The sales department sends out offers via a signature tool, the HR department sends out employment contracts as PDFs, the marketing department creates texts using an AI tool, and the customer data is stored in a cloud whose server location no one can specify exactly. Each step was meaningful; together they form a structure that no one has ever legally reviewed.
This is often noticeable from the outside. A customer requests proof of data protection before signing a contract, a client asks about the handling of AI, or an employee disputes an agreement because the signature was just an image in a PDF file. Digital legal certainty thus determines not only risks but also contracts.
clience.legal is a digital business law firm for entrepreneurs. We work digitally ourselves and know the friction points between technical implementation and legal requirements from practice. This post brings together the three areas of digital legal certainty and begins with a self-assessment that will allow you to identify your biggest gaps in just a few minutes.
The most important information at a glance
- Three fields, one connection: Contracts, data, and AI are interconnected because the same processes are affected. Those who handle them separately close some gaps twice and overlook others.
- Form before content: Since the Bureaucracy Relief Act IV, text form is sufficient in many cases. In important exceptions, a handwritten signature remains mandatory, and a formal defect renders the agreement invalid.
- Provability beats signature technology: In a dispute, what matters is rarely the type of signature, but whether you can prove receipt and content.
- Data protection fails due to everyday processes: Problems are not caused by the major data breach, but by unanswered data subject requests, missing records of processing activities, and missing data processing agreements.
- AI rules already apply: The transparency obligations and the enforcement of the AI Act have applied since August 2, 2026. The obligations for high-risk systems have been postponed to December 2027.
- Evidence is a selling point: In tenders and with large customers, the documentation you have determines whether you are even invited to bid.
Self-check: Where do you stand?
Go through the following twelve statements and count how many you can agree with. Answer honestly, not as things should be.
Contracts
- We know which of our agreements can be concluded digitally and which cannot.
- For every contract sent digitally, we can prove receipt by the recipient.
- Our terms exist in a current version and are demonstrably incorporated into our contracts.
- Contract terms and notice periods are centrally recorded and monitored.
Data
- Our record of processing activities is up to date and reflects the systems actually in use.
- Data processing agreements are in place with all external service providers that have access to data.
- We could fully answer a data subject request within one month.
- For a security incident, there is an action plan with designated responsible parties.
Artificial Intelligence
- We know which AI tools are actually used in the company.
- It is regulated what data can be entered into these tools.
- Results are checked before use, and this check is assigned to someone.
- We can explain to customers on request how and where we use AI.
Nine to twelve yes answers indicate a solid foundation; this is about fine-tuning. Five to eight mean that some areas are solid and others are unregulated, usually with AI use as the weakest. With fewer than five, you should make the topic a priority before the first incident forces a review.
Why the three fields belong together
Contracts, data, and AI appear at first glance to be separate topics with separate responsibilities. In practice, they meet in the same place, namely in the day-to-day business processes. An offer contains customer data, is sent via an external tool, possibly with AI support, and is then digitally signed and stored. Four legal issues, one process.
This leads to a practical consequence. Those who sort the topics by legal areas work on documents. Those who sort them by processes work on the reality of the company and identify gaps that are not included in any checklist. In our experience, the most expensive points are almost always at the interfaces: where one department has introduced a tool that another department does not know about.
Field 1: Concluding contracts digitally
Which form applies when
The German Civil Code (BGB) recognizes three levels. Written form under § 126 BGB requires a handwritten signature on a document. Electronic form under § 126a BGB can replace it, but only with a qualified electronic signature that is based on a certificate and created with a secure signature creation device. Text form under § 126b BGB merely requires a legible declaration on a durable medium that names the person making the declaration. An email is sufficient.
Most contracts in business dealings are not subject to any form requirement. They can also be concluded orally or by implied conduct. The question of the signature is therefore often not a question of validity, but a question of proof.
Where the handwritten signature remains mandatory
Since the Bureaucracy Relief Act IV took effect on January 1, 2025, text form is sufficient for the written statement of the essential terms of employment. Some exceptions remain, and a formal defect there renders the agreement invalid.
- Termination of employment relationship: Section 623 of the German Civil Code requires written form and explicitly excludes the electronic form.
- Fixed-term agreements: § 14(4) TzBfG requires written form. Alternatively, electronic form with a qualified electronic signature is permitted. For fixed terms ending at the standard retirement age, text form is now sufficient.
