AI and HR data: GDPR risks and EU-hosted alternatives

Why HR data in US AI services is risky, what the GDPR, the AI Act and works councils require, and which EU providers host open models.

Putting HR data into AI tools is everyday practice for many HR teams, but legally it is one of the most sensitive cases: whether it is a job advert, an appraisal or a sick note, the data involved enjoys special protection under data protection law. According to a Bitkom survey of 604 companies with 20 or more employees from October 2025, 8 percent of companies describe the use of private AI tools by employees as widespread, and 17 percent report isolated cases. These are the companies' assessments, not those of the employees.

Giving HR data to US AI services is not prohibited across the board, but it is tied to conditions that look shaky in 2026: the data protection framework between the EU and the US is before the courts, and US access rights apply regardless of where the data centre is located. There is a second route, namely open models in the EU, run by yourself or by EU providers. This article puts the law, the practice and the providers in context.

Transparency note: Sentient Dynamics builds such solutions for customers. We therefore rely mainly on statutes, court decisions, statements by authorities and the providers' own information, and additionally on specialist articles, press reports and retailer prices, each with a date. We describe the providers by the same criteria.

As of 16 October 2026

TL;DR

Legal position: HR data often contains special categories (Art. 9 GDPR), decisions based solely on automated processing with a significant effect, for example on applicants, are in principle not permitted (Art. 22), and the works council has a say.
US services: For US transfers, the main options are a Data Privacy Framework (DPF) certification that covers HR data, or standard contractual clauses with an assessment; Chapter V GDPR provides for further safeguards and narrowly limited derogations. The DPF is being challenged before the Court of Justice of the EU (CJEU), and US disclosure obligations also apply to data in EU data centres.
Alternative: Open models in the EU (your own hardware, rented EU servers or EU providers). The GDPR obligations remain, the third-country transfer falls away as long as processing and access stay in the EU.

Why HR data is particularly sensitive

HR data is sensitive more often than many HR teams assume. Art. 9(1) of the General Data Protection Regulation (GDPR) prohibits the processing of health data and of data revealing, for example, religious beliefs or trade union membership (GDPR). In personnel files, this affects sick notes and severe disability, because according to Recital 35 everything from which information about a person's state of health can be derived counts as health data.

In our assessment, church tax details in payroll can also reveal religious affiliation. The CJEU interprets health data broadly (C-21/23, 4 October 2024, on medicine orders): this includes data from which the state of health can be inferred.

Art. 9(2)(b) GDPR and Section 26(3) of the Federal Data Protection Act (BDSG) permit the processing of special categories where it is necessary for rights and obligations under employment law. In our reading, this does not allow you to copy personnel files into just any AI tool.

The legal basis is also uncertain for ordinary HR data. Since a CJEU judgment on a comparable Hessian provision (C-34/21, 30 March 2023), the Federal Labour Court (BAG) leaves Section 26(1) BDSG unapplied as a legal basis, and lawfulness is assessed directly under Art. 6 GDPR (BAG, 8 May 2025, 8 AZR 209/21; on sentence 1 already BAG, 9 May 2023). In the same judgment it awarded the sole claimant EUR 200 in damages because the employer had transferred HR data to the US parent company for a test of the Workday cloud software beyond what a works agreement covered.

The BAG did not examine the third-country question there, so this is not a ban on US transfers. In assessing the amount, it took into account that the data was below the Art. 9 threshold; for health data, more would in our assessment be expected.

An Employee Data Protection Act is meant to clarify this, but none is in sight: the ministry draft bill of 8 October 2024 failed with the previous "traffic light" coalition, the immediate action programme of May 2025 announces the act, and on 22 April 2026 the federal government described the preparatory work within government as ongoing. As of 16 October 2026 we have not found a draft.

For applicants, Art. 22 GDPR applies: data subjects have the right not to be subject to a decision based solely on automated processing with a significant effect (GDPR). After the SCHUFA judgment (C-634/21, 7 December 2023), even a score is such a decision if the recipient attributes a decisive role to it. The Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI) considers this transferable to applicant selection where algorithms alone decide, and the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) calls the judgment groundbreaking for AI-supported decisions as well.

The German Data Protection Conference (DSK) treats an AI that evaluates all applications and invites candidates to interviews on its own as a breach of Art. 22(1); merely formal involvement of a human is not enough. Anyone who evaluates in an automated way must also be able to explain which data went in and how (CJEU C-203/22, 27 February 2025).

The General Equal Treatment Act (AGG) adds to this: applicants count as employees, and where there are indications of discrimination, the employer bears the burden of proof under Section 22 AGG. Reuters reported in 2018 on an Amazon tool, since abandoned, that downgraded CVs containing the word "women's"; Amazon said recruiters never used it to evaluate candidates. The planned extension of the deadline in Section 15(4) AGG from two to four months has not been adopted following the hearing of 5 October 2026.

