--- title: "Can German Companies Use AI Customer Service? GDPR & AI Act (2026)" description: "Yes — with the right setup. Covers GDPR legal basis, DPA review, AI Act transparency rules, and human escalation. Includes a 10-step rollout checklist." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/ai-customer-service/" language: "en" --- ![AI customer service GDPR and AI Act compliance guide Germany](https://compound.law/assets/images/compliance/compliance_2.webp) compliance # Can German Companies Use AI Customer Service? GDPR & AI Act (2026) 3 April 2026 Short answer AI customer service can be used lawfully in Germany if companies narrow the use case, choose a valid GDPR setup, review the DPA and subprocessors, give clear AI disclosures, and keep meaningful human escalation for complaints and consequential decisions. - Use AI support for low-risk automation first, not for fully automated decisions with legal or similarly significant effects. - Review legal basis, privacy notice, retention, hosting, transfers, and vendor terms before customer data enters the tool. - Build human handoff, complaint handling, and governance controls before scaling the rollout. **AI customer service in Germany is possible, but it is not a plug-and-play compliance question.** In practice, German companies can use chatbots, ticket summaries, call transcripts, and agent-assist tools if they limit the data scope, choose a defensible GDPR setup, review the vendor contract and transfer mechanics, and ensure that customers can reach a human when the issue becomes sensitive, contested, or outcome-relevant. For most companies, the safest starting point is **low-risk support automation**: FAQ chat, ticket triage, knowledge-base suggestions, summary drafting, and agent-assist. The legal difficulty rises once the system handles complaints, analyses calls at scale, influences refunds or account restrictions, or processes large volumes of identifiable customer data without strong controls. A 10-step rollout checklist for legal, privacy, and support teams follows at the end of this guide. Before rollout, support, legal, and privacy teams should usually confirm: - what customer data enters the AI workflow, - which GDPR legal basis and privacy notice cover that processing, - whether the vendor offers a usable **DPA** under Article 28 GDPR, - where hosting and subprocessors are located, - whether model training is disabled or contractually restricted, - and when the workflow must escalate to a human reviewer. ## Can German companies use AI in customer support lawfully? Yes, in many cases. But the lawful answer depends on the **use case design**, not just the tool name. German companies often ask whether they may use AI for: 1. customer-service chatbots, 2. ticket classification and prioritisation, 3. support-response drafting, 4. call transcription and summary generation, 5. quality-assurance review of support conversations, 6. agent-assist prompts during live interactions. Those use cases are often defensible if they stay within a structured operational model. The core legal framework is usually: - **Articles 5 and 6 GDPR** for data minimisation, purpose limitation, and legal basis, - **Articles 13 and 14 GDPR** for customer-facing transparency, - **Article 28 GDPR** for processor terms and instructions, - **Chapter V GDPR** for third-country transfers, - **Article 22 GDPR** if the setup moves toward automated decisions with legal or similarly significant effects, - and the **EU AI Act**, especially Article 50 transparency obligations for systems that interact directly with natural persons. The current AI Act timeline matters. The European Commission states that the AI Act entered into force on **August 1, 2024**, prohibited practices and AI literacy obligations started applying on **February 2, 2025**, and **Article 50 transparency rules start to apply on August 2, 2026**. That means customer-service teams should already design for explainability and disclosure instead of waiting until the last minute. If your customer-service stack includes AI voice generation, our [ElevenLabs DPA guide](https://compound.law/en-DE/tools/elevenlabs/) breaks down the vendor-specific questions around GDPR, EU data residency, retention, voice data, and buyer-side due diligence in Germany. If you are reviewing adjacent customer-facing systems, our guides on [AI chatbots](https://compound.law/en-DE/compliance/ai-chatbots/), [AI voice assistants](https://compound.law/en-DE/compliance/ai-voice-assistants/), [Intercom AI](https://compound.law/en-DE/tools/intercom/), [Zendesk AI](https://compound.law/en-DE/tools/zendesk/), and [HubSpot AI](https://compound.law/en-DE/tools/hubspot/) help compare typical data flows and rollout questions. ## Chatbots, ticket summaries, call transcripts, and agent assist tools: what changes legally? The legal risk