Lawyer for AI law – AI Act, contracts & liability
For companies that use or offer AI systems – on the AI Act, AI contracts and liability.
Using AI, developing products, clarifying responsibility
ITMR Rechtsanwälte advises companies throughout Germany on AI law, i.e. on all legal questions relating to the use and offering of artificial intelligence. From our offices in Düsseldorf and Hamburg, we support the introduction of AI tools, the implementation of the AI Act and the legal safeguarding of AI products, contracts and content.
Would you like to approve an AI tool within your company, bring an AI feature to market or provide customers with robust compliance evidence? We clarify roles, obligations and risks and translate the results into usable documents: for example an obligations matrix, an AI policy, a revised contract or a labelling concept.
The team includes Fachanwälte für IT-Recht (certified specialist lawyers for IT law), certified AI officers (KI-Beauftragte, DEKRA) and an AI privacy expert (GDDcert. EU). We connect the AI Regulation with data protection, copyright, media law and practical implementation within the company.
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)
Your contact: Jean Paul P. Bohne
Fachanwalt für IT-Recht · AI officer (KI-Beauftragter, DEKRA)
What happens after your enquiry?
After your enquiry, we will get back to you within 24 hours on working days. The first contact is free of charge. Before any costs are incurred, we will tell you so explicitly.
- A short description is enough. Helpful are a short description of the system and its use, details of the provider and the data flows, and any existing contracts or policies. Please also state the desired date, such as rollout or launch.
- Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
- Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.
- Fachanwälte für IT-Recht (certified specialist lawyers for IT law) with experience from our own software programming
- Certified AI officers (KI-Beauftragte, DEKRA) and AI privacy expert (GDDcert. EU)
- Advice for companies, start-ups, agencies and professional market participants
- AI Regulation, contracts, data protection and IP rights reviewed together
When companies need legal support for AI
The occasion is usually specific: a team wants to use a tool, a contract is ready for signature or an AI feature is to be released. We start from this decision and clarify which review it requires.
Introducing ChatGPT, copilots and other AI tools in the company
Employees want to create texts, write code, evaluate documents or handle customer enquiries. In particular, permitted inputs, confidential information, personal data and the control of results must be clarified.
The AI tool review with usage rules and approval recommendation creates a basis for the rollout. Background information can be found in the article ChatGPT and AI in companies (in German).
Buying external AI solutions or integrating them into your own systems
You obtain AI via software as a service (SaaS), an application programming interface (API), a software development kit (SDK) or a white-label offering. Scope of services, data use, model changes, liability and exit must then be reviewed together.
Depending on the focus, the SaaS contract review and the DPA review for AI service providers are a good fit. Added to this is the classification of your role under the AI Act.
Bringing an AI product or a new AI feature to market
Before pilot, launch or distribution, classification, transparency, contract documents and performance promises must match the actual product. A legal launch review shows which points need to be clarified before the start and which risks remain.
For regulated products, we additionally review the safety function of the AI and the applicability of the product-related high-risk rules from 2 August 2028. Relief due to equivalent sectoral requirements does not apply automatically but requires a corresponding delegated act.
Publishing AI images, voices, texts and music
In advertising, media productions and automated communication, labelling, rights of use, personality rights and advertising claims must fit together. The AI Act transparency review clarifies the disclosure obligations. The review of AI content and rights concerns whether the use is permissible.
Practical examples (in German): AI images and AI logos, voice misuse through AI and AI music and GEMA conflicts. From 2 December 2026, new prohibitions also apply to certain AI systems for generating or manipulating non-consensual intimate content and child sexual abuse material.
Procurement, integration, configuration, marketing and operational use can also trigger obligations and liability risks of your own. In the event of modifications, a new intended purpose or marketing under your own name, you may also become a provider. That is why the role review belongs before approval.
In brief
Four occasions usually bring clients to us: internal use of AI tools, procurement and integration of external AI, a product launch of your own and the publication of AI content. Even those who only purchase or integrate can have obligations of their own.
Typical cases from our AI advisory practice
We regularly encounter the following constellations in our advisory work. They are abstracted and simplified; each review depends on the specific system, contract and use.
Software providerIntegrating an AI feature into your own product
- Starting point
- A software provider builds an AI feature based on a general-purpose AI model into its application and wants to offer it to business customers.
