cannot independently enter into contracts.

Acts performed by an AI system are therefore attributed to human or legal persons based on existing legal doctrines. In practice, this attribution is typically grounded in the principles of agency, organisational responsibility and risk allocation. Where an AI agent is deployed by a company or individual to perform tasks within a predefined operational framework, actions taken by the system are generally attributed to the deploying entity as acts performed through a technical tool. This aligns with established case law on automated systems and software-based decision-making (see X ZR 37/12, judgment of 16 October 2012, BGH).

At present, German law does not contain sector-specific legislation that explicitly targets agentic AI as a distinct regulatory category. However, the deployment of autonomous or semi-autonomous AI agents is increasingly addressed indirectly through sectoral regulatory frameworks, particularly where high levels of risk, safety concerns or fundamental rights implications are involved.

In financial services, the use of autonomous AI systems is subject to existing supervisory regimes under banking and capital markets law. Where agentic AI is used for trading, portfolio management, credit assessment or compliance functions, regulated entities remain fully responsible for ensuring compliance with organisational, risk management and governance requirements. German supervisory practice, aligned with guidance from the European Central Bank and the European Banking Authority, emphasises that decision-making authority cannot be fully delegated to opaque or uncontrollable systems. Institutions must retain the ability to understand, monitor and override AI-driven decisions, including those taken by autonomous agents. This applies irrespective of whether decisions are taken in real time or through self-learning processes.

In the healthcare sector, the use of agentic AI is constrained by medical device regulation and professional liability standards. AI systems that autonomously generate diagnostic or therapeutic recommendations may qualify as medical devices under Regulation (EU) 2017/745. Fully autonomous decision-making without meaningful human review is regarded as legally and ethically problematic, particularly where it affects patient safety. Under German medical law, responsibility for diagnosis and treatment remains with licensed healthcare professionals, which limits the permissible scope of autonomous AI agents in clinical practice.

Under current German law, liability for AI-related harm is primarily assessed under two regimes: fault-based liability under the German Civil Code (sections 280 and 823, BGB) and strict product liability under the German Product Liability Act (ProdHaftG), which implements EU Directive 85/374/EEC. The ProdHaftG applies only to “products”, usually understood as movable items, including those incorporated into other movable or immovable property. Traditionally, this has covered hardware components incorporating software, while the qualification of standalone software as a product has been controversial. As a result, AI systems offered exclusively as cloud-based services (e.g. software-as-a-service or API-based AI models) will generally also fall outside strict product liability and have to be assessed under contract law and general tort law.

This fragmented approach is one of the primary reasons for the EU-level reform of product liability law. In December 2024, the EU adopted a new Product Liability Directive ((EU) 2024/2853), which needs to be implemented into German law by December 2026. The new product liability law will explicitly include software, digital manufacturing files and AI systems within its scope, irrespective of whether they are embedded in hardware or provided independently.

Under the current ProdHaftG, strict liability applies only if damage is caused by a defective product, meaning that the product does not provide the safety which a person is entitled to expect. Where applicable, liability does not depend on fault but on defectiveness, damage and causation. In practice, this regime has had limited relevance for AI systems. German courts have so far not addressed AI-specific strict liability questions, and there is no established case law clarifying how defectiveness should be assessed for adaptive or probabilistic systems.

The new EU Product Liability Directive significantly expands strict liability for AI-related harm. It explicitly provides that a product may be defective not only due to its initial design, but also due to its ability to learn, update or change behaviour after being placed on the market. Defectiveness may also arise from inadequate post-market monitoring, failure to provide safety updates, or insufficient instructions and warnings regarding foreseeable AI behaviour.

Under current German law, obligations to recall defective products or implement safety measures primarily arise from product safety law rather than product liability law. The German Product Safety Act requires manufacturers and distributors to place only safe products on the market and to take appropriate corrective measures where risks become known. This includes recalls, warnings, software patches or usage restrictions. For AI systems, these obligations already apply where AI is embedded in regulated products, such as machinery, vehicles or medical devices. In practice, corrective measures often take the form of software updates rather than physical recalls, raising questions about ongoing control, update obligations and cybersecurity risks.

The EU AI Act reinforces these mechanisms for high-risk AI systems by imposing post-market monitoring obligations, incident reporting duties and corrective action requirements. Providers must assess risks throughout the lifecycle of the AI system and take immediate action if serious risks or fundamental rights violations emerge. And the new Product Liability Directive complements these obligations by making failures in post-market monitoring, updates or recalls legally relevant for strict liability purposes.

