
SCHUFA shadow database: what data subjects should know
SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read articleSince this week, Art. 50 of the AI Act has required companies to disclose when users are communicating with an AI rather than a human. Anyone using a chatbot, a voice assistant or automatically generated content should act now.
Since 2 August 2026, Art. 50 of the AI Act (Regulation (EU) 2024/1689) has applied directly throughout the EU. The provision obliges providers and deployers of certain AI systems to disclose their use: anyone communicating with a chatbot, a voice assistant or an AI-supported customer service must be able to recognise this — at the latest at the first contact, not only in the small print. AI-generated or manipulated content such as text, images, audio or video is also subject to a labelling obligation, for example in the case of deepfakes or automatically created marketing texts that are intended to appear to have been written by a human. Infringements can be punished with fines of up to 15 million euros or — for larger companies — up to three per cent of worldwide annual turnover, whichever is higher.
Considerably more companies are affected than many realise. A chatbot on one's own website, an AI-supported ticketing system in customer service, automatically generated product descriptions or social media posts — all of this falls within the scope as soon as the AI generation is not already obvious to the average user. Because the obligation literally came into force this week, even well-staffed legal departments have often not yet reviewed it systematically — unlike the GDPR, there are no years of interpretative practice to go by here.
For technical implementation, an important distinction applies: the mere notification obligation — the clear, clearly visible notice that an interaction with an AI is taking place or that content is AI-generated — already applies now, without a transitional period. For machine-readable marking, i.e. the technical labelling that automated systems can also read, a grace period runs until 2 December 2026. Anyone who confuses the two and believes they have until December underestimates the actual risk: it is the missing notice in user contact that is noticed first and penalised first.
For companies, a short, targeted check is worthwhile now: which AI systems are used in customer contact, is the labelling clear and placed in the right position, and is this also documented for content creation in marketing, social media and customer communication? In most cases, this can be checked and remedied quickly — before it becomes an issue for the supervisory authority.

SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read article
Art. 13 Data Act reviews unilaterally imposed data clauses between businesses: scope, black and grey list, legal consequences.
Read article
The BGH sets out what determines the amount of GDPR damages: punitive character or deterrence are not criteria.
Read article