- Post-contractual non-compete covenants: Written form required under §§ 74 et seq. HGB.
- Declarations of suretyship: Section 766 of the German Civil Code excludes the electronic form.
Also check your own contract templates for written form clauses. Anyone who has agreed that amendments require written form cannot later rely on an amendment agreed by email. We show which clauses frequently cause problems here in our overview of the key clauses in contracts.
A second point concerns the incorporation of your own terms. In a digital ordering process, a link in the page footer is often not sufficient. The terms must be reasonably accessible before the contract is concluded, and the customer must be able to save them. For contracts with consumers, there are also information obligations and the correct design of the order button. A mistake here affects every single contract concluded, not just one case.
Provability in a dispute
A scanned signature image in a PDF file neither satisfies the written form requirement nor creates evidentiary value. If the conclusion of the contract is disputed, you must show who declared what and when, and that the declaration was received. Three measures are practical: a signature service that logs the process, a confirmation of receipt in the standard process, and audit-proof archiving. For more detail, see our article on electronic signatures and their legal requirements.
Field 2: Keeping data under control
Many companies treat data protection as a one-time project. A privacy notice, a record of processing activities, and a few contracts were created; after that, the system landscape evolved but the documentation did not. It is precisely this gap that is noticed first in audits and customer inquiries.
Four points cover most of the practical requirements. First, a record of processing activities that reflects the systems actually in use, including tools that individual departments introduced on their own. Second, data processing agreements with all service providers that have access to personal data, from the cloud provider to the agency. Third, a procedure for data subject requests, which must generally be answered within one month. Fourth, a reporting plan for security incidents, because the 72-hour reporting deadline leaves no room for rounds of coordination.
Fines under the General Data Protection Regulation can reach up to twenty million euros or four percent of worldwide annual turnover. For medium-sized companies, however, the economically more relevant point is a different one: large clients now routinely check their suppliers’ data protection. Anyone who cannot provide the documents at short notice loses the tender. We describe how to organize this within the company under Data protection and compliance in the company.
Field 3: Artificial Intelligence in the workplace
AI tools are already in use in most companies, often without approval and without rules. From a legal perspective, this raises four questions that can be cleanly separated.
- What data may be entered? If personal data or trade secrets are entered into external systems, a legal basis and a contract with the provider are required. Without both, entering the data is already the mistake.
- Who owns the result? Purely machine-generated content is generally not protected by copyright. Anyone who wants to grant rights in it to third parties must know how much of it was shaped by human creative input.
- Who is liable for errors? Responsibility remains with the company that uses the result. An erroneous contract text, incorrect information, or an infringement of rights in a generated image is not attributed to the tool.
- What needs to be disclosed? The transparency obligations of the AI Act require, among other things, that users can recognize when they are interacting with an AI system or when content has been artificially generated.
On the state of regulation: the Digital Omnibus was published in the Official Journal at the end of July 2026 and is in force. The transparency obligations as well as enforcement and penalties have applied since August 2, 2026. The extensive obligations for high-risk systems under Annex III have been postponed to December 2, 2027, and for systems embedded in regulated products to August 2, 2028. For most medium-sized users, this means relief in documentation, but no pause: taking stock of the systems in use and classifying them remains the basis for everything else. We support this as part of our legally compliant use of AI and address the liability issues under Liability, copyright and data protection when using AI .
In practice, a one-page usage policy is enough to start with: a list of approved tools, clear rules on permissible inputs, a designated duty to review results before use, and a statement on disclosure to customers. We explain why contracts should nevertheless not come out of the tool under why contracts should not be drafted with AI tools such as ChatGPT, and the data protection-related aspects are handled under AI and data protection.
What customers and clients are now asking about
The strongest driver of digital legal certainty is no longer the supervisory authority, but the purchasing departments of large customers. Anyone who wants to be listed as a supplier receives questionnaires that have changed noticeably over the past two years.
- Proof of data protection, often including the record of processing activities and technical measures.
- Information about subcontractors and the processing location of data.
- Information on whether and how AI is used in performance delivery.
- Rules on information security and on handling security incidents.
- Statements regarding compliance and whistleblower protection.
These requirements are passed on contractually, regardless of whether the law directly obliges your company. Those who have the documents ready can bid at short notice. Those who first have to create them lose time and, if in doubt, the contract. This turns a compliance obligation into a sales argument, and that is exactly how it should be justified internally as well.