What happens when you use US AI services

Giving HR data to US AI services is permitted if the conditions of Chapter V GDPR are met, and it is precisely these conditions that are uncertain in 2026. Under Art. 44 to 46 GDPR, a transfer needs an adequacy decision or appropriate safeguards, such as the standard contractual clauses of Decision (EU) 2021/914, whose Clause 14 requires an assessment of the law and practice in the destination country. Chapter V also names further safeguards such as binding corporate rules (Art. 47) and narrowly limited derogations (Art. 49). Art. 48 in principle allows the recognition or enforcement of disclosure orders from third countries only on the basis of an international agreement; other transfer grounds under Chapter V remain unaffected. In our reading, Art. 48 does not remove a disclosure obligation that US law imposes on a US provider.

The adequacy decision on the Data Privacy Framework (DPF) of 10 July 2023 applies only to organisations on the DPF list. HR data is covered only if the certification expressly includes it. You should therefore check on the DPF list whether the provider is actively listed and covers the data type "HR Data".

The General Court of the EU dismissed the action against the decision on 3 September 2025, the appeal C-703/25 P has been pending before the CJEU since 31 October 2025, and we have found no hearing date or Advocate General's opinion. On 30 June 2026, noyb announced an action against the decision; we found no action filed by 16 October 2026.

On 29 June 2026, the Supreme Court declared the removal protection of the FTC commissioners unconstitutional in Trump v. Slaughter. The European Data Protection Board asked the Commission on 31 July 2026 to examine whether this affects the functioning of the DPF, without calling for repeal or suspension; we found no published reply. According to its agency page, the oversight body PCLOB has only one member, while the statutory quorum is three.

The statutory basis of FISA Section 702 expired on 12 June 2026 and, according to our research, had not been reauthorised on 16 October 2026. According to the Brennan Center and EPIC, collection continues on the basis of the FISA court certifications of 17 March 2026, and according to The Hill the government is pushing for an extension. Whether that holds up is disputed.

Independently of this, the CLOUD Act obliges US providers to disclose data in their "possession, custody, or control", whether located inside or outside the US. A representative of Microsoft France was unable to guarantee before the French Senate on 10 June 2025 that data of French citizens would never be handed over after a US order without the consent of the French authorities; he said, however, that this had never happened.

On 26 February 2025, Microsoft completed its EU Data Boundary, and OpenAI offers data residency in Europe for the API and for new Enterprise and Edu workspaces. The storage location still does not resolve the question of US access, because the CLOUD Act turns on the company's control.

On training with inputs, providers distinguish by offering: OpenAI does not use business customers' inputs for model training by default, whereas for consumer services it may use content as long as the user has not switched this off. If a processor determines the purposes itself, it counts as a controller under Art. 28(10) GDPR. If a provider reserves the right in its terms to use data for its own purposes, then according to the HmbBfDI no personal data may be transmitted, expressly including that of your own employees.

The DSK recommends excluding training use and presetting employee accounts without input training and without history beyond the session. It follows that anyone who copies HR data into a private ChatGPT account has no data processing agreement (DPA) and, by default, no training exclusion.

What the AI Act requires for HR software

The AI Act classifies many HR applications as high-risk, but the obligations for them apply only from 2 December 2027. Annex III point 4 covers AI systems intended to select applicants (placing targeted job adverts, analysing and filtering applications, evaluating applicants) or to affect working conditions, promotion, termination, the allocation of tasks based on individual behaviour or personal traits, and the monitoring of performance and behaviour. Under Art. 6(3), profiling always makes an Annex III system a high-risk system, and the GDPR expressly counts the evaluation of work performance as profiling.

The later date is set by Regulation (EU) 2026/1744, in force since 27 July 2026. What it changes for Art. 4 is explained in our article on AI literacy: the obligation has applied since 2 February 2025, and since 27 July 2026 it requires measures to support AI literacy, without guaranteeing a particular level. Since 2 August 2026, providers of chatbots must make it recognisable that people are talking to an AI, see our article on Art. 50.

Since 2 February 2025, Art. 5(1)(f) has in principle prohibited AI systems that infer the emotions of people in the workplace; the only exceptions are medical and safety reasons, which the Commission interprets narrowly. The Commission guidelines give webcam and voice recognition in call centres and emotion recognition in the application process as examples; the prohibition does not cover inference from written text, because it presupposes biometric data. Breaches can cost up to EUR 35 million or, if higher, 7 percent of worldwide annual turnover, with the lower amount applying to SMEs; we have found no fine decision on this by 16 October 2026.

From 2 December 2027, employers that use a high-risk system at the workplace must inform workers' representatives and affected employees in advance; existing participation rights remain unaffected under Recital 92. They keep logs under their control for at least six months, unless data protection law requires otherwise, and affected persons must be informed about the use. A fundamental rights impact assessment under Art. 27 does not, on its wording, concern ordinary private employers.

Where the line runs is shown by the Commission's draft of 19 May 2026 (not binding, final version planned by the end of 2026). According to it, a tool that evaluates CVs with scores or rankings is high-risk even if recruiters can override it. An assistant for questions about policies does not fall under point 4(a), but can fall under point (b) if it influences working conditions or feeds into performance evaluations; a writing assistant that only improves the language of promotion reports that have already been fully drafted is not considered high-risk.

