#
Art 22 GDPR framework is in force and actively enforced/litigated (green core), but AI-specific risk-assessment rules, biometric-specific statute, and genetic-data-specific statute are all absent or still in guidance/proposal stage, and state-surveillance oversight architecture is itself subject to unresolved reform proposals.
Sub-modules (6)
Profiling RestrictionsGreen
Art 22 GDPR restricts solely-automated, significant-effect decisions including profiling.
Claims (1):
- GDPR Article 22 restricts solely-automated decisions with legal or similarly significant effect, including profiling; CJEU litigation (Case C-484/24, continuing the SCHUFA line) tests whether a scoring controller's own process itself constitutes such a decision even where a third party formally decides. Also directly informs the automated_decision_making_transparency sub-module (same underlying CJEU litigation); precise holding of C-484/24 not independently confirmed this pass — see gaps_register.
Automated Decision Making TransparencyAmber
CJEU litigation (SCHUFA line) tests whether a scoring controller's process itself constitutes an Art 22 'decision' even where a third party formally decides.
Claims (1):
- GDPR Article 22 restricts solely-automated decisions with legal or similarly significant effect, including profiling; CJEU litigation (Case C-484/24, continuing the SCHUFA line) tests whether a scoring controller's own process itself constitutes such a decision even where a third party formally decides. Also directly informs the automated_decision_making_transparency sub-module (same underlying CJEU litigation); precise holding of C-484/24 not independently confirmed this pass — see gaps_register.
Ai Risk AssessmentsAmber
BfDI issues non-binding AI guidance and co-runs an AI Reallabor sandbox; no binding DE AI-specific risk-assessment statute exists yet.
Claims (1):
- BfDI issues non-binding AI guidance for federal administration and co-runs an AI Reallabor regulatory sandbox with the Bundesnetzagentur and Hesse's digital ministry. No dedicated AI Reallabor source page independently retrieved this pass.
Biometric RegimeAmber
No dedicated biometric-specific German statute identified beyond GDPR Art 9; enforcement gaps alleged (noyb v. HmbBfDI re PimEyes).
Claims (1):
- noyb has litigated alleged under-enforcement by Hamburg's HmbBfDI regarding unlawful facial-recognition (PimEyes) processing.
Genetic DataRed
No DE-specific genetic-data statute beyond GDPR Art 9 special-category rules was identified in this pass.
Absence provenance: unavailable. Searched: Gendatenschutzgesetz Deutschland 2026, genetic data specific statute Germany.
State Surveillance CarveoutsAmber
BfDI retains oversight of federal intelligence-service processing; opposes a proposed UKRat transfer of this supervision as duplicative and likely to weaken oversight.
Claims (1):
- BfDI opposes a proposed transfer of federal intelligence-service data-processing oversight functions to the already-operating Unabhängiger Kontrollrat (UKRat), an oversight body established via the 2021 BNDG amendment and operational since the turn of 2021/2022, whose remit the 2026 reform proposal seeks to expand. Corrected per Challenger fold f-002: original text mischaracterised UKRat as a new body; UKRat is existing (est. 2021 BNDG amendment), reform proposal expands its remit.
Key findings (3)
- — source on file
- — source on file
- — source on file
Algorithmic, Biometric & Surveillance Governance
The KI-MIG (Gesetz zur Durchführung der KI-Verordnung), Germany's implementing act for the EU AI Regulation, entered into force on 29 July 2026, having been promulgated in the Federal Law Gazette (BGBl. 2026 I Nr. 233) the previous day. Beyond naming the Bundesnetzagentur as the central AI market-surveillance and complaints authority, the KI-MIG establishes, under its Article 20, a non-public register of certain high-risk AI systems to be maintained by the Bundesnetzagentur, and mandates the establishment of at least one AI regulatory sandbox.