As of 2026, there is no published German case law on product liability specific to AI. However, German courts are increasingly dealing with disputes concerning the attribution of AI behaviour to providers of AI systems.

Grok, X.AI LLC, the operator of the X account, is liable for AI-generated statements made by the account. The Hamburg Regional Court has prohibited the US company from further disseminating hallucinatory claims relating to Campact (O 461/25, decision of 23 September 2025). The fact that the post was created by AI did not change the fact that it was inadmissible under freedom of expression laws. Nevertheless, X users would consider Grok’s statements to be factual assertions, and the AI itself pointed out that its statements were fact-based. Despite general disclaimers that AI outcomes may be faulty, the average user would therefore attribute a certain factual significance to them. As the operator, X.AI was held responsible for the statements. By “presenting them on the account”, the company was considered to have adopted the statements as its own.

The Kiel Regional Court applied a similar argument when granting injunctive relief to a family business that had been incorrectly presented as being dissolved due to a lack of assets on an online platform (6 O 151/23, judgment of 29 February 2024). The provider used AI-driven online search tools to retrieve company information and offered users reports based on its research. Despite a disclaimer, the provider was held liable for the incorrect statements on its website.

Although the claim against Google was dismissed in this particular case, the Frankfurt Regional Court also held that the operator of an online search engine can, in principle, be held liable for incorrect statements generated by an integrated AI tool that summarises search results (2-06 O 271/25, judgment of 10 September 2025).

While Germany has not enacted any horizontal, but only fragmented, sector-specific AI legislation of its own, legislative and organisational activity is underway to implement and operationalise the EU AI Act at national level. This includes the designation of competent authorities, the establishment of coordination mechanisms between federal and Länder authorities (including Data Protection Authorities), and the preparation of enforcement structures for high-risk AI systems. At the same time, the federal government and the Länder have expanded pilot projects for the use of AI in public administration and the judiciary, including document analysis, workflow automation and decision support tools.

The German government formulated an AI strategy in 2018 (see Strategie Künstliche Intelligenz der Bundesregierung at www.bundesregierung.de/resource/blob/997532/1550276/3f7d3c41c6e05695741273e78b8039f2/2018-11-15-ki-strategie-data.pdf) and continuously emphasises the importance of AI to bolster Germany’s position as a leading economic power. The 16 Länder have also implemented digitalisation strategies, including on the use of AI in public service, administration, and courts. However, the legal framework will continue to be significantly determined by initiatives at the European level, such as the AI Act.

AI strategy of the Federal Government 2018

The German government, following the example of many other countries, adopted a National Strategy for Artificial Intelligence in July 2018, defining guidelines for an AI-supported economy. The AI strategy sets out three core objectives for Germany:

• To become a leading AI location in order to secure future German competitiveness, e.g. through the creation or expansion of scientific research facilities and easier access to government funding programs for start-ups.
• To ensure responsible and public welfare-oriented development and use of AI by safeguarding human rights, including workers’ rights in the use of AI systems in the workplace.
• To ensure that AI applications are considered ethically, legally, culturally and institutionally, and brought into line with existing basic principles of social coexistence.

Update to the AI Strategy 2020

As early as December 2020, the German government contextualised and further developed its AI strategy (see www.bundeswirtschaftsministerium.de/Redaktion/DE/Publikationen/Technologie/strategie-kuenstliche-intelligenz-fortschreibung-2020.pdf) in the light of the backdrop of the COVID-19 pandemic, which highlighted widespread IT backwardness of small- and medium-sized enterprises, and also of public services. The centrepiece of the German government’s updated strategy was an increase in the budgetary resources earmarked for the development of Germany as an AI location.

AI Action Plan 2023

In late 2023, the federal government developed an AI Action Plan (www.bmftr.bund.de/SharedDocs/Downloads/DE/2023/230823-executive-summary-ki-aktionsplan.pdf) that will continue to be pursued even after the 2025 elections and government transition. The plan aims to strengthen AI research in Germany, expand AI infrastructure, advance the campaign for AI skills, promote the transfer of AI into real-world value creation and economic opportunities, and foster dialogue with society and multidisciplinary research on AI.