In our assessment, anyone who uses an open model only internally does not automatically become a provider. Provider obligations may arise if you put a system you developed yourself into service under your own name for a high-risk purpose, substantially modify a high-risk system, or change the intended purpose of a general-purpose system so that it becomes high-risk (Art. 3 and 25). In Germany, the Federal Network Agency (Bundesnetzagentur) supervises the HR systems of private employers, on the basis of the German AI Market Surveillance Act (KI-MIG); details are in our article on the KI-MIG.

Template

AI policy with an agent annex

Request the template

Works council and supervision: what practice shows

The works council often has a say on AI tools. Under Section 87(1) no. 6 of the Works Constitution Act (BetrVG), it has co-determination rights over technical devices intended to monitor the behaviour or performance of employees, and according to the BAG (13 December 2016, 1 ABR 7/15) objective suitability is enough for this. Since 18 June 2021, the following have been added: information on the use of AI (Section 90), the deemed necessary consultation of an expert (Section 80(3)) and selection guidelines involving AI (Section 95(2a)).

The Labour Court of Hamburg (ArbG Hamburg) denied co-determination on 16 January 2024 (24 BVGa 1/24) where the employer allowed ChatGPT via private accounts in the browser. That decision was made in interim relief proceedings and does not apply to company tools. A simplification of co-determination on software has been announced but not adopted: the coalition committee asked the social partners for proposals in early July 2026, the Confederation of German Employers' Associations (BDA) submitted proposals in September 2026, there is no government draft, and Section 87(1) no. 6 applies unchanged.

The DSK must-list for the data protection impact assessment (DPIA) names, under no. 8, extensive processing of employee behaviour to evaluate work activity and, under no. 11, AI for evaluating personal aspects. The Bavarian Data Protection Authority (BayLDA) cites as an example applicant data that an AI product pre-classifies. Cases:

H&M 2020: EUR 35,258,707.95 (EUR 35.3 million), announced on 1 October 2020, because private circumstances and health data of employees were recorded at the service centre in Nuremberg and used for decisions.
Amazon France Logistique: On 27 December 2023, the CNIL imposed EUR 32 million, among other things for scanner surveillance; the Conseil d'État reduced the amount to EUR 15 million on 23 December 2025.
Foodinho (Glovo): On 13 November 2024, the Italian data protection authority (Garante) ordered EUR 5 million, among other things for algorithmic management of more than 35,000 riders.
Myndoor: On 14 May 2026, the Garante warned a provider whose AI plug-in analyses Slack and Teams messages for stress about possible data protection breaches, and also referred to the ban on emotion recognition. It imposed no penalty, and it did not find a breach of Art. 5 of the AI Act.
Spain: On 23 September 2026, the AEPD warned a company that intends to introduce an AI tool for screening and prioritising CVs; this is not a sanction.
France: On 3 April 2026, the CNIL announced that it would check recruiting in 2026.

None of these cases involves a US AI service as the recipient of HR data; they show how supervisory authorities assess profiling and algorithmic management of employees.

Route A: running open models yourself

If you do not want to give HR data to third parties, you can run open models yourself. Open means: the weights can be downloaded, and the licence decides on use. For summarising, drafting job adverts or answering questions about policies via RAG, a mid-sized model is in our assessment sufficient.

For RAG, the DSK considers it possible to use a model with less factual knowledge and, under some circumstances, to run the system on-premises, without transmitting data to online operators of large language models.

Examples with licence, as of October 2026: Qwen3.8-27B (Apache 2.0, FP8 about 31 GB according to Unsloth), Gemma 4 31B (Apache 2.0), Kolibri-1 from Aleph Alpha (Apache 2.0, German and English only, at least one H200 or two H100) and Mistral Small 4 (Apache 2.0). In the Aleph Alpha table, Qwen3.8-27B scores 79.9 on German against 70.8 for Kolibri-1; this is a measurement by a competitor of Alibaba, not an independent one.

The licences contain traps: Llama 4 grants no rights to companies headquartered in the EU, Mistral Medium 3.5 may not be used without a separate commercial licence by anyone with more than USD 20 million in monthly revenue, and Qwen3.8-Flash-Next needs its own licence for business as an "AI Work Assistant"; internal use is free.

In FP8, Qwen3.8-27B needs about 31 GB for the weights according to Unsloth, plus memory for the KV cache, which grows with context length and the number of concurrent users. A card with 96 GB (RTX PRO 6000) offers headroom for this; how many users it can carry has not been measured for this model, and you have to test it with your own tasks. For two such cards, Geizhals and JACOB together quote about EUR 31,000 to 41,400 gross on 16 October 2026, with the host on top.

For rental, Hetzner offers the GEX63 with this card for EUR 999 net per month plus a EUR 999 setup fee, location Helsinki. The location details on the Hetzner pages partly contradict each other, so check the location when you order. At IONOS, an H200 costs EUR 3 net per GPU hour on an hourly basis.

