The sales department sends out offers via a signature tool, the HR department sends out employment contracts as PDFs, the marketing department creates texts using an AI tool, and the customer data is stored in a cloud whose server location no one can specify exactly. Each step was meaningful; together they form a structure that no one has ever legally reviewed.<\/p>\n\n\n\n
This is often noticeable from the outside. A customer requests proof of data protection before signing a contract, a client asks about the handling of AI, or an employee disputes an agreement because the signature was just an image in a PDF file. Digital legal certainty thus determines not only risks but also contracts.<\/p>\n\n\n\n
clience.legal is a digital business law firm for entrepreneurs. We work digitally ourselves and know the friction points between technical implementation and legal requirements from practice. This post brings together the three areas of digital legal certainty and begins with a self-assessment that will allow you to identify your biggest gaps in just a few minutes.<\/p>\n\n\n\n
Go through the following twelve statements and count how many you can agree with. Answer honestly, not as things should be.<\/p>\n\n\n\n
Nine to twelve yes answers indicate a solid foundation; this is about fine-tuning. Five to eight mean that some areas are solid and others are unregulated, usually with AI use as the weakest. With fewer than five, you should make the topic a priority before the first incident forces a review.<\/p>\n\n\n\n
Contracts, data, and AI appear at first glance to be separate topics with separate responsibilities. In practice, they meet in the same place, namely in the day-to-day business processes. An offer contains customer data, is sent via an external tool, possibly with AI support, and is then digitally signed and stored. Four legal issues, one process.<\/p>\n\n\n\n
This leads to a practical consequence. Those who sort the topics by legal areas work on documents. Those who sort them by processes work on the reality of the company and identify gaps that are not included in any checklist. In our experience, the most expensive points are almost always at the interfaces: where one department has introduced a tool that another department does not know about.<\/p>\n\n\n\n
The German Civil Code (BGB) recognizes three levels. Written form under \u00a7 126 BGB requires a handwritten signature on a document. Electronic form under \u00a7 126a BGB can replace it, but only with a qualified electronic signature that is based on a certificate and created with a secure signature creation device. Text form under \u00a7 126b BGB merely requires a legible declaration on a durable medium that names the person making the declaration. An email is sufficient.<\/p>\n\n\n\n
Most contracts in business dealings are not subject to any form requirement. They can also be concluded orally or by implied conduct. The question of the signature is therefore often not a question of validity, but a question of proof.<\/p>\n\n\n\n
Since the Bureaucracy Relief Act IV took effect on January 1, 2025, text form is sufficient for the written statement of the essential terms of employment. Some exceptions remain, and a formal defect there renders the agreement invalid.<\/p>\n\n\n\n
Also check your own contract templates for written form clauses. Anyone who has agreed that amendments require written form cannot later rely on an amendment agreed by email. We show which clauses frequently cause problems here in our overview of the key clauses in contracts<\/a>.<\/p>\n\n\n\n A second point concerns the incorporation of your own terms. In a digital ordering process, a link in the page footer is often not sufficient. The terms must be reasonably accessible before the contract is concluded, and the customer must be able to save them. For contracts with consumers, there are also information obligations and the correct design of the order button. A mistake here affects every single contract concluded, not just one case.<\/p>\n\n\n\n A scanned signature image in a PDF file neither satisfies the written form requirement nor creates evidentiary value. If the conclusion of the contract is disputed, you must show who declared what and when, and that the declaration was received. Three measures are practical: a signature service that logs the process, a confirmation of receipt in the standard process, and audit-proof archiving. For more detail, see our article on electronic signatures and their legal requirements<\/a>.<\/p>\n\n\n\n Many companies treat data protection as a one-time project. A privacy notice, a record of processing activities, and a few contracts were created; after that, the system landscape evolved but the documentation did not. It is precisely this gap that is noticed first in audits and customer inquiries.<\/p>\n\n\n\n Four points cover most of the practical requirements. First, a record of processing activities that reflects the systems actually in use, including tools that individual departments introduced on their own. Second, data processing agreements with all service providers that have access to personal data, from the cloud provider to the agency. Third, a procedure for data subject requests, which must generally be answered within one month. Fourth, a reporting plan for security incidents, because the 72-hour reporting deadline leaves no room for rounds of coordination.<\/p>\n\n\n\n Fines under the General Data Protection Regulation can reach up to twenty million euros or four percent of worldwide annual turnover. For medium-sized companies, however, the economically more relevant point is a different one: large clients now routinely check their suppliers\u2019 data protection. Anyone who cannot provide the documents at short notice loses the tender. We describe how to organize this within the company under Data protection and compliance in the company<\/a>.<\/p>\n\n\n\n AI tools are already in use in most companies, often without approval and without rules. From a legal perspective, this raises four questions that can be cleanly separated.<\/p>\n\n\n\n On the state of regulation: the Digital Omnibus was published in the Official Journal at the end of July 2026 and is in force. The transparency obligations as well as enforcement and penalties have applied since August 2, 2026. The extensive obligations for high-risk systems under Annex III have been postponed to December 2, 2027, and for systems embedded in regulated products to August 2, 2028. For most medium-sized users, this means relief in documentation, but no pause: taking stock of the systems in use and classifying them remains the basis for everything else. We support this as part of our legally compliant use of AI<\/a> and address the liability issues under Liability, copyright and data protection when using AI<\/a> .<\/p>\n\n\n\n In practice, a one-page usage policy is enough to start with: a list of approved tools, clear rules on permissible inputs, a designated duty to review results before use, and a statement on disclosure to customers. We explain why contracts should nevertheless not come out of the tool under why contracts should not be drafted with AI tools such as ChatGPT<\/a>, and the data protection-related aspects are handled under AI and data protection<\/a>.<\/p>\n\n\n\n The strongest driver of digital legal certainty is no longer the supervisory authority, but the purchasing departments of large customers. Anyone who wants to be listed as a supplier receives questionnaires that have changed noticeably over the past two years.<\/p>\n\n\n\n These requirements are passed on contractually, regardless of whether the law directly obliges your company. Those who have the documents ready can bid at short notice. Those who first have to create them lose time and, if in doubt, the contract. This turns a compliance obligation into a sales argument, and that is exactly how it should be justified internally as well.<\/p>\n\n\n\n The most common mistake is to handle each field separately. Data protection ends up with IT, contracts with management, AI with no one. Yet all three affect the same processes: a quote is prepared, sent, signed, filed, and evaluated. At every step, questions from several fields arise at the same time.<\/p>\n\n\n\n It makes more sense to look along the processes. Take your three most important workflows, such as preparing quotes, hiring, and customer service, and go through them once. At each step, note which data flows, which declaration is made, which form applies, and whether AI is involved. The priority list follows from this overview almost by itself. Implementation then belongs in fixed areas of responsibility, as we set them up in Drafting of contracts and T&Cs<\/a> and in ongoing support as external legal department<\/a> .<\/p>\n\n\n\n Tell us your self-check score and the processes in which you see the greatest uncertainty. We will assess which obligations actually apply to you, what needs to be closed in the short term, and what you can tackle in a planned way over the coming months. To do so, schedule an free initial consultation<\/a> of 15 to 20 minutes. The professional framework for this is our advice on Compliance and managing director liability<\/a>.<\/p>\n\n\n\nProvability in a dispute<\/h3>\n\n\n\n
Field 2: Keeping data under control<\/h2>\n\n\n\n
Field 3: Artificial Intelligence in the workplace<\/h2>\n\n\n\n
\n
What customers and clients are now asking about<\/h2>\n\n\n\n
\n
Bringing the three fields together<\/h2>\n\n\n\n