- Key difficulty
- Integration and distribution under its own name can give rise to provider obligations of its own. At the same time, business customers demand robust statements on data use, transparency and responsibilities.
- Our work
- We review the allocation of roles in the supply chain, the model and API terms, the regulatory classification of the feature as well as customer contracts, performance promises and data protection documents before the launch.
- Work result
- Legal risk matrix with priorities, adapted customer contract and terms of use, transparency notices and a basis for the internal decision on launch, modification or postponement.
Simplified example.
CommunicationUsing AI-generated content in a campaign
- Starting point
- A marketing department or agency wants to use AI-generated images and a synthetic voice in an advertising campaign.
- Key difficulty
- It must be clarified whether and how the content has to be labelled, which rights of use the tool terms actually grant and whether personality rights or third-party rights are affected.
- Our work
- We review origin and tool terms, human contributions, third-party rights and advertising claims as well as the labelling obligations under Article 50 AI Act and the responsibilities in the agency contract.
- Work result
- Assessment of the intended use with restrictions or need for adjustment, a labelling concept with placement and timing and, where required, revised licence, consent and indemnity clauses.
Simplified example.
Work sample
Introducing an AI tool for customer service
A medium-sized company wants to use an AI assistant in customer service. The tool is obtained as SaaS and is to be used to answer or prepare customer enquiries. The real difficulty: it is unclear what role the company assumes under the AI Act, whether customers must be informed about the AI interaction and whether the provider's terms allow the inputs to be used for the provider's own purposes. We classify the system and role under the AI Act, review the transparency obligations under Article 50, the data processing under the GDPR including the data processing agreement (AVV) and data transfers, as well as the SaaS contract with its performance limits, data use and liability. Result of our work: an obligations matrix with responsibilities, a documented approval recommendation with conditions, a notice text for the chat interface and prioritised points for amending the provider contract.
The scenario is anonymised and simplified; it describes how we work, not the outcome of any specific proceedings.
What is typical is not a single legal question but the interplay of the AI Act, data protection, contract and IP rights. The result is always a working document for the decision within the company – not a promise of a particular outcome.
How we support you in your AI project
A legal assessment must help the company move forward. We therefore align our advice with the upcoming decision: approving a tool, concluding a contract, launching a product or answering a customer audit. We determine which documents we review, prepare or revise to suit the mandate.
The results you receive from AI adviceServices, results and next steps at a glance – open a row for the scope, review points and the complete work result of each service.
AI ActAI inventory, role review and obligations matrix
Concrete result: Obligations matrix and prioritised implementation plan
Clarifying and implementing obligations – implementing the AI Act: You need to know which AI systems are affected and what your company must do about them.
Result: AI inventory, role and risk classification and a prioritised obligations matrix.
We record the relevant AI uses, classify company roles and risks and determine the resulting measures. For SMEs and small mid-cap companies, we take the relevant simplifications and support arrangements into account.
Your work result: a documented classification and a prioritised implementation plan with responsibilities, deadlines and required evidence.
AI Act implementation in detail
Next step: AI Act implementation in detail
Tool review and governanceReviewing AI tools, setting up an AI policy and approvals
Concrete result: Review memo with approval recommendation, on request with AI policy
Procuring tools and using them internally – reviewing AI tools and regulating their use: an AI assistant, chatbot or coding tool is to be used in teams. Data, contracts and internal rules must fit together.
Result: documented approval recommendation, usage rules and, where required, an AI policy.
We review the intended use together with the provider terms, data flows, confidentiality and output control. For internal use, we define who may use which tools with which data and when queries, human review or escalation are required.
Your work result: a review memo with an approval recommendation or need for changes and – depending on the assignment – an AI usage policy, an approval process and clear responsibilities.
Request an AI tool review and policy
Next step: Request an AI tool review and policy
ContractsReviewing, drafting and negotiating AI contracts
Concrete result: Annotated contract version with negotiation points
Procurement, development and distribution – reviewing and drafting AI contracts: You purchase AI services, integrate a model or offer an AI feature yourself.
Result: reviewed or drafted contracts, concrete proposed amendments and negotiation priorities.