To operate this you need tools with data protection switches:

vLLM (Apache 2.0) does not log requests by default; prompt contents appear only when request logging is switched on at DEBUG level, and the usage statistics can be switched off.
LiteLLM (MIT outside enterprise/) stores prompts only when a switch is set and can delete logs after a defined period. On 24 March 2026, two PyPI versions were compromised; pin your versions.
Open WebUI has been under its own licence with a branding clause since version 0.6.6. By default, admins can read other users' chats (ENABLE_ADMIN_CHAT_ACCESS), which matters for HR.

Running it yourself does not solve everything: you still need a data processing agreement (DPA) with the data centre or server lessor, and security and updates remain your job. According to our own market research, it rarely pays off on cost alone; the main reason is data sovereignty.

Route B: EU providers for open models

We describe all providers by the same criteria: registered office and owner, location, contract and data use, audit reports and certifications, example price. The prices are list prices, net, per 1 million tokens, as of 16 October 2026. More on contract and data use is in the article on ChatGPT alternatives, and model prices are compared in the LLM comparison 2026.

Provider	Service location	gpt-oss-120b, input / output
IONOS	Germany	EUR 0.15 / 0.65
STACKIT	Germany (region EU01)	EUR 0.45 / 0.65
T-Systems	Germany	EUR 0.20 / 0.65
OVHcloud	France (Gravelines)	EUR 0.08 / 0.40
Scaleway	France (Paris)	EUR 0.15 / 0.60
Nebius	Region only for Dedicated Endpoints	0.15 / 0.60, currency not stated, billed in USD

IONOS AI Model Hub

IONOS Cloud GmbH in Montabaur, part of IONOS Group SE, in which United Internet AG holds 63.8 percent (as of 30 June 2026).
Inference in Germany; according to the IONOS documentation, the DPA is part of the contract, there are no subprocessors, and prompts and outputs are never logged or used for training.
C5:2020 Type 1 (reporting date 28 May 2026); whether the Model Hub is one of the 33 audited services is open.
High-risk use is permitted, the obligations lie with the customer.

STACKIT AI Model Serving

Schwarz Digits Cloud GmbH & Co. KG, part of the Schwarz Group (STACKIT Facts); region EU01 in Germany.
According to the FAQ, no storage and no training; according to the service certificate, version 1.3, email and subject ID remain in the logs for 30 days.
A DPA for STACKIT Cloud Services is publicly available.
C5 Type 2; the product is on the list of C5-certified products.

T-Systems AI Foundation Services

T-Systems International GmbH, 100 percent owned by Deutsche Telekom; platform T Cloud Public (until January 2026 Open Telekom Cloud), data centres in Biere and Magdeburg.
According to the model page, open models run in Germany; according to the trust page, proprietary US models in the same catalogue are forwarded to Azure or Google, so for HR data only with a model allowlist.
According to the trust page, not designed for high-risk AI, so not intended for ranking applicants. The prefix cache is on by default and can be switched off; the Essential plan has a minimum spend of EUR 1,000 per month.
A DPA based on the Telekom template is available on request according to the trust page. According to the service description, models operated by Telekom do not store prompts and responses permanently and do not train on them.
According to the trust page, ISO 27001 concerns the operating organisation; T Cloud Public additionally names BSI C5 Type II, but whether that covers the AI Foundation Services is not evidenced.

OVHcloud AI Endpoints

OVH Groupe SA in Roubaix, 79 percent owned by the Klaba family (as of 5 December 2025); operation in Gravelines.
Zero Data Retention in standard mode, no training; ISO 27001, SOC 2 Type II and HDS.
According to the contract terms, outputs should not be used without human review, especially where the rights of individuals are concerned.
The DPA (version of 17 October 2025) is part of the agreement.

Scaleway Generative APIs

Part of the French iliad group (About), data centre in Paris.
Zero Data Retention by default, with exceptions for abuse or errors (Privacy Policy).
ISO 27001 and HDS; according to Scaleway, SecNumCloud is under assessment, not granted.
A DPA is available in the contract documents; according to the Privacy Policy, inputs are not used to train the base models.

Nebius Token Factory

Nebius Group N.V. in Amsterdam, which emerged from Yandex N.V. (sale of the Russian business on 15 July 2024).
Regions in the EU, Israel, the US and the UK; a fixed region exists only for Dedicated Endpoints, while Serverless comes without a region commitment.
Zero Data Retention is optional, otherwise inputs are stored for speculative decoding; on 16 October 2026 the US subsidiary Nebius Inc. is listed as active on the DPF List, but for "Non-HR Data" only, so this certification does not cover HR data. For HR data, we recommend a Nebius Dedicated Endpoint in an EU region with Zero Data Retention; the specific processing arrangements and any access from third countries also require assessment.
According to the terms of service, the contracting party is Nebius B.V. in Schiphol (Netherlands); the DPA is part of the terms.
According to the Legal Quick Guide, Nebius names ISO 27001, ISO 27701 and SOC 2 Type II as evidence.
According to the Legal Quick Guide, the standard contractual clauses also apply to administration, maintenance and support access from outside the EEA, for example by Nebius companies in the US, Israel or Serbia.

