Digital Transformation: A Legal Roadmap for German Companies

Why digital transformation needs a legal roadmap

Digital transformation is usually framed as a technology and change-management challenge. In Germany, it is also a legal project. A new data platform raises questions under the GDPR and the EU Data Act. A generative AI tool used by staff touches the AI Act, copyright, confidentiality and employee data protection. Moving core systems to the cloud requires robust contracts and, for many companies, compliance with NIS2 or DORA. And almost every new system that processes employee data will be subject to the works council's co-determination rights under the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG).

When these issues surface late, projects stall: a rollout is delayed because a works agreement is missing, a supplier contract cannot be signed because data transfers were not assessed, or a pilot is stopped because nobody classified the AI use case. A legal roadmap avoids this by identifying the legal workstreams early, assigning owners and sequencing them alongside the technical plan.

This article sets out a practical roadmap for digital transformation in German companies, covering five workstreams: data strategy, AI governance, contracts, cybersecurity and employee involvement.

Workstream 1: data strategy and data rights

Data is the raw material of most transformation programmes. The legal questions are who may use which data, for which purposes, and on what terms data can be shared with partners and suppliers.

Personal data. The GDPR requires a legal basis for each processing purpose, transparency towards data subjects, data minimisation and appropriate security. Where new technologies are likely to result in a high risk, a data protection impact assessment is required (Article 35 GDPR). Programmes that combine data sets from different sources, analyse behaviour or use profiling often meet that threshold. A record of processing and clear role allocation between controllers and processors are basic hygiene.

Non-personal and product data. The Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. It gives users of connected products and related services rights to access and share the data they generate, regulates the terms on which data holders make data available to third parties, controls unfair contractual terms on data sharing imposed on businesses and introduces rules on switching between cloud services. Manufacturers must design connected products placed on the market after 12 September 2026 so that data is accessible by default. For industrial companies, this can be a business opportunity as well as an obligation.

Trade secrets. Data sets, models and algorithms are often protected only as trade secrets under the Trade Secrets Act (GeschGehG). Protection requires appropriate confidentiality measures, so access controls, NDAs and classification policies are legal requirements, not only IT measures.

Workstream 2: AI governance under the AI Act

Most digital transformation programmes now include AI, from coding assistants to predictive maintenance and customer service bots. The AI Act (Regulation (EU) 2024/1689) regulates AI by risk category. Prohibited practices and AI literacy have applied since 2 February 2025, and the rules on general-purpose AI models since 2 August 2025.

The timetable changed in 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026, postponed the core high-risk requirements: they now apply from 2 December 2027 for high-risk systems under Article 6(2) and Annex III (for example AI used in recruitment or employee management) and from 2 August 2028 for AI embedded in products under Article 6(1) and Annex I. The omnibus also reworded the AI literacy duty in Article 4: providers and deployers must take measures to support the development of AI literacy of their staff and other persons using AI on their behalf.

A workable AI governance framework includes an AI inventory, a classification procedure, an acceptable use policy for generative AI, rules on confidential and personal data in prompts, human oversight for decisions affecting individuals, and a process for evaluating AI vendors. Our article on the AI Act timeline covers the dates in more detail.

Workstream 3: contracts with suppliers and partners

Digital transformation shifts value into contracts: cloud subscriptions, software development, data licences, AI services and platform partnerships. Typical risks are lock-in, unclear ownership of results, insufficient service levels and liability caps that do not match the business impact of failure.

• Cloud and SaaS: service levels, data protection, security annexes and exit rights, including the Data Act switching rules – see our guide to SaaS and cloud contracts.
• Development projects: classification as a work or service contract, acceptance and change management – see IT contracts for agile projects.
• AI services: use of customer data for training, confidentiality, output rights, indemnities for third-party IP claims and transparency on model changes.
• Data partnerships: purpose limitation, data quality, onward sharing, Data Act compliance and competition law limits on exchanging sensitive information.

Standard terms matter here. Under German law, standard business terms are reviewed for fairness under § 307 BGB even between businesses, which limits how far suppliers can exclude liability and gives customers some leverage in negotiations.