We handle SaaS, API, licence, development and integration contracts. The focus is on performance limits, rights to data and results, model changes, support, audit, indemnities, liability and exit. In relevant high-risk supply chains, we include the information and agreement obligations under Article 25 AI Act.
Your work result: a draft contract or an annotated version with concrete clause amendments and prioritised negotiation points.
Continue directly to the SaaS contract review, the software development contract or the classification under IT contract / software contract.
Next step: SaaS contract review · Software development contract · IT contract / software contract
AI and data protectionReviewing data processing, preparing the DPA (AVV) and DPIA (DSFA)
Concrete result: Data protection assessment, where required with DPIA
We clarify legal bases, purposes, data categories, provider roles, storage locations and access. Depending on the project, this includes data processing agreements, international data transfers and the question of whether a data protection impact assessment is required.
Your work result: a documented data protection assessment, required contract amendments and, if commissioned accordingly, a DPIA (DSFA) with risks, safeguards and a decision paper.
In depth: review the DPA for AI service providers, data protection impact assessment and data protection audit for existing processes.
Next step: Review the DPA for AI service providers · Data protection impact assessment · Data protection audit for existing processes
Product and market launchLegally preparing an AI product launch
Concrete result: Risk matrix as a basis for the launch decision
Before pilot, release or distribution, we review the interplay of product function, regulatory classification, contracts, data protection, IP rights and advertising claims. This shows which open points affect the launch.
Your work result: a legal risk matrix with priorities, need for adjustment and a basis for the internal decision on launch, modification or postponement.
To the legal risk assessment. For customer contracts and terms of use, we prepare or review suitable general terms and conditions (AGB) where required.
Next step: Legal risk assessment · Suitable general terms and conditions (AGB)
Content and IP rightsReviewing AI content, training material and rights of use
Concrete result: Usage assessment with need for adjustment
We review the planned use of images, voices, texts, music, logos as well as training and reference material. Decisive factors are origin, tool terms, human contributions, third-party rights and the intended publication or exploitation.
Your work result: an assessment of the intended use with restrictions or need for adjustment and, where applicable, revised licence and consent texts.
In depth: copyright in AI content, licence agreements and rights clearance and review of advertising claims.
Next step: Copyright in AI content · Licence agreements and rights clearance · Review of advertising claims
Transparency and labellingAI Act transparency review for chatbots and AI content
Concrete result: Assessment of labelling obligations and labelling concept
Chatbots, deepfakes and AI content – AI Act transparency review: You want to clarify which notices or labels your system and the published content require.
Result: assessment of the labelling obligations and a concept for notices, responsibilities and evidence.
A chatbot talks to customers, an avatar guides users through an offer or a campaign uses AI-generated images and voices: we review whether and how the use of AI must be disclosed. In doing so, we distinguish the provider's obligations from those of the company that uses the system or the content. We have compiled typical use cases from the internal copilot to the customer chatbot, each with its review points, in the AI use case gallery.
What we review
- System, use case and role of your company
- Applicable obligations and exceptions under Article 50 AI Act
- Initial information for chatbots, avatars and voice assistants
- Disclosure of deepfakes and certain AI-generated texts
- Legal requirements for machine-readable marking, where applicable
- Responsibilities in provider, agency and distribution contracts
What you can implement with it
- A documented assessment for each use case reviewed
- A labelling concept with reviewed notices and rules on placement and timing
- A list of required product and process adjustments
- Approval rules and traceable documentation
- Where required: labelling and indemnity clauses
Decisive: A visible label and a machine-readable marking serve different functions. Likewise, an AI notice does not yet answer whether an image, voice, source material or advertising claim may be used.
Training and ongoing supportAI literacy and ongoing use
Concrete result: Training with documented content and attendance, ongoing support
We supplement policies and approvals with training on the tools, data and tasks actually in use. This is complemented by AI and data protection training with documented content and attendance. We can support recurring reviews and coordination through an outsourced legal department.
Disputes and defenceConflicts, claims and defence
Concrete result: Statement, out-of-court demand or representation in court
In the case of warning letters (Abmahnungen), infringements, contractual disputes or questions from authorities, we review the claims situation, evidence, deadlines and response options. Depending on the mandate, the result is a statement, an out-of-court demand or representation in court. We deal with data protection conflicts in more depth under privacy litigation.