Mistral AI

Paris; EU endpoint api.eu.mistral.ai with a 10 percent surcharge.
The Trust Center (retrieved 16 October 2026) lists subprocessors including Mistral Compute (France), CoreWeave (EEA), Microsoft for cloud infrastructure in Sweden and Norway, and Google in the Netherlands, Belgium and the United States (US API endpoint); for web search and image generation in Vibe and Studio/API it lists Brave Software, Inc. and Blackforest Labs Inc., both located in the United States.
Zero Data Retention is available only on request for stateless API calls; the addendum allows training as a controller unless you have objected.
Medium 3.5 has the licence threshold mentioned above; Large 4 is so far available only as a preview version via API.
Mistral states that it meets SOC 2 Type II as well as ISO 27001 and 27701 (Help Center).

Aleph Alpha

Heidelberg; the platform is available on-premises, air-gapped or as sovereign SaaS, and Kolibri-1 has been available with open weights since early October 2026.
The merger with Cohere (Canada) has been bindingly agreed since 16 September 2026, but has not been completed and is subject to approval.
Price, DPA and certificate list are not public on the website.

Special cases: DeepL offers translation and text improvement. After agreeing to the AWS terms, content can be processed worldwide; regional data residency is available as an add-on for sales-assisted Team, Business and API for Business plans, and is included in DeepL for Enterprise. Black Forest Labs supplies only images and may use inputs for training unless you object, so it is unsuitable for staff photos. Hetzner rents out hardware only.

On audit reports and certifications: with BSI C5, Type 1 assesses the suitability of the measures at a reporting date, while Type 2 also assesses their effectiveness over a period; C5 is an attestation, not a BSI certificate, and C5:2026 becomes mandatory from 1 June 2027. The EU scheme EUCS had not been adopted as of October 2026, and the Cloud and AI Development Act exists only as a proposal.

What remains mandatory even with EU hosting

With EU hosting, the GDPR obligations remain; the third-country transfer falls away only if subprocessors and remote access, for example for support, also stay in the EU.

Data processing: With the provider or server lessor you need an agreement under Art. 28(3) GDPR; according to the DSK, a cloud provider, as an extended arm, often acts as a processor. Breaches of Art. 28 and 35 can cost up to EUR 10 million or, if higher, 2 percent of worldwide annual turnover, and breaches of Art. 9 and 22 up to EUR 20 million or, if higher, 4 percent.
Impact assessment: Art. 35 GDPR requires one where processing is likely to result in a high risk; according to the DSK, this is often the case for AI applications.
Works council: Involve the data protection officer and the works council early. A works agreement does not cure processing that is contrary to the GDPR (CJEU, 19 December 2024, C-65/23).
Record of processing activities: An HR assistant belongs in the record under Art. 30, together with the hosting service provider and deletion periods, which you must present to the supervisory authority on request.
Deletion concept: Regulate inputs and chat histories, logs and the vector database separately. DIN 66398 has been withdrawn, its successor is DIN EN ISO/IEC 27555; the Standard Data Protection Model (SDM) requires written deletion periods in the record (module 60). With RAG, documents can be deleted selectively, but the problem inside the model remains.
Roles and permissions: For RAG, the DSK requires a rights and roles concept for the vector database and reference documents, because inside the model you cannot control who sees what (module 51).
Logging without contents: Module 43 in version 2.0 has applied since 1 June 2026 and, as a rule, provides for leaving personal data and content data out of the log.
Pseudonymisation before the model: Under the EDPB Guidelines 01/2025 (consultation version), pseudonymised data remains personal data; on 4 September 2025 the CJEU differentiated by recipient. Presidio (MIT) needs adaptation for German, and the vendor warns of gaps. According to its maker, the German spaCy model reaches about 92 percent recall for personal names on news texts; for HR documents this is not evidenced.
Tools: LLM Guard has been archived since 9 July 2026, so we do not recommend it. LiteLLM can use Presidio before the call.
Human decision: Decisions based solely on automated processing with legal or similarly significant effect are in principle not permitted; exceptions and safeguards are governed by Art. 22(2) to (4) GDPR. The DSK requires that a human with real room for judgement makes the decision.

A hybrid approach uses a gateway that removes or replaces names and identifiers before a request reaches an external model. This lowers the risk but does not make the data anonymous. For Art. 9 data and evaluations of applicants, the route via EU hosting or self-hosting remains in our assessment the safer one.

Checklist for HR and IT leads

List all AI tools into which HR data flows, including private accounts, and regulate their use in an AI policy.
Check whether special categories under Art. 9 GDPR are affected, and clarify an exception for them.
For every US service, clarify the transfer basis, usually a DPF entry with "HR Data" or standard contractual clauses with a documented assessment.
Exclude training on inputs, both contractually and in the settings.
Conclude a data processing agreement with every provider or lessor.
Involve the data protection officer and the works council early, and regulate the use in a works agreement.
Carry out a data protection impact assessment before you have applicants or employees evaluated.
Enter the assistant in the record of processing activities, with the hosting service provider and deletion periods.
Classify every use case under Annex III point 4 and plan the deployer obligations from 2 December 2027.
Have HR decisions made by humans with real room for judgement.
Restrict roles and permissions, especially in RAG databases, and log without contents.
Pin the versions of the operating tools, check the licences and switch off the logging of contents.

