--- title: "EU AI Act Employee Monitoring in Germany: Not Lawful by Default (2026)" description: "Not lawful by default. Emotion recognition at work is banned since 2 February 2025; other workplace AI needs GDPR, Section 26 BDSG, and works council review." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/ai-employee-monitoring/" language: "en" --- ![EU AI Act employee monitoring Germany compliance guide](https://compound.law/assets/images/compliance/compliance_1.webp) compliance # EU AI Act Employee Monitoring in Germany: Not Lawful by Default (2026) 22 May 2026 Short answer EU AI Act employee monitoring in Germany is not lawful by default. Employers may use narrow, proportionate workplace AI controls under GDPR and Section 26 BDSG, but emotion recognition at work has been prohibited since 2 February 2025, and higher-risk employment AI needs separate deployer, privacy, and works-council governance. - Emotion recognition in workplaces has been prohibited since 2 February 2025. - Vendor compliance does not replace the employer’s own deployer, GDPR, and labor-law duties. - Treat 2026 as the latest preparation point, while tracking the Commission’s 2 December 2027 employment timeline update. **EU AI Act employee monitoring in Germany is not lawful by default.** Employers may use narrow, proportionate workplace AI controls under **GDPR**, **Section 26 BDSG**, and German labor law — but **emotion recognition at work has been prohibited since 2 February 2025**, and any AI that materially supports employment decisions needs separate **deployer**, privacy, and **works council** review before rollout. If your company wants the short answer before procurement, this is it: - **Do not deploy emotion recognition** or pseudo-emotion analytics for stress, honesty, engagement, or motivation at work. - **Do not assume vendor compliance is enough**. The employer remains responsible for the actual workplace use case. - **Classify the tool before rollout**: security log, analytics layer, HR decision support, or biometric monitoring are not the same legal category. - **Run privacy and labor-law review in parallel**: GDPR, **Section 26 BDSG**, retention, access rights, and **Section 87(1) no. 6 BetrVG** should be addressed together. - **Treat 2026 as the latest preparation point**, while tracking the Commission’s May 2026 statement that Annex III employment timelines are set to move to **2 December 2027** under the simplification package. ## August 2026 or December 2027? The Timing Employers Should Track This topic now has a timing wrinkle that many older guides miss. The European Commission’s **AI Act FAQ** still describes **2 August 2026** as the date from which Annex III high-risk obligations and Article 50 transparency duties apply. But the Commission’s main **AI Act policy page**, updated after the **7 May 2026** political agreement on the simplification package, states that rules for high-risk areas including **employment** are set to apply from **2 December 2027**. For employers in Germany, the practical answer is not to wait for the legislative clean-up. The safer approach is: 1. **Treat prohibited practices as already live** from **2 February 2025**. 2. **Build deployer governance now** for any tool that could affect evaluation, scheduling, promotion, discipline, or termination. 3. **Use 2026 as the internal readiness deadline**, even if the final Annex III employment application date settles at **2 December 2027**. This matters because an employer can still create immediate GDPR, labor-law, and reputational risk even before the full employment high-risk regime bites. ## Why “Vendor Compliant” Does Not Solve Employee Monitoring Risk One of the most common mistakes in this area is to outsource the legal analysis to the software vendor. That is not how the risk sits in practice. The vendor may be the **provider** of the AI system, but the employer is usually the **deployer** of the concrete workplace use case. The employer decides: - which teams are monitored - which data points are collected - who can see dashboards, alerts, or rankings - whether outputs influence pay, promotion, discipline, or dismissal - whether the system is rolled out before the works council process is complete That means a vendor’s DPA, security sheet, or AI Act statement does **not** answer the key German-law questions. The employer still needs to assess necessity under **Section 26 BDSG**, transparency under **Articles 13 and 14 GDPR**, possible **Article 22 GDPR** risk, retention limits, internal access controls, and co-determination under **BetrVG**. If a product team or HR team says “the vendor is AI Act compliant”, the right follow-up question is: **compliant for which intended use, and under whose governance model?