Public administrations, associations and education providers are under pressure: more tasks, fewer staff, rising expectations for digital services. Artificial intelligence can bring noticeable relief here. At the same time, stricter standards apply than in the private sector. This overview shows what makes sense today, what the legal framework requires and what a good start looks like.
Where AI really helps today
The biggest effects rarely lie in spectacular projects, but in daily routine:
- Sorting and answering enquiries: Emails are categorised by topic and routed to the right place, and draft replies are generated from a maintained knowledge base. Example workflow
- Texts and summaries: Templates, minutes, press releases and summaries of long documents as drafts.
- Registrations and events: Forms, confirmations and overviews run automatically.
- Internal workflows: Leave requests, onboarding, reports. More workflows in the library
What all the examples have in common: the AI prepares, a person decides.
What the legal framework requires
Data protection
The GDPR continues to apply unchanged. What matters is where data is processed, whether a data processing agreement is in place and whether the processing is documented in the record of processing activities. Solutions that run on servers in Germany or in your own data centre make the assessment much simpler.
EU AI Act
The AI Act is coming into force in stages and was revised on some points in 2026. For public administrations and associations, the following points are currently the most relevant:
- Prohibited practices have applied since February 2025, such as certain forms of scoring people based on their social behaviour. For typical administrative tasks, this hardly plays a role in practice.
- AI literacy: Anyone who uses AI must take measures to promote the AI literacy of their staff. Since the revision, no specific level is prescribed, but the obligation to take measures remains. To our AI training
- Transparency: Anyone who offers, for example, a chatbot for citizens must make clear that they are talking to an AI.
- High-risk systems, such as AI that helps decide access to public services, are subject to strict requirements. After the revision, these apply from December 2027.
Co-determination
When technical systems are introduced that change work or could evaluate behaviour and performance, the staff representation generally has to be involved. Involving them early saves time later and builds acceptance.
As of November 2026. This overview does not replace legal advice. Binding information is provided by your data protection officer and your legal department.
Getting started in five steps
Set the rules. A short AI policy defines which tools are allowed and which data does not belong in them.
Train the team. So everyone knows what AI can do, where its limits are and what is allowed.
Choose a pilot. A manageable, frequent task with clear benefits and no high-risk connection.
Involve data protection and IT early. And the staff representation if working processes change.
Evaluate and expand. What did the pilot deliver? Build on that to tackle the next workflows.
Your own platform or a cloud service?
To get started, business versions of well-known AI services with a data processing agreement are often enough. As soon as personal data or many workflows come into play, your own automation platform on German servers or in your own data centre pays off. You keep control of the data, costs don't depend on the number of uses, and you are not tied to one provider. How something like this is set up is shown in our insight “Your own AI platform”.
FAQ
Are employees in public administration allowed to use ChatGPT and similar services?
That depends on the rules of your organisation. In principle: personal and confidential data does not belong in freely available services. For business use, business versions with a data processing agreement or your own solutions on German servers come into question. A written AI policy creates clarity.
Do we have to train our employees?
Under the EU AI Act, anyone who uses AI must take measures to promote AI literacy. Since the 2026 revision, a specific level is no longer required. Documented training is still the simplest proof and above all helps in practice.
What counts as high-risk AI?
Among others, AI systems that help decide access to public services. Strict requirements apply to such systems, taking effect from December 2027 after the revision of the regulation. Assistance with drafting, summarising or sorting enquiries generally does not fall under this, as long as a person decides.
