Oppenhoff : Taskforce AI

Do you have an overview of the obligations?

AI Act applicable on a staggered basis from 2024

Your contacts: Dr. Marc Hilber; Dr. Jürgen Hartung; Dr. Axel Grätz

The AI Act is anticipated to come into force in the second quarter of 2024. The regulations on prohibited AI will apply six months after the AI Act comes into force, certain regulations for high-risk AI and general purpose AI models after one year and the other regulations after two years. The aim is to make Europe a pioneer for trustworthy, safe and innovative AI. The AI Act imposes numerous obligations on providers and operators of AI, depending on the risk posed by the system. The higher the risk, the stricter the obligations. In the case of high-risk AI systems, all companies that use them are subject to strict monitoring obligations. Certain AI applications are prohibited, e.g. biometric systems, emotion recognition systems and social scoring. Consumers have the right to lodge complaints and receive meaningful explanations.

Violations could result in fines of up to 40 million euros or 7 percent of global turnover.

Important publications (external forwarding)

• AI Act

Are your employees and the works council on board?

The introduction of AI technologies is causing significant changes in the world of work. Recruiting and HR management are being accompanied by AI and work processes are being reorganised by AI. The demands on employees are increasing. The use of AI technology in the company requires the consent of the works council.

A timely dialogue with employees and negotiations with the works council should be initiated at an early stage in order to achieve a high level of acceptance of AI in everyday working life.

Your contact: Kathrin Vossen

Do your measures comply with EU requirements?

NIS 2 Directive applicable from the end of 2024

EU cybersecurity regulations such as the NIS 2 Directive define the legal framework throughout the EU to achieve a uniformly high level of cybersecurity. In addition, different German national regulations apply. Among other things, companies must implement reporting obligations for security incidents, risk management measures to combat cyberattacks and cybersecurity training for company management.

New obligations are to be transposed into national law by October 2024 via the NIS 2 Implementation Act. AI technology can support these compliance processes - provided it is used in accordance with the law.

Your contacts: Dr. Marc Hilber; Dr. Jürgen Hartung; Dr. Axel Grätz

Are your AI applications compliant with the applicable data protection laws?

By their very nature, AI projects raise numerous data protection issues, as the development and use of AI requires the availability of large amounts of data and the processing of personal data can be relevant at all stages of AI development. In addition, the term of personal data is subject to broad interpretation.

The overriding interest of the providers and operators of the AI systems often justifies the respective data processing, provided this is done for research and statistical purposes. Any data transfers to third countries must be justified separately.

In addition, providers and operators of AI must fulfil the transparency and information obligations under data protection law and observe the principle of data minimisation.

Your contacts: Dr. Marc Hilber; Dr. Jürgen Hartung; Dr. Axel Grätz

Important publications (external forwarding)

• German Data Protection Conference: The German Data Protection Conference (Datenschutzkonferenz, “DSK“) publishes a guide on artificial intelligence and data protection. In its guide, the DSK provides an overview of the criteria under data protection law for the compliant use of AI systems, with a focus on so-called large language models such as ChatGPT (6 May 2024).
• Measures for using AI: The Bavarian State Office for Data Protection Supervision publishes an information flyer and a checklist with recommended measures for the data protection-compliant use of AI (24 January 2024).
• LLM-based chatbots: The Hamburg Commissioner for Data Protection and Freedom of Information publishes a checklist for the use of LLM-based chatbots (13 November 2023).
• Discussion paper on the use of AI: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg publishes a discussion paper on the legal basis for data protection in the use of artificial intelligence (7 November 2023).
• Self-assessment guide: The French Data Protection Authority publishes a self-assessment guide for AI systems (August 2020).

Are you aware of the claim to get access to data?

Data Act applicable from September 2025

The data access and data sharing requirements set out in the Data Act are intended to increase the availability of data and break up the multitude of data silos. Among other things, data generated by networked products and connected services shall be accessible by default.

This also applies to data generated by AI that is implemented in devices. Large parts of the regulation will apply from 12 September 2025, and companies must be prepared for this and adapt their products accordingly.

Your contacts: Dr. Marc Hilber; Dr. Jürgen Hartung; Dr. Axel Grätz

Are your AI creations sufficiently protected?

The use of AI can lead to new challenges in the area of intellectual property, especially where the creation of works, patents, designs or marks by AI systems are concerned. Companies should protect their rights and make clear agreements on intellectual property in relation to AI developments.

This can also prevent disputes with employee inventors. At the same time, companies should clearly define which data is used for training and operating their systems.

Your contact: Georg Lecheler

Does your AI operate within the framework of competition law regulations?

Cartel authorities around the world are keeping a watchful eye on KI to ensure that its use does not lead to restrictions of competition.

AI developers and users are obliged to continuously check the functions of the programmes for effects that violate antitrust law. AI toolsshall not be misused for price or market agreements between competitors. Increased market transparency created by AI applications or the "signalling" of future market behaviour can also be problematic under competition law.

Your contact: Dr. Daniel Dohrn

Do processes to minimise liability risks under public law exist?

AI applications can be used to fulfil obligations under public law, such as reporting and supervisory duties. However, when using AI tools for support, it should be noted that the fulfilment of duties is primarily the responsibility of the management. It also bears the responsibility for errors made by the AI.

Developers, users and operators of AI must also be careful when it comes to foreign trade law: both software and hardware components as well as technical data, which serve as the basis for AI can be relevant under export control law and therefore restricted in their handling. Furthermore, the sale of a German operator or developer of AI can be subject to investment screening.

Your contact: Mareike Heesing

Are you the owner of all rights?

AI systems consist of software and databases and utilise data. Open source software is often used. Against this background, companies that develop AI systems must ensure that they own all rights to the object of development. This is the only way they can amortise their investments and prohibit the unlawful use of their systems by third parties.

Finally, the question arises who owns the rights to software codes generated by AI.

Your contacts: Dr. Marc Hilber; Dr. Jürgen Hartung; Dr. Axel Grätz

Have you considered all "purchased" consequential risks?

Companies are increasingly trying to push forward their own AI transformation through external growth. Technology start-ups and SMEs are therefore the centre of the resurgent transaction environment. However, as the regulation of AI will also apply in part to mere users of AI, the "purchased" consequential risks will have to be analysed in practically every M&A deal in future.

From a start-up and investor perspective, funding programmes such as the announced EU package of measures to support European start-ups and SMEs should also be considered when developing trustworthy AI.

Your contact: Anna-Catharina von Girsewald

Do you use AI in compliance with regulations?

There are various innovative AI-based business models in the insurance industry. Examples include chatbots in sales and customer service, fraud prevention applications and automated underwriting, claims settlement and audit processes.

Regulatory compliance must also be taken into account in order to fulfil existing regulatory requirements. Insurers and brokers must ensure careful AI governance. Insurance companies must also adhere to the limits of permissible insurance-related activities when integrating and financing AI systems.

Your contact: Anna-Catharina von Girsewald

Are you aware of the special liability provisions for AI?

AI Liability Directive expected to apply from 2026

If damage occurs when using AI systems, various liability issues arise. In September 2023, the European Commission adopted a proposal for an AI Liability Directive. This aims to harmonise civil liability regulations. The Directive contains simplified rules of representation and proof in the enforcement of claims in favour of the injured party.

Important publications (external forwarding)

• AI Liability Directive