** ## Which Employee Monitoring Uses Are Prohibited, High-Risk, or Easier to Defend? Not every workplace AI feature belongs in the same bucket. Employers should split them early: | Use case | Practical position | Main concern | | -------------------------------------------------------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------ | | Narrow security logs, fraud alerts, or access-control analytics with short retention | Often defensible with controls | Proportionality, notice, retention, access restrictions | | Productivity analytics, workflow scoring, manager dashboards, or queue-priority tools | Elevated risk | Necessity under Section 26 BDSG, works council rights, hidden HR use | | AI influencing evaluation, scheduling, promotion, discipline, or termination | High scrutiny | Employment high-risk analysis, profiling, human oversight, documentation | | Emotion recognition, biometric mood analysis, honesty scoring, or engagement inference | Usually prohibited or should be avoided | Article 5 AI Act, Article 9 GDPR, severe labor-law risk | | Facial recognition for attendance or persistent identity tracking | Very difficult to justify | Special-category data, DPIA triggers, works council resistance | For adjacent use cases, see our guides on [AI hiring tools](https://compound.law/en-DE/compliance/ai-hiring-tools/), [AI recruitment screening](https://compound.law/en-DE/compliance/ai-recruitment-screening/), and [AI facial recognition](https://compound.law/en-DE/compliance/ai-facial-recognition/). ## The Prohibition Line: Emotion Recognition Is Already Out This is the clearest rule in the current framework. The European Commission lists **emotion recognition in workplaces and education institutions** among the prohibited AI practices, and those prohibitions have applied since **2 February 2025**. For German employers, that means tools that infer stress, motivation, honesty, fatigue, engagement, or “attitude” from voice, facial expressions, typing rhythm, webcam signals, or similar proxies should be treated as off-limits unless a very narrow medical or safety exception genuinely applies. The fact that a vendor markets the feature as “wellbeing”, “engagement intelligence”, or “meeting quality” does not change the legal analysis. If the real effect is to infer employee emotion or psychological state in the workplace, the risk profile is fundamentally different from ordinary security or IT administration. ## GDPR, Section 26 BDSG, and Article 22 Still Drive the Core Analysis Even where a use case is not prohibited, German employers still need a separate **employee-data** analysis. In practice, the core stack is: - **Article 5 GDPR** for purpose limitation, data minimisation, storage limitation, and transparency - **Article 6 GDPR** for a lawful basis - **Section 26 BDSG** for employment-related necessity - **Article 9 GDPR** if biometric or other special-category data is involved - **Article 22 GDPR** where decisions become solely automated and significantly affect employees - **Article 35 GDPR** where a **DPIA** is required Consent is usually a weak primary basis in employment relationships. The more useful question is whether the employer can prove that the tool is **necessary**, **proportionate**, and **narrowly configured** for a legitimate workplace purpose. Before rollout, employers should be able to answer these five questions in writing: 1. What exact business problem is the tool solving? 2. Why is AI needed instead of a less intrusive workflow? 3. Which employee data is processed, and for how long? 4. Will any output influence evaluation, task allocation, HR action, or dismissal? 5. What human review and escalation path exists when the tool is wrong, biased, or overbroad? If those answers are vague, the project is not ready. ## Works Council Sequencing Matters Before Procurement, Not After In Germany, many AI monitoring projects fail because the legal team gets involved too late. **Section 87(1) no. 6 BetrVG** gives the works council co-determination rights for technical systems intended to monitor employee behaviour or performance, and that threshold is broad. This can catch more than obvious surveillance software. Manager dashboards, productivity scores, insider-risk alerts, QA scoring, activity logs, and AI-driven workforce analytics can all trigger the rule if they can be used to assess behaviour or performance. The sequencing point is critical: - **do not sign the vendor before the use case is narrowed** - **do not start a pilot before the co-determination path is mapped** - **do not promise managers access to granular outputs before a works agreement exists** The same issue appears in adjacent tooling categories. For example, [enterprise search and GDPR](https://compound.law/en-DE/compliance/enterprise-search-dsgvo/) reviews can trigger similar employee-monitoring concerns where internal search layers expose query logs, document access patterns, or message snippets tied to named employees. A workable **works agreement** for AI monitoring normally covers: - the exact purpose of the tool - the employee groups affected - data categories collected and excluded - manager, HR, compliance, and vendor access rights - retention and deletion rules - whether outputs may be used for disciplinary measures - human review and escalation rules - audit, testing, and change-management obligations ## Do Private Employers Need an AI Act Fundamental Rights Assessment? Not automatically. This point is often overstated in secondary commentary. The Commission’s AI Act Service Desk explains **Article 27** as requiring a **fundamental rights impact assessment** before deployment for **public bodies**, **private entities providing public services**, and certain Annex III cases outside the ordinary private-employer scenario. That means many private employers will focus first on: - classification of the system - deployer instructions and human oversight - provider documentation and intended-use limits - GDPR documentation and any **DPIA** - works council process and internal policy controls That said, if your company uses a tool in a way that substantially affects employee rights, a structured rights-impact analysis is still sensible even where Article 27 is not the formal trigger. ## Practical Rollout Checklist for German Employers Before any AI employee monitoring rollout in Germany, employers should usually work through this order: 1. **Map the use case precisely.** Separate IT security, workflow analytics, HR decision support, and biometrics. 2. **Eliminate prohibited features first.** Remove emotion recognition, pseudo-psychological scoring, and similar workplace inference features. 3. **Classify the legal risk.** Review GDPR, Section 26 BDSG, Article 22, works council rights, and possible AI Act employment exposure together. 4. **Lock down the vendor model.** Confirm hosting, subprocessors, retention, training exclusions, audit logging, and intended-use limitations. 5. **Prepare the documentation pack.** Update privacy notices, records of processing, retention schedules, internal access rules, and DPIA materials where needed. 6. **Involve the works council early.** If a works council exists, align on the use case before pilot rollout. 7. **Restrict manager use.** Do not let experimental scores quietly shape disciplinary, pay, or promotion outcomes. 8. **Train internal users.** AI literacy obligations have applied since **2 February 2025**, so HR, IT, compliance, and managers should understand both the tool and its limits. For the broader deadline picture, see [EU AI Act August 2026 deadline checklist](https://compound.law/en-DE/compliance/eu-ai-act-august-2026-deadline-checklist/) and our [AI scheduling optimization guide](https://compound.law/en-DE/compliance/ai-scheduling-optimization/). ## FAQ ### Can employers use AI to monitor employees in Germany? Yes, but only in limited and proportionate scenarios. Employers need a lawful basis, a necessity analysis, transparency, and usually works council involvement if the system can monitor behaviour or performance. ### Does vendor compliance replace employer compliance? No. The vendor may support compliance with documentation and controls, but the employer remains responsible for the concrete deployment, including purpose limitation, retention, manager access, and HR use of outputs. ### Is emotion recognition at work allowed? No, except for narrow medical or safety exceptions. The European Commission treats emotion recognition in workplaces as a prohibited AI practice from **2 February 2025**. ### Is AI employee monitoring always high-risk under the EU AI Act? No. Narrow logging or access control is not automatically high-risk. The closer the system gets to evaluation, scheduling, promotion, discipline, or termination decisions, the higher the AI Act and employment-law exposure becomes. ### Do private employers always need an AI Act fundamental rights assessment? No. Article 27 is not a blanket requirement for every private employer. But many private employers will still need a DPIA, a structured rights analysis, and robust internal governance before rollout. ### Does a works council need to approve AI monitoring tools? In many cases, yes. **Section 87(1) no. 6 BetrVG** is broad enough to catch many technical systems that can be used to monitor employee behaviour or performance, even when they are marketed as analytics or productivity tools. ## Talk to Compound Law If your company is evaluating productivity analytics, insider-risk tooling, AI scheduling, HR dashboards, or biometric workplace controls, the real legal question is not whether the software has an AI label. It is whether the deployment is defensible under **GDPR**, **Section 26 BDSG**, **BetrVG**, and the evolving **EU AI Act** timeline. Compound Law advises employers, founders, and legal teams on **EU AI Act employee monitoring in Germany**, including vendor review, DPIAs, works agreements, and rollout governance. For a project-specific assessment, [contact our team](https://compound.law/en-DE/#booking). This page provides general information only and is not legal advice for a specific situation. ## Related Compliance Guides [![EU AI Act training obligation and Article 4 AI literacy in