The non-public character of this high-risk AI system register is itself a notable design choice: unlike some public AI-system registers maintained at EU level under the AI Act's own Article 71 database provisions, Germany's national register under KI-MIG Article 20 is not publicly accessible, meaning external stakeholders, including affected data subjects, civil-society organisations, and researchers, will not be able to independently verify which systems are registered or inspect the register's contents. This has implications for transparency and external accountability around high-risk AI deployment in Germany that sit alongside, but are distinct from, the GDPR's own transparency and data-subject-rights framework.
The mandated regulatory sandbox is a further structural element of the KI-MIG package, intended to provide a supervised testing environment for AI systems, though the operational details of how the sandbox will function, including eligibility criteria and the scope of any regulatory flexibility offered to participants, were not established this cycle.
Outlook
The practical operation of both the non-public high-risk AI register and the mandated regulatory sandbox will be important to revisit once the Bundesnetzagentur has had time to establish operational procedures. Given the register's non-public status, any future disclosure of aggregate statistics (such as the number of registered systems, by sector) by the Bundesnetzagentur, even without individual system detail, would be a meaningful transparency marker worth tracking.
1 earlier distinct update(s)
Algorithmic, Biometric & Surveillance Governance
The BfDI launched its "ReguLab" regulatory sandbox at the start of 2026, a confirmed, Tier-1-sourced institutional development. Its first competitive call concerned a healthcare-digitalisation use case, opening in the first quarter of 2026. Notably, ReguLab is distinct from a separate AI-Reallabor pilot the BfDI runs jointly with the Bundesnetzagentur and Hesse's state digital ministry — two parallel sandbox-style initiatives operating simultaneously, one BfDI-led and general-purpose, the other multi-agency and AI-Act-specific.
Both developments represent new institutional tooling rather than binding rule changes: neither ReguLab nor the AI-Reallabor pilot creates a new compliance obligation this cycle. Their significance lies in signalling how the BfDI intends to engage with algorithmic and data-driven innovation — through supervised experimentation frameworks rather than through ex ante binding rulemaking alone. The healthcare-digitalisation focus of ReguLab's first call suggests the BfDI is prioritising a sector where data-protection and algorithmic-governance questions intersect particularly acutely.
Outlook
Watch for the outcome of ReguLab's first healthcare-digitalisation competitive call and whether it produces published learnings or guidance that could inform binding rulemaking. Similarly watch for any output from the AI-Reallabor pilot with the Bundesnetzagentur and Hesse, which would be the first substantive signal of how the BfDI expects to apply data-protection principles within an AI-Act sandbox context.
Sources and claims (4)
- ProbableEUR-Lex / CJEU — GDPR Article 22 restricts solely-automated decisions with legal or similarly significant effect, including profiling; CJEU litigation (Case C-484/24, continuing the SCHUFA line) tests whether a scoring controller's own process itself constitutes such a decision even where a third party formally decides. Also directly informs the automated_decision_making_transparency sub-module (same underlying CJEU litigation); precise holding of C-484/24 not independently confirmed this pass — see gaps_register.observed
- UncertainBundesbeauftragte für den Datenschutz und die Informationsfreiheit — BfDI issues non-binding AI guidance for federal administration and co-runs an AI Reallabor regulatory sandbox with the Bundesnetzagentur and Hesse's digital ministry. No dedicated AI Reallabor source page independently retrieved this pass.observed
- ProbableOneTrust DataGuidance — noyb has litigated alleged under-enforcement by Hamburg's HmbBfDI regarding unlawful facial-recognition (PimEyes) processing.observed
- Probableunavailable — BfDI opposes a proposed transfer of federal intelligence-service data-processing oversight functions to the already-operating Unabhängiger Kontrollrat (UKRat), an oversight body established via the 2021 BNDG amendment and operational since the turn of 2021/2022, whose remit the 2026 reform proposal seeks to expand. Corrected per Challenger fold f-002: original text mischaracterised UKRat as a new body; UKRat is existing (est. 2021 BNDG amendment), reform proposal expands its remit.