Workstream 4: cybersecurity and operational resilience

Every new interface and cloud service expands the attack surface. For many companies, cybersecurity is also a legal obligation. The NIS2 implementation in the new BSI Act requires particularly important and important entities to implement risk management measures, including supply chain security, and to report significant incidents; management must implement and monitor these measures and can be liable for breaches. Financial entities are subject to DORA, which prescribes ICT risk management and contract content for ICT services.

Even companies outside these regimes have duties: Article 32 GDPR requires appropriate security for personal data, and directors' general duty of care includes adequate IT risk management. Building security requirements into transformation projects from the start – security by design, supplier assessments, incident response plans – is cheaper than retrofitting them. Our guide to cybersecurity and NIS2 explains the regulatory scope.

Workstream 5: employees and the works council

In German companies with a works council, employee involvement is often the critical path of digital transformation. The key rights are:

• Information and consultation on the planning of technical facilities and of work processes, expressly including the use of artificial intelligence (§ 90 BetrVG);
• Co-determination on the introduction and use of technical facilities designed to monitor employees' behaviour or performance (§ 87(1) no. 6 BetrVG). Case law applies this broadly: it is enough that a system is objectively capable of monitoring, which covers most modern software;
• Experts: if the works council must assess the introduction or use of AI, calling in an expert is deemed necessary (§ 80(3) BetrVG), and the employer bears the reasonable costs;
• Operational changes: fundamentally new working methods may constitute an operational change under § 111 BetrVG in undertakings with more than 20 employees entitled to vote, triggering negotiations on a reconciliation of interests and a social plan.

Without the works council's agreement, the employer may not introduce a system subject to § 87(1) no. 6 BetrVG; the works council can seek an injunction. Many companies therefore negotiate a framework works agreement on IT and AI that sets principles – purpose limitation, no performance monitoring without specific agreement, data access rules – and allows individual systems to be added through short annexes.

Intellectual property, competition and consumer law

Three further areas often surface during digital transformation and deserve a place on the roadmap even if they do not justify a full workstream.

Intellectual property. Software, databases and content created in the programme must be owned or licensed in a way that allows the company to use, change and commercialise them. Under German copyright law, the employer acquires rights in computer programs created by employees in the course of their duties, but rights in other works and in results created by freelancers and suppliers must be secured by contract. AI-generated output raises separate questions, because works without sufficient human creative contribution may not be protected at all, so contractual and trade secret protection becomes more important.

Competition law. Data pooling with competitors, joint platforms and industry data spaces can be efficient, but exchanging competitively sensitive information is restricted under Article 101 TFEU and the German Act against Restraints of Competition. Platform businesses may also face specific rules in the Digital Markets Act and in § 19a GWB.

Consumer-facing products. New digital products sold to consumers must comply with the rules on digital content and services in §§ 327 ff. BGB, including the duty to provide updates, as well as e-commerce information duties and accessibility requirements. Building these into product design avoids costly redesigns after launch.

Putting the digital transformation roadmap into practice

A practical sequence for a digital transformation programme looks like this:

1. Mobilise: appoint a legal workstream lead, map the programme's initiatives and identify the legal touchpoints for each.
2. Assess: run data protection, AI classification, security and co-determination checks for each initiative; flag show-stoppers early.
3. Frame: adopt group policies on data, AI use and supplier management, and negotiate a framework works agreement.
4. Contract: use templates and negotiation playbooks for recurring supplier contracts; review strategic contracts individually.
5. Operate: keep inventories of processing activities, AI systems and suppliers up to date; train staff; monitor regulatory change.
6. Review: report to management and the supervisory board on legal risks of the programme, since directors are responsible for adequate risk management.

The order matters less than the principle: legal requirements should be inputs to design decisions, not a final approval step.

How TRW & Co helps

We support German companies and international groups with the legal side of digital transformation. We set up legal workstreams for transformation programmes, draft data, AI and supplier policies, classify AI use cases under the AI Act, negotiate cloud, software and data contracts, and advise on NIS2 and DORA compliance. Together with our employment team, we negotiate framework works agreements on IT and AI with works councils. Our work connects with our AI Act and works councils practices. Please contact us to discuss your programme. This article is general information and not legal advice.