AI in performance reviews and appraisal talks in Germany: what is allowed and what HR teams settle before rollout

May AI support performance reviews and appraisal talks?

Yes, as preparation. No, as the deciding authority. The law does not draw the line at the tool but at the effect: using AI to word a conversation guide, smooth your own text or sort notes mostly stays outside the strictest rules. Letting a system evaluate the performance or behaviour of individual employees, or using it to prepare promotion, dismissal or task allocation, lands in Annex III no. 4(b) of the AI Act and therefore among the high-risk systems.

The exemption in Art. 6(3) AI Act helps only a little. It applies where there is no significant risk to health, safety or fundamental rights. Profiling of natural persons, by contrast, is always high-risk. A system that builds a performance profile of a person from metrics, tickets and calendar entries is profiling, even if a human clicks “save” at the end.

Bitkom shows how common this is. In its survey of 852 companies with three or more employees (calendar weeks 38 to 44 of 2024), 8 percent used AI to assess work performance and 20 percent could imagine doing so. According to Destatis, 26 percent of German companies use AI at all (2025), and 57 percent of companies with 250 or more employees. If you are planning in this field, you are early rather than late. That is a reason to settle the rules beforehand and not afterwards.

Evidence12345

What does the AI Act expressly ban at work?

Inferring emotions. Art. 5(1)(f) of the AI Act bans AI systems that detect or infer emotions of a person in the workplace, except for medical or safety reasons. The ban has applied since 2 February 2025, independent of the later deadlines for high-risk systems.

For appraisal talks this is more concrete than it sounds. A transcription tool that only takes notes is something different from one that also reports “mood”, “engagement” or “stress level” from voice or face. The second is the case the provision means. Check every tool for talks and surveys for such analytics, and switch them off. That a feature can merely be hidden does not change that you, as the deployer, are responsible for its use.

The exception for medical purposes and safety is narrow. Mood data also quickly becomes health data: Art. 9(1) GDPR prohibits processing special categories of personal data, which include health data, unless an exception under paragraph 2 applies. Anyone starting with mood analysis therefore also enters difficult terrain under data protection law. Whether the European Commission's guidelines on prohibited practices name these cases specifically, I could not check against the original text in this run. According to the Commission, the guidelines are non-binding anyway, and interpretation rests with the Court of Justice.

Evidence67

Which rule applies when, and what happens until then?

The high-risk duties for Annex III systems apply from 2 December 2027. The date is set in Regulation (EU) 2026/1744, the Digital Omnibus, of 8 July 2026, published in the Official Journal on 24 July 2026. They were previously due in August 2026. The ban on emotion recognition at work, by contrast, has applied since 2 February 2025, and the GDPR applies unchanged.

The later date is no reason to wait. It is the deadline by which your processes must stand, and anyone introducing a system today needs it compliant tomorrow. The overview of all duties is on the page about the EU AI Act for HR. On top of that, the duties have to be settled at rollout, not on the deadline: the works council co-determines introduction and use now, and the data protection impact assessment belongs before the start.

For breaches of the deployer duties the Regulation provides fines of up to EUR 15,000,000 (Art. 99(4)). I did not check the percentage-of-turnover threshold against the original text and therefore do not state it. For your planning it is enough to know that this is not a small matter.

Evidence8910

When is an appraisal an automated decision under the GDPR?

When no human with genuine room to decide stands in between. Art. 22(1) GDPR gives data subjects the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. An appraisal on which a bonus, promotion or dismissal rests meets that quickly. Under paragraph 3, where an exception applies, there must at least be human intervention, the chance to express one's point of view and the chance to contest the decision.

In its guidance on AI and data protection of 6 May 2024, the German Data Protection Conference stressed that the human decision-maker must have genuine room to decide (as reported by Gleiss Lutz). This is where many rollouts fail. If a tool suggests a rating and the manager accepts it in 40 out of 40 cases, a supervisory authority has reason to treat that as a formality. Record how often managers deviate from the suggestion, and give them the data they need to deviate.

Information duties come on top. Anyone using automated decision-making including profiling must say so (Art. 13(2)(f) GDPR), and employees can request information about it (Art. 15(1)(h) GDPR). The AI Act adds to this: for high-risk systems, affected persons can ask the deployer for clear and meaningful explanations (Art. 86(1)), and deployers must inform them that they are subject to the system (Art. 26(11)). If you cannot explain it, you should not deploy the system.