The scope of review and the specific documents depend on your project and are agreed at the start of the mandate. If the direction is still open, an initial consultation on your AI project helps.
Your contacts for AI law at ITMR
AI mandates often combine IT law, data protection, contracts and IP rights. At ITMR, we lead each mandate according to its focus and handle it as a team where required. We advise clients throughout Germany from Düsseldorf (head office) and Hamburg.
Jean Paul P. Bohne, LL.M., MM is a partner, Fachanwalt für Informationstechnologierecht (certified specialist lawyer for IT law) and Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law) as well as a certified AI officer (KI-Beauftragter, DEKRA). He advises in particular at the interfaces of AI, media, platforms, IP rights and disputes. Dr. Alexander Pleh is a partner, Fachanwalt für Informationstechnologierecht, certified AI officer (KI-Beauftragter, DEKRA) and external data protection officer. He works on AI law, software contracts, data protection, cybersecurity and open source. Timocin Can is a lawyer whose areas of practice include IT law, AI law and e-commerce. He supports digital business models, contract and usage terms as well as disputes involving platforms and online matters. Dominik Skornia, LL.B. is a lawyer, AI privacy expert (GDDcert. EU) and external data protection officer. He connects AI law with data protection, data law and IT contract law. He supports data protection processes, training and contentious data protection issues.
- An AI tool is to be approved while data use and usage rules are still open.
- An AI contract is ready for signature or a provider changes models, terms or features.
- An AI feature is about to go into pilot, launch or a major customer deal.
- Customers, investors or auditors request documents on roles, governance and controls.
- AI content is to be published and rights or labelling are unclear.
How we proceed in an AI mandate
Capture the system
Describe function, intended purpose, data flows and technical architecture. This results in a clearly defined subject of review.
Determine the role
Provider, deployer, importer, distributor, authorised representative or product manufacturer: integration and procurement processes are assigned to their statutory role.
Assess risks
Review prohibitions, transparency obligations, high-risk and GPAI relevance and document the classification with its assumptions.
Define measures
Translate obligations into responsibilities, deadlines, contracts, approvals and evidence.
AI Regulation: classifying system, role and obligations
The AI Act, as amended by Regulation (EU) 2026/1744, is linked to specific systems, models and roles. What matters is whether there is an AI system or a general-purpose AI model (GPAI model), how it is used and what responsibility your company assumes in the supply chain.
You need operational AI Act implementation
If classification, obligations matrix, governance, fundamental rights impact assessment or implementation documentation are the focus, the direct route leads to implementing the AI Act / AI Regulation.
Legal status: 23.10.2026. Reviewed on 23.10.2026. The deadline structure shown takes into account Regulation (EU) 2026/1744 (opens in a new tab), which has amended the AI Act since 27 July 2026. Application remains staggered. For the specific review, timing, system and company role are what count. Further information is provided in the article Digital Omnibus on AI (in German).
In brief
Which obligations apply depends on the system or model, your company's role and the point in time. The AI Act initial check narrows down the need for review; the legal assessment clarifies the specific system.
Key terms of the AI Act
- AI system
- Machine-based system designed to operate with varying levels of autonomy that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions (Article 3(1) AI Act).
- Provider
- Anyone who develops an AI system or a general-purpose AI model, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3) AI Act).
- Deployer
- Anyone who uses an AI system under its own authority, except where it is used in the course of a personal, non-professional activity (Article 3(4) AI Act).
- General-purpose AI model (GPAI)
- AI model that displays significant generality and is capable of competently performing a wide range of distinct tasks; it can be integrated into downstream systems (Article 3(63) AI Act).
- High-risk AI system
- AI system classified as high-risk under Article 6 AI Act – as a safety component or product under Annex I or as a use case under Annex III.
- AI literacy
- Skills, knowledge and understanding that allow an informed deployment of AI systems and an awareness of their opportunities and risks (Article 3(56), Article 4 AI Act).
Summary of the definitions; the wording of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 is authoritative.
The AI Act after the Digital Omnibus: what applies when?