How we build this for you

Sentient Dynamics builds and operates the approach described here for customers. Together with you, we select the open models, check their licences and build the environment in which your HR data is processed.

We start with your HR tasks: what should the assistant be able to do, and what data does it need for that? That shows which route from this article fits you. We implement it for you:

Selection of open models, including a licence check, for your tasks
Deployment on your hardware or on hardware rented in the EU
Gateway with pseudonymisation and logging without content
Connection to HR processes, for example questions about policies and works agreements via RAG, and drafts for job adverts
Data protection documents: entry in the record of processing activities, preparatory work for the data protection impact assessment and documents for the works council
Operation and updates of the whole environment

We build and operate this for you; the legal assessment remains with you and your data protection officer. If you would like to plan the route together, we first discuss your initial HR tasks: Book a session.

FAQ

May I enter HR data into ChatGPT or another US AI service?

Not prohibited across the board, but tied to conditions: you need a legal basis, for special categories an exception under Art. 9, a data processing agreement and a transfer basis under Chapter V, usually a DPF entry with "HR Data" or standard contractual clauses with an assessment. If the provider reserves the right to use data for its own purposes, then according to the HmbBfDI no employee data may be entered. The framework is uncertain on 16 October 2026 because the appeal against the DPF decision is pending before the CJEU.

No. An EU provider does not automatically remove third-country transfers; also check subprocessors and remote access. The obligations concerning processing by a processor, a legal basis, an impact assessment and works council involvement still apply. The providers also differ: T-Systems also lists US models in its catalogue, Nebius offers fixed regions only for Dedicated Endpoints, and Mistral uses US corporations as subprocessors.

Is an HR chatbot high-risk AI under the AI Act?

Not automatically; it depends on the intended purpose. According to the Commission draft of 19 May 2026, a CV ranking is high-risk, while an assistant for questions about policies does not fall under point 4(a), but can fall under point (b) if it feeds into performance evaluations. The obligations apply from 2 December 2027, the notice about AI interaction under Art. 50 since 2 August 2026.

Does the works council have to approve an AI tool?

Often yes: for technical devices that can monitor behaviour or performance, it co-determines under Section 87(1) no. 6 BetrVG, and objective suitability is enough for this. The Labour Court of Hamburg denied this on 16 January 2024 only for permitted use via private accounts in the browser, in interim relief proceedings. A statutory simplification had not been adopted as of 16 October 2026.

What hardware does my own language model for HR tasks need?

A 27B-class model such as Qwen3.8-27B needs about 31 GB for the weights in FP8 plus memory for the KV cache; a card with 96 GB offers headroom, and the number of concurrent users has not been measured. Two such cards cost about EUR 31,000 to 41,400 gross (as of 16 October 2026) plus host; renting is possible at Hetzner from EUR 999 net per month, and at IONOS on an hourly basis from EUR 3 net per H200 hour.

This article is not legal advice; assessing your individual case is up to you and your data protection officer.

Sources

All pages retrieved on 16 October 2026 unless stated otherwise.

