Artificial intelligence (AI) for process automation

The introduction of artificial intelligence (AI) into business processes offers enormous opportunities to increase efficiency and competitiveness, but also presents companies with complex legal and ethical challenges. The use of AI systems for process automation and decision support requires careful consideration of the potential benefits and the associated risks, particularly with regard to data protection and the protection of the personal rights of employees and customers.
Companies wishing to implement AI in their business processes must not only comply with the applicable data protection regulations under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), but also take into account emerging regulations such as the EU AI Act. This requires a holistic approach that encompasses technical, organizational and legal aspects.

The key challenges include

• Ensuring transparency in AI-supported decision-making processes
• Ensuring data minimization and purpose limitation when processing personal data
• Implementing robust security measures to protect sensitive information
• Conducting data protection impact assessments for AI systems with high risk potential
• Compliance with ethical guidelines to avoid discrimination and unfair practices

Companies must also consider the labor law implications of the use of AI, particularly with regard to co-determination rights and the protection of employee rights. Involving works councils and trade unions in the AI implementation process can help to create acceptance and address potential conflicts at an early stage.

A proactive and risk-oriented approach is required to ensure data protection when using AI for companies and to promote innovation at the same time. This includes the development of comprehensive AI governance structures, the continuous training of employees and the regular review and adaptation of the implemented measures to changing legal and technological conditions.
Ultimately, the challenge for companies is to find a balanced approach that exploits the potential of AI without jeopardizing the fundamental rights and freedoms of the individuals concerned. This is the only way to ensure the sustainable and trustworthy integration of AI into company processes.

Legal implications and liability issues

When implementing AI systems for process automation, companies must pay particular attention to the legal implications and liability issues. The EU AI Act, which was adopted by the European Parliament on March 13, 2024 and is expected to come into force this year, creates a uniform legal framework for the development and use of AI in Europe. This law aims to protect the rights and security of citizens while promoting innovation in the field of AI.

Under the AI Act, companies must classify their AI applications into different risk classes and fulfill corresponding documentation obligations. AI systems that are classified as high-risk are particularly critical, as they are subject to stricter requirements and controls. This requires careful planning and implementation in order to minimize legal risks and ensure compliance. Liability issues play a central role, especially when AI systems make mistakes or cause damage. The planned AI Liability Directive provides for a reversal of the burden of proof under certain conditions, which should make it easier for injured parties to assert claims. This means that companies could be under an obligation to prove that their AI systems are error-free, underlining the importance of robust quality assurance processes and detailed documentation.

Companies must therefore implement not only technical but also organizational measures to ensure the transparency, traceability and accountability of their AI systems. This includes the establishment of governance structures, the performance of regular risk analyses and the implementation of control mechanisms to monitor AI performance and decisions.

In addition, contracts with AI providers and users should be carefully drafted in order to clearly regulate and, if necessary, limit liability risks. It is important to define responsibilities and liability scenarios in detail and to establish mechanisms for dealing with unforeseen events or damage. A regular legal review and adaptation of AI systems and processes is essential in order to keep pace with evolving legal requirements. This also includes the ongoing training of employees in the legal and ethical aspects of AI use and the establishment of reporting procedures for potential legal violations or ethical concerns.

Companies should also consider the potential impact of their AI systems on fundamental rights and freedoms. The AI Act prohibits certain AI practices that are considered incompatible with EU values, such as social scoring or the use of AI to manipulate human behavior. It is therefore important that companies check their AI applications not only for technical efficiency, but also for ethical and legal compliance. Finally, companies must bear in mind that the legal framework for AI continues to evolve. In addition to the AI Act, there are numerous other relevant laws and directives, such as the GDPR, the Product Liability Directive and sector-specific regulations that must be taken into account when implementing AI systems[3]. Proactively addressing these legal requirements and working with legal experts can help companies minimize compliance risks and make their AI strategies legally compliant.