- AI Act enters into force
- Prohibitions and first basic obligations
- GPAI and governance
- Digital Omnibus in force
- Transparency and further obligations
- New prohibitions and transitional period
- GPAI transitional period, AI regulatory sandboxes
- High-risk under Annex III
- High-risk product-related (Annex I)
- Transition for high-risk systems of public authorities
| Date | Obligation | Article | Status |
|---|---|---|---|
| AI Act enters into force. The AI Regulation formally entered into force. This marked the beginning of the European legal framework for AI, even though the obligations did not all become applicable at the same time. | Reg. (EU) 2024/1689, Art. 113 | in force | |
| Prohibitions and first basic obligations. Since this date, key prohibitions, basic rules and the AI literacy obligation have applied. Since 27 July 2026, providers and deployers must support appropriate measures for developing literacy. They do not have to guarantee a specific level of literacy for each individual person. | Art. 4, Art. 5 | applies since 2 February 2025 | |
| GPAI and governance. The governance rules and the obligations for general-purpose AI apply. This is particularly relevant for providers, integrators and companies that build on general-purpose AI models. | Chapter V (Art. 51 et seq.), Chapter VII | applies since 2 August 2025 | |
| Digital Omnibus in force. Regulation (EU) 2026/1744 amends the AI Act. Of particular short-term relevance are the new standard for AI literacy, Article 4a on bias detection and correction and the brought-forward application of Articles 102 to 110. | Reg. (EU) 2026/1744; Art. 4, Art. 4a, Art. 102–110 | applies since 27 July 2026 | |
| Transparency and further obligations. Since this date, in particular the transparency obligations for certain AI systems and the remaining provisions not brought forward or postponed have applied. Sections 1 to 3 of the high-risk chapter – with the exception of Article 6(5) – do not yet apply at this point. | Art. 50; Art. 6(5) | applies since 2 August 2026 | |
| New prohibitions and transitional period. The new prohibitions apply to certain AI systems for generating or manipulating non-consensual intimate content and child sexual abuse material. Providers of systems for generating synthetic content placed on the market before 2 August 2026 must also comply with Article 50(2) from this date. | Art. 5 (new), Art. 50(2) | from 2 December 2026 | |
| Transitional period for certain GPAI models placed on the market before August 2025. National AI regulatory sandboxes must be operational. | Art. 111(3), Art. 57 | from 2 August 2027 | |
| Sections 1 to 3 of the high-risk chapter apply to systems under Article 6(2) and Annex III. | Art. 6(2), Annex III | from 2 December 2027 | |
| These high-risk rules apply to product-related systems under Article 6(1) and Annex I. | Art. 6(1), Annex I | from 2 August 2028 | |
| For certain high-risk systems intended for use by public authorities that have already been placed on the market or put into service, the transitional rule of Article 111(2) applies. | Art. 111(2) | from 2 August 2030 |
What companies should take from this
- determine the obligations already applicable for each AI use
- assign roles in the supply chain properly
- define the obligations matrix, responsible persons and evidence
- consider contracts, transparency and governance together
- align procurement, launch and operation with the same timetable
The obligations of the AI Act apply in stages. The Digital Omnibus mainly postpones Sections 1 to 3 of the high-risk chapter, not the AI Act as a whole. For the legal assessment, the point in time, the company's role and the classification of the respective system or model therefore count together.
In brief
Prohibitions, AI literacy, GPAI obligations and transparency obligations already apply. The Digital Omnibus mainly postpones the high-risk rules: to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Which questions should be clarified first in AI mandates
Whether an AI project is legally sound usually becomes apparent at the outset. That is when it becomes clear whether a project is built in a manageable way or whether it will later fail because of roles, evidence and responsibilities.
Is there a legally relevant AI system at all?
Not every automated tool automatically falls under the AI Regulation. Decisive factors are function, inference logic, intended purpose and the way the system is used or marketed within the company. AI integrated into a regulated product is not a safety component for that reason alone either. What matters in particular is its intended safety function and the consequences of a failure or malfunction.
What role does your company play in the supply chain?
Providers, deployers, importers, distributors, authorised representatives and product manufacturers do not bear the same obligations. "Integrator" and "procurer", on the other hand, describe practical functions from which, depending on the set-up, a statutory role or even provider status may result. In white-label, software-as-a-service or application programming interface constellations in particular, the classification is often not self-explanatory.