Bringing the three fields together
The most common mistake is to handle each field separately. Data protection ends up with IT, contracts with management, AI with no one. Yet all three affect the same processes: a quote is prepared, sent, signed, filed, and evaluated. At every step, questions from several fields arise at the same time.
It makes more sense to look along the processes. Take your three most important workflows, such as preparing quotes, hiring, and customer service, and go through them once. At each step, note which data flows, which declaration is made, which form applies, and whether AI is involved. The priority list follows from this overview almost by itself. Implementation then belongs in fixed areas of responsibility, as we set them up in Drafting of contracts and T&Cs and in ongoing support as external legal department .
Tell us your self-check score and the processes in which you see the greatest uncertainty. We will assess which obligations actually apply to you, what needs to be closed in the short term, and what you can tackle in a planned way over the coming months. To do so, schedule an free initial consultation of 15 to 20 minutes. The professional framework for this is our advice on Compliance and managing director liability.
FAQs
Is a contract concluded via email valid?
In most cases, yes, because freedom of form applies in business dealings. Contracts can also be concluded orally or by implied conduct. The situation is different only where the law prescribes a specific form, for example for the termination of employment relationships or for suretyships. Also check whether your own contracts contain a written form clause that excludes amendments by email.
What electronic signature do I need?
That depends on the statutory form requirement. For contracts not subject to a form requirement, any signature is sufficient; the only issue here is provability. If text form is required, a simple electronic signature is sufficient. Only where the law requires written form and permits electronic form is a qualified electronic signature under § 126a BGB required.
Is a scanned signature image in the PDF file sufficient?
For contracts not subject to a form requirement, this may be sufficient, but it provides hardly any evidentiary value. It does not satisfy the written form, because that requires a handwritten signature on the document. If the conclusion of the contract is disputed, you are left without proof. A signature service that logs the process and a confirmation of receipt in the standard process are advisable.
Can I sign employment contracts digitally?
Yes. Since the Bureaucracy Relief Act IV, text form is sufficient for the written statement of the essential terms of employment, so a PDF sent by email is possible. Exceptions continue to apply to terminations under § 623 BGB, to fixed-term agreements under § 14(4) TzBfG, and to post-contractual non-compete covenants. In addition, employees can request the statement in written form, and special rules apply in certain industries.
Which data protection documents do I need to keep on hand?
At its core, this means an up-to-date record of processing activities, data processing agreements with all service providers that have access to data, information for data subjects, and technical and organizational measures. In addition, there are documented procedures for data subject requests and security incidents. Being up to date is key, because outdated documents are noticed immediately in audits.
How quickly must I respond to a data subject request?
Generally within one month of receipt. For complex requests, an extension is possible, but the data subject must be informed of it within the original deadline. Security incidents that pose a risk to data subjects must be reported to the supervisory authority within 72 hours. Both deadlines can only be met if the procedure has been defined in advance.
Which obligations under the AI Act apply to me today?
For most companies, these are the transparency obligations, such as making interaction with an AI system recognizable and labeling artificially generated content. These obligations have applied since August 2, 2026, as have enforcement and penalties. The extensive requirements for high-risk systems were postponed to December 2027 by the Digital Omnibus. Regardless of this, taking stock of the systems in use is worthwhile.
May I enter customer data into an AI tool?
Only with a legal basis and an appropriate contractual basis with the provider. If personal data is processed, a data processing agreement is generally required, and the processing location and any use of the inputs for training must be checked. Trade secrets lose their protection if reasonable confidentiality measures are lacking. A list of approved tools with clear input rules is a practical solution.
Who owns the texts and images that an AI has created?
Machine-generated content generally does not enjoy copyright protection because it lacks a personal intellectual creation. You cannot grant exclusive rights to third parties based on this. In addition, there is the risk that a result infringes on someone else's rights, for which the company that uses the results is responsible. Those who commercially exploit results should document the human creative input and review the provider's terms of use.
When is an attorney for digital legal certainty worth hiring?
As soon as contracts are concluded digitally, personal data is stored in external systems, or AI is used in day-to-day business, a review is worthwhile. We go through your processes, determine the applicable form requirements, bring your data protection documentation up to date, and draw up the rules for using AI. The economic benefit lies not only in avoided fines, but in proof that you can present in tenders and to large customers.