Data protection and employee rights

The use of AI for process automation raises important questions about data protection and employee rights. The processing of personal data by AI systems must comply with the General Data Protection Regulation (GDPR). In addition, companies must now also take into account the requirements of the EU AI Act, which was passed in May 2024 and is gradually coming into force. The AI Act creates a comprehensive legal framework for the development and use of AI systems in the EU and sets different requirements depending on the risk classification of the AI system. Companies must have a clear legal basis for data processing and observe the principles of data minimization and purpose limitation. In the employment relationship, consent as a legal basis is often problematic due to the existing imbalance of power. When implementing AI systems, a data protection impact assessment (DPIA) is often essential in order to identify and minimize potential risks to the rights and freedoms of data subjects.

In the context of employee data protection, companies must be particularly careful, as AI systems for performance monitoring or automated decision-making could be classified as high-risk systems within the meaning of the AI Act. This requires not only the involvement of the works council and possibly the conclusion of a works agreement, but also compliance with strict requirements under the AI Act, such as extensive documentation and transparency obligations. Companies must ensure that the processing of employee data by AI systems is proportionate and transparent. This includes the implementation of technical and organizational measures to protect data and the development of clear guidelines for the use of AI in the workplace. The AI Act also requires a thorough risk assessment and continuous monitoring of AI systems, especially if they are classified as high risk.

Transparency towards employees is crucial. Companies must provide their employees with comprehensive information about the use of AI systems, including the type of data processed, the purpose of the processing and the potential impact on their work. The AI Act reinforces these requirements by, for example, prescribing the labeling of AI-generated content.

Regular training on the use of AI systems, data protection and the requirements of the AI Act is essential to reduce compliance risks and increase acceptance. In addition to technical aspects, these training courses should also address the legal and ethical implications of the use of AI in the working environment.

Proactively addressing the legal requirements of the AI Act and the GDPR and working with legal experts are crucial to minimizing compliance risks and making AI strategies legally compliant. Businesses should note that the AI Act will come into force gradually, with some provisions applying earlier. A balanced approach that utilizes the innovation potential of AI without compromising the rights and dignity of employees is of central importance.

Product safety and ethical aspects

The implementation of AI systems for process automation raises important questions of product safety and ethical responsibility. Companies must ensure that their AI-driven products and processes comply with the applicable safety standards and do not pose any unacceptable risks to consumers or employees. This requires careful risk assessment and continuous monitoring of AI systems. The EU AI Act, which has already come into force, places specific requirements on the safety and reliability of AI systems, especially for high-risk applications. Companies must now implement quality assurance and risk management processes at an early stage to ensure compliance with the law. This includes the development of robust test procedures, the implementation of security mechanisms and the performance of regular audits.

Ethical aspects are playing an increasingly important role in the development and use of AI. Companies should develop and implement ethical guidelines for the use of AI to ensure fairness, transparency and accountability. The establishment of an ethics committee or the integration of ethical considerations into the development process of AI systems can help to identify and address potential ethical conflicts at an early stage. An important aspect of product safety in AI systems is ensuring the reliability and robustness of the algorithms. Companies must ensure that their AI systems function stably even under unforeseen conditions and do not have any unintended negative effects. This requires extensive testing and validation under various scenarios.

Taking ethical aspects into account can not only minimize legal risks, but also strengthen the trust of customers and employees. Transparency with regard to the functioning and decision-making processes of AI systems is of crucial importance. Companies should be able to explain the decisions of their AI systems in a comprehensible manner and identify and correct possible biases or discrimination. Companies should also consider the potential impact of their AI systems on society and the environment and take measures to minimize negative consequences. This can include carrying out impact assessments, involving various stakeholder groups and continuously monitoring social impacts.

Proactively addressing these issues can help companies to position themselves as responsible players in the field of AI technology. This also includes active participation in discussions on the further development of safety standards and ethical guidelines for AI systems. In the context of occupational safety, companies must pay particular attention to ensuring that AI systems do not endanger the health and safety of employees. This requires close cooperation between AI developers, occupational health and safety experts and the employees concerned in order to identify and minimize potential risks at an early stage.

Finally, companies should also consider the possibility of using AI systems themselves as a tool to improve product safety and support ethical decision-making. For example, AI can help to identify security risks or analyze complex ethical scenarios.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.