Which data, content and third-party rights are involved?
Training data, reference material, inputs, outputs and interfaces can raise data protection, copyright, trademark or trade secret issues. This also applies if the actual model comes from a third-party provider.
Which statements will you have to be able to prove later?
At the latest in customer audits, audits, financing rounds or enquiries from authorities, role decisions, approvals and controls must be traceable. We clarify which documents are missing for this and which information you need contractually from the supply chain.
The review is intended to clarify whether an AI use is legally justifiable, which conditions apply to it and what must be done before the next step. Depending on the occasion, we record this in a risk assessment, an obligations matrix or a documented approval recommendation.
Which other legal issues run alongside the AI project
Which additional review makes sense depends on data, product and use. We bring the relevant topics together and define the assignment so that you can make the decision you need in each case.
Data protection and data use
Personal data in training, inputs, retrieval, monitoring or outputs leads to data protection law. Data access, data licences, sharing and cloud switching additionally concern data law. Article 4a AI Act permits the use of special categories of data for bias detection and correction only within its narrow conditions and safeguards.
Copyright, trademark and communication
With published AI content, copyright law, trademark law, personality rights and advertising law frequently interlock. For campaigns and media productions, we align rights, labelling and approvals with the intended channels and uses.
Software, models and open source
Openly available models, libraries and third-party components can have different licence terms. We review the terms in the specific usage and distribution model. For software components, open source law and the open source compliance audit lead to licence obligations, evidence and required adjustments.
Liability and security
Wrong decisions, security defects and inaccurate performance promises can raise liability issues. We combine the contract review with product liability law and, where necessary, cybersecurity. Whether an AI is a safety component depends in particular on its intended safety function and the consequences of a failure.
We include the Data Act, NIS2, DSA or other regulations where the specific AI project offers points of contact for them. If it is initially unclear which sets of rules apply at all, the EU Digital Acts Audit helps with delimitation and prioritisation.
Alongside the AI Act, data protection, copyright and trademark law, open source licences and liability usually also come into play. We define the assignment so that you can make the decision you need.
Frequently asked questions on AI law, tool review and the AI Act
The answers help you choose the right starting point. Which obligations and documents your company actually needs depends on the specific system, its use and your role.
What does AI law cover within a company?
AI law covers the legal classification, implementation and safeguarding of AI systems. This includes the AI Act and, depending on the project, data protection, contracts, copyright, trademark law, advertising law and liability. At ITMR, we bring these questions together for the specific use – for example for internal AI tools, products of your own, the procurement of AI services or the publication of AI content.
Which specific documents do we receive from AI advice?
Depending on the agreed assignment, you receive, for example, an AI inventory with role and risk classification, an obligations matrix, an AI policy, a documented approval recommendation, revised contracts or a labelling concept. For data protection and launch questions, a DPIA (DSFA) or a legal risk matrix may be added. At ITMR, we determine before starting work which review and which results your project needs.
May employees use ChatGPT and other AI tools for work?
A blanket approval for every use does not make sense. Decisive factors are the specific tool, plan and configuration, the purpose of use, the data entered and the provider's terms. In particular, personal data, trade secrets, possible use for training and the control of results must be reviewed. An AI tool review at ITMR can create the basis for determining which use is approved internally under which conditions.
Is an AI policy enough to comply with the AI Act?
A policy is an important building block. However, it does not replace the classification of the systems used, the role review or the implementation of the relevant obligations. Depending on the use, contract review, data protection assessment, tool approval, AI literacy measures and controls are also part of it. At ITMR, we combine these tasks into effective AI governance with responsibilities and traceable evidence.
When does the AI Regulation affect my company?
The AI Act may be relevant if your company offers, integrates, markets or operates AI systems. Which obligations apply is determined in particular by role, intended purpose and product context. Not every automated software feature is an AI system, and not every AI system is high-risk. At ITMR, we start with a system and role review. This determines the specific scope of the AI Act implementation.
Do we have to label all AI-generated content?
Article 50 AI Act does not contain a blanket labelling obligation for every use of AI. It distinguishes between different systems, content, roles and exceptions. Notices when interacting with AI, machine-readable markings and the disclosure of certain published content must be reviewed separately. ITMR's AI Act transparency review clarifies which obligations affect your use case and how the required notices can be implemented.