Bitkom, Beschäftigte nutzen vermehrt Schatten-KI, press release (21 October 2025): bitkom.org
European Union, Regulation (EU) 2016/679 (GDPR), Art. 4, 9, 22, 28, 30, 35, 44 to 49, 83 and Recital 35 (Official Journal of 4 May 2016): eur-lex.europa.eu
Haufe, Kirchensteuer im Lohnsteuerabzugsverfahren: Religionszugehörigkeitsschlüssel (no date given): haufe.de
Court of Justice of the European Union, press release No 159/24 on C-21/23 (4 October 2024): curia.europa.eu
Federal Ministry of Justice, Section 26 BDSG (as of 16 October 2026): gesetze-im-internet.de
Court of Justice of the European Union, press release No 54/23 on C-34/21 (30 March 2023): curia.europa.eu
Federal Labour Court, judgment 8 AZR 209/21 (8 May 2025): bundesarbeitsgericht.de
Federal Labour Court, order 1 ABR 14/22 (9 May 2023): bundesarbeitsgericht.de
BMAS and BMI, ministry draft bill Beschäftigtendatengesetz, copy at ITM NRW (drafting status 8 October 2024): itm.nrw
Federal Government, Verantwortung für Deutschland: Sofortprogramm der Bundesregierung, copy at the CDH association (May 2025): cdh.de
German Bundestag, reply of the Federal Government, printed paper 21/5560 (22 April 2026): dserver.bundestag.de
Court of Justice of the European Union, press release No 186/23 on C-634/21 (7 December 2023): curia.europa.eu
Thuringian State Commissioner for Data Protection, press release on the SCHUFA judgment (7 December 2023): tlfdi.de
Hamburg Commissioner for Data Protection and Freedom of Information, Effects of the Schufa judgement on AI applications, press release, English version (7 December 2023): datenschutz-hamburg.de
Datenschutzkonferenz, Orientierungshilfe Künstliche Intelligenz und Datenschutz, version 1.0 (6 May 2024): datenschutzkonferenz-online.de
Court of Justice of the European Union, press release No 22/25 on C-203/22 (27 February 2025): curia.europa.eu
Federal Ministry of Justice, Section 6 AGG (as of 16 October 2026): gesetze-im-internet.de
Federal Ministry of Justice, Section 22 AGG (as of 16 October 2026): gesetze-im-internet.de
Reuters, Amazon scraps secret AI recruiting tool that showed bias against women (10 October 2018): reuters.com
German Bundestag, hearing on the amendment of the General Equal Treatment Act (5 October 2026): bundestag.de
European Commission, Implementing Decision (EU) 2021/914 on standard contractual clauses (4 June 2021): eur-lex.europa.eu
European Commission, Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework (10 July 2023): eur-lex.europa.eu
US Department of Commerce, Data Privacy Framework List (retrieved 16 October 2026): dataprivacyframework.gov
Court of Justice of the European Union, press release No 106/25 on T-553/23, Latombe v Commission (3 September 2025): curia.europa.eu
Official Journal of the EU, appeal C-703/25 P, Latombe v Commission (lodged on 31 October 2025): eur-lex.europa.eu
noyb, US Supreme Court just blew up EU-US Data Transfers (30 June 2026): noyb.eu
Supreme Court of the United States, Trump v. Slaughter, No. 25-332 (29 June 2026): supremecourt.gov
European Data Protection Board, letter to the European Commission on the judgment in Trump v. Slaughter (31 July 2026): edpb.europa.eu
Privacy and Civil Liberties Oversight Board, Board Members (retrieved 16 October 2026): pclob.gov
Legal Information Institute, 42 U.S. Code § 2000ee (retrieved 16 October 2026): law.cornell.edu
NPR, FISA 702, a key U.S. spy tool, has lapsed. Now what? (12 June 2026): npr.org
Brennan Center for Justice, Section 702 Resource Page (as of 17 September 2026): brennancenter.org
EPIC, FISA Section 702 almost certain to expire after House votes against extension (June 2026): epic.org
The Hill (via Yahoo News), Intelligence community warned Congress on FISA 702 deadlines, but some Democrats have doubts (18 September 2026): yahoo.com
Legal Information Institute, 18 U.S. Code § 2713 (retrieved 16 October 2026): law.cornell.edu
Sénat, Commission d'enquête sur la commande publique, record of the hearing of Microsoft (10 June 2025): senat.fr
Microsoft, Microsoft completes landmark EU Data Boundary (26 February 2025): blogs.microsoft.com
OpenAI, Data residency and inference residency for ChatGPT, help page (archive copy of 10 October 2026): help.openai.com
OpenAI, Enterprise privacy at OpenAI (as of 8 January 2026): openai.com
Hamburg Commissioner for Data Protection and Freedom of Information, Checkliste zum Einsatz LLM-basierter Chatbots (13 November 2023): datenschutz-hamburg.de
European Union, Regulation (EU) 2024/1689 (AI Act), consolidated version (as of 27 July 2026): eur-lex.europa.eu
European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI) (8 July 2026): eur-lex.europa.eu
European Commission, Guidelines on prohibited AI practices, C(2025) 5052 final (29 July 2025): ec.europa.eu
European Commission, draft guidelines on the classification of high-risk AI systems (19 May 2026): digital-strategy.ec.europa.eu
Federal Ministry of Justice, KI-MIG (promulgated 22 July 2026): gesetze-im-internet.de
Federal Ministry of Justice, Section 87 BetrVG (as of 16 October 2026): gesetze-im-internet.de