For human oversight, Art. 26(2) AI Act requires persons with the necessary competence, training and authority. Art. 14(4)(b) names the tendency to rely automatically on the output as a risk that oversight persons should remain aware of. So train managers not only to operate the tool but to distrust its suggestion.

Evidence11121314151617

Which legal basis carries data from appraisals and talks?

The employment relationship, but not alone. Section 26(1) sentence 1 of the Federal Data Protection Act (BDSG) permits processing employees' personal data for the purposes of the employment relationship. Consent comes into question only if it is freely given, and in judging voluntariness the employee's dependence must be taken into account (section 26(2) BDSG). For appraisal data, consent is therefore weak ground. The participation rights of employee representatives remain unaffected under section 26(6) BDSG.

Art. 88 GDPR allows member states and collective agreements to provide more specific rules on employee data. Anyone relying on a works agreement should know that on 19 December 2024 (C-65/23) the Court of Justice ruled that such agreements must meet not only the requirements of Art. 88(2) GDPR but also the general provisions of the GDPR (as summarised by Heuking). The works agreement is not a free pass.

That can become expensive, as a Federal Labour Court case shows. In its judgment of 8 May 2025 (8 AZR 209/21), the court awarded an employee EUR 200 in damages under Art. 82 GDPR because, during the test operation of HR software, the employer had transferred data to the parent company outside the works agreement. The amount is small, the lesson is not: data beyond the agreed purpose is a liability case of its own, even in testing.

For systematic and extensive evaluation of personal aspects by automated processing, Art. 35(3)(a) GDPR requires a data protection impact assessment. AI-assisted performance evaluation will as a rule meet that. It belongs before rollout and should use the information the vendor has to provide anyway. The basics are on the page GDPR and AI in HR.

Evidence1819202122

What does the works council co-determine on AI in appraisals?

More than many expect. Two provisions carry it: section 94(2) of the Works Constitution Act (BetrVG) extends the consent requirement to the setting of general appraisal principles, and section 87(1) no. 6 BetrVG gives the works council a co-determination right over the introduction and use of technical systems intended to monitor the behaviour or performance of employees. Where there is no agreement, the conciliation board replaces it.

Objective suitability is enough. On 13 December 2016 (1 ABR 7/15) the Federal Labour Court ruled that what matters is the objective suitability of the system to collect behaviour or performance information, not the employer's intent. On 23 October 2018 (1 ABN 36/18) it clarified that there is no minor-significance threshold and that software-based personnel systems are covered, down to Excel. Anyone who says the AI is only meant to write texts must therefore expect the question whether it collects performance data on the side.

The works council may also get help. Where it must assess the introduction or use of AI, calling in an expert is deemed necessary (section 80(3) sentence 2 BetrVG), and it must be informed in good time about the use of AI in work procedures (section 90(1) no. 3 BetrVG). Employer and works council must also protect and promote the free development of employees' personality (section 75(2) BetrVG). Plan weeks for the participation process, not days.

There is a limit. On 16 January 2024 (24 BVGa 1/24) the Hamburg Labour Court saw, in interim proceedings, no co-determination right where employees voluntarily use ChatGPT via private accounts and the employer has no access to the data (as reported by Gleiss Lutz). That is a special case that does not carry over to company systems with employer access. It does not work as an argument for appraisals.

Evidence232425262728293031

May AI tools take minutes of appraisal talks?

Only with clear information and, where needed, co-determination. Recording is the delicate part. Under section 201 of the German Criminal Code (StGB), anyone who without authorisation records another person's non-public spoken word on a sound carrier is punishable. An appraisal talk is non-public. A tool that stores the audio track therefore moves into an area you do not regulate with a line in the calendar invite.

Consent is not reliable here. In its 2025 activity report, the Hamburg data protection commissioner writes on automatic transcription of video conferences in the public sector that activating camera and microphone can hardly be read as freely given consent and that consent stands “on shaky ground” (in the original: “auf tönernen Füßen”). The case concerns neither appraisal talks nor the private sector. The assessment of voluntariness fits section 26(2) BDSG, however, and therefore carries over.