profile depends on what the system does with the conversation and what follows from its output. A support chatbot that answers shipping questions from a knowledge base is very different from a support workflow that: - scores customer credibility, - proposes complaint outcomes, - recommends denying service, - analyses emotion or intent in calls, - or shapes decisions about refunds, cancellations, or fraud flags. The European Commission’s AI Act Service Desk explains that Article 50 requires people interacting directly with AI to be informed that they are interacting with an AI system unless that is obvious from the context, and that the information must be given clearly and at the latest at first interaction. For customer-service teams, that points to practical disclosure design, not hidden footer language. The Hamburg Commissioner for Data Protection’s chatbot checklist is also operationally useful for support teams. It emphasises internal use rules, involving the data protection officer, avoiding uncontrolled personal-data inputs where no legal basis exists, opting out of training where possible, checking outputs for accuracy and discrimination, and avoiding automated final decisions unless Article 22 GDPR requirements are met. In practical terms, the main legal shift happens when AI moves from **assistive support tooling** to **decision-shaping infrastructure**. Drafting, summarising, and suggesting are easier to justify than deciding, especially when the customer could be materially affected. ## Customer-data legal bases, transparency, and retention There is no single legal basis that fits every support AI deployment. Many companies look first at **Article 6(1)(f) GDPR legitimate interests**, especially for ordinary support operations, ticket handling, and service improvement. In other cases, **Article 6(1)(b)** may be relevant where the processing is necessary to deliver contractual support. The correct answer depends on the workflow, data category, and customer expectation. The practical review should include: 1. what categories of customer data enter the model or support layer, 2. whether the use is necessary for service delivery or better framed as a legitimate-interest balancing exercise, 3. whether special-category data or complaint details appear in the workflow, 4. how long prompts, transcripts, summaries, and outputs are retained, 5. whether customer notices explain the AI-supported interaction clearly enough. For German and DACH companies, the weak spot is often not the abstract legal basis but the mismatch between the **privacy notice** and the real workflow. If the chatbot, transcript tool, or summarisation layer is not described accurately, the transparency story breaks down. Companies should therefore review whether they need to update: - their external privacy notice, - support-channel disclosures, - retention schedules, - complaint-handling scripts, - and internal rules on which data agents may paste into AI-enabled tools. As a rule of thumb, keep the first deployment narrow. Do not start with unrestricted customer-history ingestion if the team has not yet agreed what belongs in the AI workflow and what should stay outside it. ## Vendor due diligence: DPA, subprocessor, and hosting questions For AI customer service in Germany, vendor review is usually where procurement and privacy teams either create a strong compliance record or leave major gaps. At minimum, the review should cover: - the **DPA / AVV** and whether it clearly covers the exact AI support features in scope, - the subprocessor list and change-notice mechanism, - hosting locations and support-access paths, - transfer safeguards for non-EU processing, - retention and deletion commitments, - security controls and account-level permissions, - whether customer data is used for model training by default or can be excluded, - and whether audit, logging, and incident clauses match the company’s expectations. This is especially important for tools used across multiple support layers, for example [Intercom AI](https://compound.law/en-DE/tools/intercom/), [Zendesk AI](https://compound.law/en-DE/tools/zendesk/), or [HubSpot AI](https://compound.law/en-DE/tools/hubspot/). Those platforms may sit close to ticket history, CRM records, support macros, and user profiles, so the legal review should reflect the full operational picture rather than only the AI add-on name. If a vendor says customer data is not used for training, treat that as a **current vendor commitment to verify**, not a permanent assumption. Check the current terms at procurement and renewal. If the feature set changes, repeat the review. ## When support AI becomes high-risk or needs extra scrutiny under the AI Act Most customer-service AI will not automatically fall into the Annex III high-risk categories. But that does not mean it is always