Is our case more a matter of data protection law or AI law?
Often it concerns both. Personal data in training, inputs, outputs, monitoring or profiling raise data protection issues. Classification, transparency, human oversight and supply chain obligations may fall under the AI Act at the same time. At ITMR, we coordinate the reviews with each other. Depending on the focus, we go into more depth on data processing on behalf (Auftragsverarbeitung), a data protection impact assessment or regulatory implementation.
Who owns AI outputs and may we use them commercially?
A tool's terms of use do not answer every question about a result. Human creative contributions, contractual rights of use and possible third-party rights, for example to reference material, images, voices or trademarks, must be reviewed. Even contractually permitted use does not rule out such conflicts. For commercial use, we at ITMR therefore review the specific content, how it was created and the planned exploitation channels.
Who is liable if an AI system causes errors?
Liability does not automatically fall only on the model provider. Role, product context, contractual situation, organisational duties and the specific damage are relevant. In corporate projects, performance limits, human control, warnings, indemnities and evidence must therefore also be considered. The legal review by ITMR is intended to show which risks can be allocated contractually and which can be reduced through processes or changes to the use.
When are a fundamental rights impact assessment and a data protection impact assessment required?
The fundamental rights impact assessment concerns the deployers and high-risk uses covered by Article 27 AI Act. The start of application follows the relevant high-risk deadlines. A DPIA (DSFA) under Article 35 GDPR must be reviewed independently of this if the processing is likely to result in a high risk to the rights and freedoms of natural persons. Where requirements are already met by a DPIA, relevant sections can be referenced or adopted in the fundamental rights impact assessment. At ITMR, we coordinate both assessments with each other.
The legal classification is based on the AI Regulation and its amendments. The European Commission, the Bundesnetzagentur (German Federal Network Agency) and the AI Act Service Desk offer additional guidance on its application.
What decision is pending in your AI project?
Approving a tool, signing an AI contract, clarifying labelling or launching a product: tell us about the next step. We clarify which legal review makes sense for it and which results you need.
To get started, a short description of the system and its use, details of the provider and the data flows, and any existing contracts or policies are helpful. Please also state the desired decision date and any open questions from customers, procurement, data protection or management.
AI Act and internal use
For roles, classification and obligations matrix, choose implementing the AI Act. If it concerns a specific tool and internal rules, you will find the right scope under AI tool review and governance.
Contracts, content and publication
Continue directly to the AI contract review, the AI Act transparency review or the review of AI content and rights of use. We support an upcoming market launch with a legal launch review.
ITMR Rechtsanwälte PartGmbB · Düsseldorf & Hamburg · AI legal advice for companies throughout Germany.
Responsible lawyers for AI law at ITMR
Jean Paul P. Bohne, LL.M., MM
Rechtsanwalt (attorney) | Partner | Business mediator
- Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law)
- Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
- AI Officer | KI-Beauftragter [DEKRA]
- Certified Information Privacy Professional/Europe [CIPP/E]
- Cert. Information Privacy Manager [CIPM]
- External data protection officer [TÜV]
- Data protection officer [TÜV]
- Data protection auditor [TÜV]
- IT compliance manager [TÜV]
AI law expert at ITMR
T: +49 211 737547-70
E: bohne@itmr-legal.de
Dr. Alexander Pleh
Rechtsanwalt (attorney) | Partner
- Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
- AI Officer | KI-Beauftragter [DEKRA]
- External data protection officer
AI law expert at ITMR
T: +49 211 737547-70
E: pleh@itmr-legal.de
Timocin Can
Rechtsanwalt (attorney) | employed
AI law expert at ITMR
T: +49 211 737547-70
E: can@itmr-legal.de
Anna Gerzer, LL.M. [Tulane]
Rechtsanwältin (attorney) | employed
AI law expert at ITMR
T: +49 211 737547-70
E: gerzer@itmr-legal.de
Dominik Skornia, LL.B.
Rechtsanwalt (attorney) | employed
- AI-Privacy-Expert (GDDcert. EU)
AI law expert at ITMR
T: +49 211 737547-70
E: skornia@itmr-legal.de