Learning goals
- You sort data into four classes and know what may go where.
- You know the key AI Act deadlines.
- You know when to involve the works council.
- You check a tool for data processing terms, training use and storage location.
Data classes and licence tiers
The most important everyday rule: private accounts and business licences are not the same. Business versions usually come with a data processing agreement and exclude training on your inputs. Storage location differs: according to OpenAI, ChatGPT Business offers no data storage in Europe, ChatGPT Enterprise does. In Google Workspace, data regions exist only in Enterprise plans.
A simple traffic light helps:
| Data class | Example | Allowed |
|---|---|---|
| Public | Press release | all approved tools |
| Internal | Project plan without customer data | business licence |
| Confidential | Customer data, contracts | business licence with data processing agreement, EU storage if required |
| Strictly confidential | HR files, health data, trade secrets | only with separate approval |
The AI Act after the Omnibus
Omnibus Regulation (EU) 2026/1744 has applied since 27 July 2026. It moved deadlines but cancelled no duty.
| Date | What applies |
|---|---|
| 2 Feb 2025 | Prohibited practices, AI literacy under Art. 4 |
| 2 Aug 2026 | Transparency duties under Art. 50, such as disclosure for chatbots |
| 2 Dec 2026 | End of labelling grace period for existing systems, two new prohibitions |
| 2 Dec 2027 | High-risk systems under Annex III, such as recruitment, credit, education |
| 2 Aug 2028 | High-risk systems in regulated products under Annex I |
Since the rewrite, Art. 4 requires measures to promote AI literacy, not a guaranteed level per person. This course can be such a documented measure.
GDPR and the works council
Germany's Data Protection Conference published guidance on AI in 2024. The key points: the company is responsible for the processing. It needs a data processing agreement under Art. 28 GDPR, should prefer tools that do not train on inputs, set internal policies and check whether a data protection impact assessment is needed. Automated decisions with legal effect are only permitted within limits under Art. 22 GDPR.
On the works council: on 16 January 2024 the Hamburg Labour Court ruled (24 BVGa 1/24) that allowing private ChatGPT accounts does not require works council approval. If the employer provides a tool itself, most law firms see co-determination under Section 87(1) No. 6 of the Works Constitution Act. There is no supreme court ruling yet. Recommendation: involve the works council early and aim for a framework works agreement on AI.
This lesson provides orientation and is not legal advice.
The data traffic light
Create a traffic light for the tools your team uses.
Do the task in your day-to-day work
You do this task in your day-to-day work, not here in the course. Tick off the steps once you have done them.
What comes out of it: A one-page data traffic light for your team.
Enter your result here
Enter what came out of the task. Everything is saved automatically. Your results from module 5 are already waiting here.
See an example
This is what a filled-in result could look like. Your entries stay unchanged.
Your data traffic light
- n8nLicence tier: Pro (cloud) · Data processing agreement: yes · Training on inputs: excluded · Storage location: EU · Highest permitted data class: Confidential
- ClaudeLicence tier: Team · Data processing agreement: yes · Training on inputs: excluded · Storage location: outside the EU · Highest permitted data class: Internal
- DeepLLicence tier: Business · Data processing agreement: yes · Training on inputs: excluded · Storage location: outside the EU · Highest permitted data class: Internal
- ChatGPT on a personal accountLicence tier: Free · Data processing agreement: no · Training on inputs: not excluded · Storage location: outside the EU · Highest permitted data class: Public
From module 5 Your first workflow open
Module 5 has no entries yet. Go to module 5 →
Used again in module 8
Your result appears there automatically, and you can take it over with one click. You will also find all results in the workbook.
Quiz
1. Since when do the transparency duties under Art. 50 of the AI Act apply?
2. From when do high-risk duties apply to AI used in recruitment?
3. What does Art. 4 of the AI Act require since the rewrite?
4. What did the Hamburg Labour Court rule in 2024?