low-friction. Extra scrutiny is usually needed where the support tool: - materially influences access to a service, - makes or strongly shapes refund, termination, or complaint outcomes, - uses biometric categorisation or emotion recognition, - analyses vulnerable individuals, - handles special-category data, - or is deployed in a way that creates profiling or fairness concerns. The safest operational approach is to separate ordinary support automation from use cases that could affect rights, opportunities, or serious customer outcomes. The matrix below is a useful internal approval tool: | Support AI use case | Typical risk level | Practical legal view | | ------------------------------------------------------------ | ---------------------------- | ---------------------------------------------------------------------- | | FAQ chatbot with clear disclosure | Low | Usually manageable with privacy notice, DPA, and escalation logic | | Ticket summarisation for human agents | Low to medium | Check retention, permissions, and training restrictions | | Suggested support replies | Medium | Review quality control and customer-impact scenarios | | Call transcript analytics for QA | Medium to high | Review legal basis, notice, retention, and sensitivity of call content | | Complaint triage that influences outcomes | High | Needs deeper legal review, stronger oversight, and documented controls | | Automated denial, restriction, or rights-impacting decisions | Avoid without bespoke review | Can trigger Article 22 GDPR and wider AI Act scrutiny | If the system may create a legal or similarly significant effect for a natural person, the assessment should not stay at a standard procurement level. That is the point where legal and privacy teams should slow the rollout and review the full decision architecture. ## Human handoff, complaint handling, and governance guardrails The simplest compliance improvement for AI customer service is often not contractual. It is **process design**. Companies should define in advance when the system must stop and route the matter to a person. Typical triggers are: - customer complaints, - refund disputes, - cancellations or account restrictions, - references to health, children, or other sensitive data, - suspected discrimination or unfair treatment, - unclear or hallucinated outputs, - and any situation where the customer explicitly asks for human review. This is where support AI, GDPR, and governance meet. The Hamburg DPA checklist warns against automated final decisions and against teams becoming de facto bound by opaque AI suggestions. In customer support, that translates into a real requirement for human judgement, not symbolic approval after the AI has effectively decided the outcome. Governance guardrails usually include: - approved and prohibited use cases, - agent guidance on what data may not be entered, - documented human-escalation triggers, - periodic quality review of outputs, - defined retention and deletion settings, - and accountability between support, privacy, legal, and vendor management. If your rollout also affects employee workflows, performance visibility, or monitoring concerns, labor-law questions may appear alongside privacy and AI Act questions. Our [expertise page](https://compound.law/en-DE/expertise/) shows how Compound Law combines privacy, employment, commercial, and AI compliance work for Germany-focused businesses. ## Practical rollout checklist for support, legal, and privacy teams Before enabling AI customer service broadly in Germany, teams should usually work through this checklist: 1. Define the exact support use cases and exclude sensitive or rights-impacting scenarios from the first rollout. 2. Map which customer data, ticket content, call material, and CRM fields enter the tool. 3. Confirm the GDPR legal basis for each workflow and record the reasoning. 4. Update privacy notices and support disclosures where needed. 5. Review the DPA, subprocessors, hosting, transfers, deletion, and training settings. 6. Limit permissions and data exposure to what the support workflow actually needs. 7. Add a clear AI disclosure at the first customer interaction where Article 50 logic is relevant. 