Compliance teams in German federal, state and municipal bodies can use AI agents to review new digital services for legal and data protection risk, check procurement files, assemble freedom of information requests and draft records of processing. Administrative acts stay with officials: German law permits fully automated decisions only where a statute allows and no discretion is involved. Staff councils have a say in deployment.
What does public sector compliance look like in Germany?
German public administration is federal. The federation, the states and the municipalities each have their own administrations, data protection supervisors and, in many cases, their own freedom of information laws. A compliance function in a federal agency, a state ministry or a city administration works within this layered structure.
Lawful administrative action. Administrative acts must have a legal basis, be issued by the competent authority and be reasoned. Fully automated administrative acts are permitted only where a statute allows them and there is no discretion or margin of judgement. Every digitisation project must answer whether that condition is met.
Digital services. Administrations are moving services online. Each new service brings questions on data protection, accessibility, information security and the legal basis for any automated steps.
Procurement and anti-corruption. Public procurement rules require competition, transparency and equal treatment. Administrations run anti-corruption measures such as rotation in sensitive posts, the four-eyes principle and declarations of secondary employment.
Data protection and freedom of information. The GDPR applies, supervised by federal and state authorities, alongside federal and state freedom of information laws where they exist.
Staff participation. Staff councils have co-determination rights where technical systems can monitor staff behaviour or performance.
Where can AI agents help?
Depth caps what each agent may do: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
New digital service reviews (depth 2). Before a new online service launches, the agent reads the specification, data flows and decision logic, and drafts a review covering legal basis, any automated steps and whether they involve discretion, data protection, accessibility and security. The question of how far an agent should take such reviews is covered in can an AI agent review a new product for compliance risk. This use is the most specific to Germany, because the condition on automated administrative acts makes the legal basis question central to every project.
Procurement file checks (depth 1). The agent checks each file for required notices, evaluation records, the four-eyes sign-off and declarations of interest, and lists gaps.
Freedom of information requests (depth 2). The agent locates documents, marks personal data, business secrets and other protected information, and drafts the response for the responsible official.
Records of processing (depth 2). The agent drafts Article 30 entries for new processing activities from project documentation.
Secondary employment declarations (depth 3). The agent sends routine reminders for overdue declarations in sensitive posts.
What stays with officials?
Administrative acts. Decisions on permits, benefits, fees and enforcement are made by competent officials. An agent may prepare material; it does not issue acts. Where an act cannot be reversed once carried out, the stakes are higher still; the article on irreversibility in public services explains why.
Whether a process may be fully automated. That is a legal judgement for the legal service, based on the governing statute.
Data protection decisions. The data protection officer advises; the head of the authority decides on processing and impact assessments.
Freedom of information determinations. Whether information is protected, and whether to release it, is decided by the responsible official.
Corruption suspicions. Concluding that misconduct may have occurred, and referring it, is for the contact person for corruption prevention and management.
Which rules apply in Germany?
GDPR. Article 5 principles, Article 6 lawful basis (often legal obligation or public task), Article 30 records and Article 35 impact assessments apply. Article 22 restricts decisions based solely on automated processing with legal or similarly significant effects, and German administrative law sets its own condition on fully automated administrative acts.
EU AI Act (Regulation (EU) 2024/1689). Entered into force on 1 August 2024, with obligations phasing in; prohibitions have applied since 2 February 2025. Some public uses are high-risk. Article 27 requires bodies governed by public law, among other deployers, to carry out a fundamental rights impact assessment before using high-risk systems. Article 26 deployer duties, Article 14 human oversight and Article 4 AI literacy apply.
NIS2. Covers parts of public administration for cybersecurity risk management and incident reporting.
Staff participation law. Federal and state laws give staff councils co-determination rights over technical systems that can monitor performance. An agent reading officials' case work or declarations is likely to be covered.
Administrative procedure, procurement and freedom of information law at federal and state level apply to the work the agent supports.
BaFin supervises financial firms and does not reach a public body's compliance agent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Weeks 1 to 4. Agree the agent's use with the staff council and record it in a service agreement. Confirm which data protection supervisor is responsible. Start with new digital service reviews, which concern systems rather than staff.
Weeks 5 to 8. Run the agent against two or three services already reviewed by the legal service, and compare its drafts with the final reviews. Look closely at how it treats discretion.
Weeks 9 to 13. Use it on new projects, with the legal service and data protection officer finalising every review. Add procurement file checks. Singapore's public bodies work under a different governance model; see compliance agents in Singapore's public sector. The guide to AI compliance agents covers the principle.
Questions people ask
Can a German authority let an AI agent issue administrative acts?
Only where a statute permits fully automated acts and no discretion is involved. A compliance agent should never issue acts; it reviews whether others may be automated.
Does the staff council need to agree to a compliance agent?
If the agent can monitor staff behaviour or performance, co-determination rights are likely. Involve the council early and set the scope in writing.
Is a fundamental rights impact assessment needed for a compliance agent?
That assessment applies to high-risk systems. A compliance agent that drafts for officials is not usually high-risk, but record your reasoning.