Employees also have the right to discuss their appraisal (section 82(2) BetrVG) and to inspect their personnel file (section 83(1) BetrVG). An AI record that only sits in the tool and never reaches the file is a problem because nobody can correct it. Decide what is stored, who sees it and when it is deleted, and have the manager review and approve every record.

I did not find documented evidence that a supervisory authority expressly measures the recording of talks by AI tools against section 201 StGB. The statement above rests on the wording of the provision. Ask your data protection officer before use.

Evidence323334

How fair and effective are appraisals, with or without AI?

Less than assumed, even without AI. Gallup reported in 2017 that only 14 percent of employees strongly agree that the reviews they receive inspire them to improve. The page names neither sample nor survey year, so the figure is an indication and not a benchmark. The meta-analysis by Kluger and DeNisi (1996) on feedback interventions found an average improvement (d = 0.41), but performance dropped in over a third of the interventions. Feedback does not help automatically, and AI does not make it automatically better.

On fairness the situation is uncomfortable because research on LLM-assisted appraisals at work is thin. The closest documented indication is a study in the Findings of EMNLP 2023: LLM-generated reference letters showed significant gender bias in language style and content. Those are reference letters, not appraisals, and I use it only as an analogy. Anyone using AI drafts for appraisal text should spot-check whether drafts for men and women differ in tone.

Legally this is no side issue. Indirect discrimination exists where apparently neutral procedures can put persons at a particular disadvantage because of a ground under section 1 of the General Equal Treatment Act (AGG) (section 3(2) AGG). If there are indications that suggest discrimination, the other party bears the burden of proving that there was no breach (section 22 AGG). If you cannot explain how an AI suggestion came about, it becomes hard to rebut the presumption.

Test your estimate. How many employees strongly agree that appraisals inspire them to improve?

Evidence3536373839

What do vendors of performance and survey tools offer on the AI Act?

Little, as far as it can be checked publicly. I evaluated 30 HR tools from performance management (10), people analytics (7) and surveys or engagement (13). For 21 of them I checked whether the vendor says anything publicly about the AI Act. Five do: three with a document or a statement, two stating that their AI features are, to the best of their knowledge, not high-risk. For 16 I found no statement. For 9 tools the entry had not yet been checked.

The data processing agreement is patchy too. 9 of the 30 tools publish it, 2 require click-through acceptance, and for 19 no entry is recorded. That does not mean it does not exist. It means you have to request it before loading employee data.

What follows? Ask every vendor in writing: is the performance or behaviour of individual employees evaluated? Is profiling carried out? Is there a statement on Annex III? Which logs does the system provide so that you can meet the duties under Art. 26 AI Act? The answers belong in the data protection impact assessment. No vendor is rated here, and the survey rests solely on public information.

Evidence15

What do you settle before introducing AI in appraisals and talks?

Seven things, in this order: the purpose, the tier, the legal basis, the works council, the oversight, the information and the exit. The purpose comes first because it determines the tier. “Smoothing text” and “evaluating performance” are two different projects legally, even if the same tool can do both.

Then the tier, per the self-check above, and the legal basis with a data protection impact assessment. Then the works council, ideally before procurement, with the vendor dossier in hand. How a works agreement can be structured is described on the page about the works council AI agreement. If employees already use AI without approval for appraisal text, the article on employees using AI without approval helps with the first step.

Oversight means: who looks, with what training and which data, and how often that person deviates from the suggestion. Information means: employees learn in advance that and how AI is used and can ask for an explanation. Exit means: you can switch the system off without losing appraisals. The checklist summarises this. Tick what is settled in your case. The state is kept in your browser, and the button below copies it as text.

Evidence623

When you do not need me for this

When use stays in preparation and you have the rules in house. If your team uses AI to word conversation guides or to shape its own notes, without entering personal data and without evaluation, a clear AI policy is usually enough, and your data protection officer or works council carry the rest. You need no outside advice for that.

It is different when a tool is meant to evaluate performance or prepare appraisals and nobody in the house can look at Annex III, works council and impact assessment together. Then I take over the classification as interim or fractional HR manager, lead the conversation with the works council and build the processes so that managers actually decide. Legal advice in an individual case stays with a lawyer.

My most important advice holds regardless of whom you call in: start with the question of which decision the AI prepares, not with the question of which tool can do it.

Evidence1