8. Create human handoff rules for complaints, escalations, contested outcomes, and sensitive data. 9. Test output quality, hallucination risk, and discriminatory or unfair patterns before scale-up. 10. Document the rollout in the company’s AI governance and vendor-management process. ## How Compound Law helps Compound Law helps companies in Germany and the DACH region structure AI customer-service rollouts across privacy, commercial contracts, employment, and AI Act compliance. Typical support includes: - DPA and vendor-term review, - transfer and subprocessor assessment, - customer-notice and disclosure design, - support AI use-case matrices, - complaint-handling and human-escalation governance, - and rollout guidance for legal, privacy, procurement, and operations teams. Specific deployments still require individual legal advice. A guide like this can structure the review, but it cannot replace a fact-specific assessment of the tool, contract, data flows, and customer-impact scenarios. ## FAQ ### Can we use a chatbot for customer support in Germany? Usually yes, if the chatbot has a defined scope, customers are informed clearly when they interact with AI, and the company has reviewed privacy notices, vendor terms, and escalation routes for sensitive cases. ### Can customer conversations be used to train an AI model? That should never be assumed. Companies should check the current vendor terms, disable training use where possible, and decide internally whether any live customer conversation may enter training-related workflows at all. ### Do we always need a DPA or AVV for support AI? If the vendor processes customer personal data on the company’s behalf, Article 28 GDPR review is usually required. The relevant question is not only whether a DPA exists, but whether it covers the actual AI-supported workflow. ### Are AI-generated call transcripts and summaries allowed? Often yes, but they need a closer review than ordinary FAQ chat. Call content may contain sensitive information, complaint details, and quality-monitoring implications, so legal basis, notice, retention, and access controls matter. ### When should a human take over from the AI? A human should usually take over where the issue is disputed, sensitive, outcome-relevant, or clearly beyond scripted support. Complaints, refunds, account restrictions, or special-category data should not be left to a fully automated support flow without bespoke legal review. ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions Often yes, if the rollout is limited, transparent, supported by a valid GDPR setup, and backed by vendor, security, and escalation controls. Some AI Act rules already apply, but Article 50 transparency obligations start to apply on August 2, 2026 according to the European Commission AI Act timeline. Yes. If a vendor processes customer data on the company’s behalf, Article 28 GDPR terms, subprocessors, security, deletion, and transfer mechanics should be reviewed. Not by default. Companies should check the current vendor terms and disable training use where possible before any live customer rollout. It becomes more sensitive when the tool handles complaints, special-category data, profiling, employee monitoring, or automated decisions that materially affect people. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Can German Companies Use AI Customer Service? GDPR & AI Act (2026)", "description": "Yes — with the right setup. Covers GDPR legal basis, DPA review, AI Act transparency rules, and human escalation. Includes a 10-step rollout checklist.", "image": "https://compound.law/assets/images/compliance/compliance_2.webp", "datePublished": "2026-04-03T00:00:00.000Z", "dateModified": "2026-04-03T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/ai-customer-service/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "Can German Companies Use AI Customer Service? GDPR & AI Act (2026)", "item": "https://compound.law/en-DE/compliance/ai-customer-service/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Can German companies use AI chatbots and support automation lawfully?", "acceptedAnswer": { "@type": "Answer", "text": "Often yes, if the rollout is limited, transparent, supported by a valid GDPR setup, and backed by vendor, security, and escalation controls." } }, { "@type": "Question", "name": "Does the AI Act already apply to customer-service AI?", "acceptedAnswer": { "@type": "Answer", "text": "Some AI Act rules already apply, but Article 50 transparency obligations start to apply on August 2, 2026 according to the European Commission AI Act timeline." } }, { "@type": "Question", "name": "Do customer conversations need a DPA or AVV review?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. If a vendor processes customer data on the company’s behalf, Article 28 GDPR terms, subprocessors, security, deletion, and transfer mechanics should be reviewed." } }, { "@type": "Question", "name": "Can customer conversations be used to train the vendor model?", "acceptedAnswer": { "@type": "Answer", "text": "Not by default. Companies should check the current vendor terms and disable training use where possible before any live customer rollout." } }, { "@type": "Question", "name": "When does support AI become more sensitive legally?", "acceptedAnswer": { "@type": "Answer", "text": "It becomes more sensitive when the tool handles complaints, special-category data, profiling, employee monitoring, or automated decisions that materially affect people." } } ] } ] ```