AI chatbots are legally permissible in Germany, and companies have long been deploying them widely across customer service. Permissible, however, does not mean free of obligations. An AI chatbot does not operate in a legal vacuum, and a recent court ruling has highlighted how far an operator's responsibility extends. Organizations familiar with the legal framework can configure their chatbots to reduce workload without incurring liability risks.

Three areas of law define the framework: data privacy, the transparency obligation under the EU AI Act, and liability for the chatbot's statements. The third has been defined much more sharply since May 2026.

In short: permissible, but with three obligations

An AI chatbot is permitted as long as it meets three requirements. It must process personal data in accordance with the GDPR. It must be identifiable to users as an AI system, as required by the EU AI Act. And its statements must be factually accurate and compliant with competition law, because the operator is liable for them as for its own statements.

The first two points are well known. The third has gained significant weight due to recent case law.

The OLG Hamm ruling: Operators are liable for chatbot statements

The Higher Regional Court (OLG) of Hamm ruled in its judgment of May 12, 2026 (Ref. 4 UKl 3/25) that a company is fully liable for inaccurate statements made by its AI chatbot. Legally, a chatbot is considered a tool of the company, and its outputs are directly attributed to the operator as its own commercial practice.

In the decided case, a provider in the field of aesthetic medicine featured a chatbot on its website through which prospective clients could ask questions and book appointments. When prompted, the chatbot cited specialist medical titles for treating physicians that did not exist or were not held. The details were entirely fabricated. The Consumer Advice Center of North Rhine-Westphalia issued a cease-and-desist warning to the company for misleading advertising and prevailed before the OLG Hamm.

Two points from this decision are crucial for operators. Liability applies on a strict liability basis—meaning it does not matter whether the operator was at fault regarding selection or supervision. Furthermore, the defense that the chatbot was trained on accurate data was insufficient for the court. Even with meticulously curated training data, responsibility for the specific output in individual cases remains. A model hallucination does not absolve the operator.

The ruling is not yet legally binding; the senate has granted leave to appeal to the Federal Court of Justice (BGH). In practice, this changes little regarding direction: Anyone operating a chatbot should treat its statements as seriously as any other claim published on their website.

Where the risk is greatest

The risk increases in areas where an inaccurate statement is legally sensitive. Three areas stand out.

Advertising prohibitions and protected claims. For food products, health-related claims are strictly regulated, and disease-related claims are prohibited. If the chatbot confirms such an effect upon inquiry, this becomes precarious under competition law.

Information on legal matters. Answers regarding warranties, rights of withdrawal, or contractual terms are risky. The generated response may be legally incorrect or contradict the company's own terms and conditions, thereby becoming misleading.

High-risk terms subject to warnings. Claims regarding guarantees, testing and certifications like CE marking, or phrasing such as "test winner" are well-known targets for legal challenges. A chatbot that issues these without verification opens the door to cease-and-desist letters.

Complicating matters further is the fact that the response behavior of a learning system is difficult to predict entirely. Targeted queries can prompt a model into making a statement that would not occur during standard operations.

Data protection and transparency: the other two obligations

Alongside liability, the two established obligations remain. In data protection, the location of data processing is critical. Processing in Germany without transfers to third countries, underpinned by a data processing agreement, provides a robust path forward. More details can be found in the article on GDPR- and EU AI Act-compliant AI chatbots.

The transparency obligation stems from the EU AI Act. Users must be able to recognize that they are interacting with an AI system, unless this is already obvious. A clear notice at the beginning of the dialog satisfies this requirement.

How operators can mitigate liability risk

The legal situation dictates a clear design principle: Risk decreases when the chatbot only states what is verified, and remains silent when it is not.

The most effective lever is grounding in verified sources. When responses are derived strictly from the company's approved content rather than freely formulated, the most common cause of false statements is eliminated. The second lever is setting clear boundaries. The chatbot should not address defined topics at all—especially legal inquiries—and should hand them over to a human instead. The third lever is oversight. Conversation logs should be recorded and reviewed on a sample basis, particularly following system updates.

The guiding principle behind this is simple: no answer is better than a false answer. A chatbot that escalates to the service team when grounding is absent protects the operator far better than one that provides an answer to every single prompt.

Is ChatGPT permitted within enterprises?

Yes, provided the enterprise addresses three areas. First, data protection: Personal data of customers or employees should only enter tools backed by a data processing agreement with the provider and where data routing is clarified, including transfers to the US. Second, trade secret protection: Content copied into a public AI tool leaves the company's control. Third, workforce policies: guidelines specifying which tools are approved for which data types, AI literacy training as required by the EU AI Act, and involvement of the works council where applicable.

If a company deploys a language model facing customers—such as a chatbot on its website—liability for its statements applies as outlined by the OLG Hamm. How ChatGPT can be used compliantly with data protection standards in customer service is detailed in our article on ChatGPT in customer service.

How Mercury.ai addresses this challenge

Mercury.ai is designed specifically for this requirement. An orchestration of specialized models identifies the user intent, locates and verifies the appropriate source, and only formulates the response at the very end. The language model verbalizes, while the facts originate from the enterprise's verified knowledge. If no reliable source is found, the assistant provides no statement and hands over to the Agent Desk. This significantly reduces the risk of fabricated and potentially actionable statements. How this source-grounded architecture operates is explained in the article on hallucinations in AI chatbots.

In addition, there is the legal framework: Data is processed in Germany, the AI disclosure for transparency requirements can be displayed at the start of the dialog, and business teams retain control over approved content via the knowledge base. Learn more about the architecture under Mercury Intelligence.

Frequently Asked Questions

Are AI chatbots legally permissible?

Yes. In Germany, the deployment of AI chatbots is permitted as long as data privacy, the transparency obligation under the EU AI Act, and the factual accuracy of statements are maintained.

Is a company liable for the statements made by its chatbot?

Yes. According to the OLG Hamm ruling of May 12, 2026, the statements of an AI chatbot are attributed to the operator as its own commercial actions. Liability applies even in the event of a model hallucination.

Does a chatbot need to be labeled as AI?

Yes. The EU AI Act requires that users can recognize that they are interacting with an AI system, unless this is obvious from the context. A clear notice at the start of the dialog is sufficient.

How can the liability risk of an AI chatbot be reduced?

By grounding responses strictly in verified sources, establishing clear topical boundaries with human handovers for legal inquiries, and continuously monitoring conversation logs.

Are AI chatbots GDPR-compliant?

They can be. Prerequisites include processing within the EU, a data processing agreement, and grounding answers in verified sources. With Mercury.ai, data is processed in Germany.

Control beats trust

AI chatbots are permissible and serve as an effective tool in customer service. Case law has merely clarified what applies to any commercial statement: The operator is accountable. Organizations that tie their chatbot to verified knowledge, define clear boundaries, and monitor its responses leverage the advantages of automation without incurring liability risks.

Looking for a chatbot that provides only verified answers? Talk to us or explore Mercury Intelligence.

This article provides a general overview of the legal framework and does not constitute legal advice. Please consult qualified legal counsel for assessments of specific individual cases.

Sources

• OLG Hamm, judgment of May 12, 2026, Ref. 4 UKl 3/25: A company is liable for false statements made by its AI chatbot; outputs are attributed to it as its own commercial action. Not yet legally binding; leave to appeal to the BGH granted.

• Verbraucherzentrale Nordrhein-Westfalen: Plaintiff in proceedings regarding the attribution of false statements by an AI chatbot.

• Regulation (EU) 2024/1689 (EU AI Act): Transparency obligation when interacting with AI systems.