Germany](https://compound.law/assets/images/compliance/compliance_2.webp)](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [compliance](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) ### [EU AI Act Training Obligation: What Article 4 Requires](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [EU AI Act training obligation under Article 4: who it covers in Germany, what AI literacy measures to implement, and how to document compliance.](https://compound.law/en-DE/compliance/ai-act-schulungspflicht/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions Yes, but only in limited and proportionate scenarios. Employers need a valid legal basis, a necessity assessment, transparency, and usually works council involvement if the system monitors behaviour or performance. No. A vendor can support compliance with documentation and technical controls, but the employer still decides the purpose, data scope, retention, manager access, and whether outputs influence employment decisions. That makes the employer responsible for GDPR, Section 26 BDSG, and works council governance in its own deployment. No, except for narrow medical or safety exceptions. The European Commission lists emotion recognition in workplaces among the prohibited AI practices that have applied since 2 February 2025. No. Narrow security logging or access control is not automatically high-risk. The risk increases sharply when AI materially supports recruitment, evaluation, promotion, task allocation, discipline, or termination decisions in the employment context. Often when the system involves systematic monitoring, profiling, biometric data, or a high risk to employee rights and freedoms. For many workplace AI tools, a data protection impact assessment should be considered before rollout rather than after procurement. In many cases, yes. Section 87(1) no. 6 BetrVG gives the works council co-determination rights where a technical system is intended to monitor employee behaviour or performance, including many analytics, HR, and productivity tools. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "EU AI Act Employee Monitoring in Germany: Not Lawful by Default (2026)", "description": "Not lawful by default. Emotion recognition at work is banned since 2 February 2025; other workplace AI needs GDPR, Section 26 BDSG, and works council review.", "image": "https://compound.law/assets/images/compliance/compliance_1.webp", "datePublished": "2026-05-22T00:00:00.000Z", "dateModified": "2026-05-22T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/ai-employee-monitoring/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "EU AI Act Employee Monitoring in Germany: Not Lawful by Default", "item": "https://compound.law/en-DE/compliance/ai-employee-monitoring/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Can employers use AI to monitor employees in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, but only in limited and proportionate scenarios. Employers need a valid legal basis, a necessity assessment, transparency, and usually works council involvement if the system monitors behaviour or performance." } }, { "@type": "Question", "name": "Does vendor compliance replace employer compliance?", "acceptedAnswer": { "@type": "Answer", "text": "No. A vendor can support compliance with documentation and technical controls, but the employer still decides the purpose, data scope, retention, manager access, and whether outputs influence employment decisions. That makes the employer responsible for GDPR, Section 26 BDSG, and works council governance in its own deployment." } }, { "@type": "Question", "name": "Is emotion recognition at work allowed?", "acceptedAnswer": { "@type": "Answer", "text": "No, except for narrow medical or safety exceptions. The European Commission lists emotion recognition in workplaces among the prohibited AI practices that have applied since 2 February 2025." } }, { "@type": "Question", "name": "Is AI employee monitoring always high-risk under the EU AI Act?", "acceptedAnswer": { "@type": "Answer", "text": "No. Narrow security logging or access control is not automatically high-risk. The risk increases sharply when AI materially supports recruitment, evaluation, promotion, task allocation, discipline, or termination decisions in the employment context." } }, { "@type": "Question", "name": "When is a DPIA required for workplace AI?", "acceptedAnswer": { "@type": "Answer", "text": "Often when the system involves systematic monitoring, profiling, biometric data, or a high risk to employee rights and freedoms. For many workplace AI tools, a data protection impact assessment should be considered before rollout rather than after procurement." } }, { "@type": "Question", "name": "Does a works council need to approve AI monitoring tools?", "acceptedAnswer": { "@type": "Answer", "text": "In many cases, yes. Section 87(1) no. 6 BetrVG gives the works council co-determination rights where a technical system is intended to monitor employee behaviour or performance, including many analytics, HR, and productivity tools." } } ] } ] ```