Federal Labour Court, order 1 ABR 7/15 (13 December 2016): bundesarbeitsgericht.de
Federal Ministry of Justice, Section 90 BetrVG (as of 16 October 2026): gesetze-im-internet.de
Federal Ministry of Justice, Section 80 BetrVG (as of 16 October 2026): gesetze-im-internet.de
Federal Ministry of Justice, Section 95 BetrVG (as of 16 October 2026): gesetze-im-internet.de
Legal Tribune Online, ChatGPT: Keine Beteiligungsrechte bei privaten Accounts (27 February 2024): lto.de
Federal Government, Ein Programm für Aufschwung und Beschäftigung, decision of the coalition committee (2 July 2026): bundesregierung.de
BDA, Betriebsverfassung grundlegend modernisieren, report of the BDA commission on works constitution (September 2026): arbeitgeber.de
Datenschutzkonferenz, Liste der Verarbeitungsvorgänge nach Art. 35 Abs. 4 DS-GVO (nicht-öffentlicher Bereich), version 1.1, copy at the HmbBfDI (17 October 2018): datenschutz-hamburg.de
Bavarian Data Protection Authority, Künstliche Intelligenz (retrieved 16 October 2026): lda.bayern.de
Hamburg Commissioner for Data Protection and Freedom of Information, 35,3 Millionen Euro Bußgeld wegen Datenschutzverstößen im Servicecenter von H&M, press release (1 October 2020): datenschutz-hamburg.de
Conseil d'État, Décision n° 492830, Amazon France Logistique (23 December 2025): conseil-etat.fr
Garante per la protezione dei dati personali, press release on Foodinho (22 November 2024, decision of 13 November 2024): garanteprivacy.it
Garante per la protezione dei dati personali, Provvedimento n. 342 (14 May 2026): garanteprivacy.it
Garante per la protezione dei dati personali, press release IA e lavoro (28 May 2026): garanteprivacy.it
Agencia Española de Protección de Datos, press release on AI in CV analysis (23 September 2026): aepd.es
CNIL, Les contrôles en 2026 : recrutement, répertoire électoral unique et fédérations sportives (3 April 2026): cnil.fr
Datenschutzkonferenz, Orientierungshilfe zu datenschutzrechtlichen Besonderheiten generativer KI-Systeme mit RAG-Methode, version 1.0 (October 2025): datenschutz-berlin.de
Alibaba Qwen, Qwen3.8-27B, model card (August 2026): huggingface.co
Unsloth, Qwen3.8 documentation (retrieved 16 October 2026): unsloth.ai
Google, Gemma 4 Model Card (retrieved 16 October 2026): ai.google.dev
Aleph Alpha, Kolibri-1, model card (October 2026): huggingface.co
Mistral AI, Models Overview (retrieved 16 October 2026): docs.mistral.ai
Aleph Alpha, Kolibri has landed (3 October 2026): aleph-alpha.com
Meta, Llama 4 Acceptable Use Policy (retrieved 16 October 2026): dev.meta.ai
Mistral AI, licence Mistral-Medium-3.5-128B (2026): huggingface.co
Alibaba Qwen, licence Qwen3.8-Flash-Next (2026): huggingface.co
Geizhals, NVIDIA RTX PRO 6000 Blackwell, price comparison (16 October 2026): geizhals.de
JACOB Elektronik, NVIDIA RTX PRO 6000 Workstation Edition (16 October 2026): jacob.de
Hetzner, Hetzner expands GPU portfolio with new GEX63 (6 October 2026): hetzner.com
Hetzner, Server with GPU (retrieved 16 October 2026): hetzner.com
IONOS Cloud, Price list EUR (retrieved 16 October 2026): docs.ionos.com
vLLM Project, Server Arguments (retrieved 16 October 2026): docs.vllm.ai
vLLM Project, Usage Stats Collection (as of 17 October 2025): docs.vllm.ai
LiteLLM, Logging (retrieved 16 October 2026): docs.litellm.ai
LiteLLM, Maximum Retention Period for Spend Logs (retrieved 16 October 2026): docs.litellm.ai
BerriAI, Issue 24518: litellm PyPI package (v1.82.7 + v1.82.8) compromised (24 March 2026): github.com
Open WebUI, License (retrieved 16 October 2026): docs.openwebui.com
Open WebUI, Environment Variable Configuration (as of v0.12.1): docs.openwebui.com
IONOS Cloud, AI Model Hub, prices (retrieved 16 October 2026): cloud.ionos.de
STACKIT, AI Model Serving, prices (retrieved 16 October 2026): stackit.com
T-Systems International, Service Specifications LLM Serving Service (as of 30 September 2026): docs.llmhub.t-systems.net
OVHcloud, AI Endpoints catalogue (retrieved 16 October 2026): ovhcloud.com
Scaleway, Model-as-a-service Solutions Pricing (retrieved 16 October 2026): scaleway.com
Nebius, Token Factory model catalog (retrieved 16 October 2026): tokenfactory.nebius.com
IONOS Group SE, Half-year Financial Report 2026 (as of 30 June 2026): ionos-group.com
IONOS Cloud, AI Model Hub: Data Handling (retrieved 16 October 2026): docs.ionos.com
IONOS Cloud, Zertifikate (as of May 2026): cloud.ionos.de
IONOS Cloud, AI Model Hub: European Union AI Act (retrieved 16 October 2026): docs.ionos.com
STACKIT, Facts (as of July 2026): stackit.com
STACKIT, Auftragsverarbeitungsvertrag (retrieved 16 October 2026): stackit.com
STACKIT, FAQ AI Model Serving (24 November 2025): docs.stackit.cloud
STACKIT, Service Certificate AI Model Serving, version 1.3 (valid since 18 September 2025): stackit.com
STACKIT, Certificates (retrieved 16 October 2026): stackit.com
Deutsche Telekom, Annual Report 2025, Principal subsidiaries (31 December 2025): report.telekom.com
T Cloud Public, Certifications (retrieved 16 October 2026): t-cloud-public.com
T-Systems, AI Foundation Services: Available Models (retrieved 16 October 2026): docs.llmhub.t-systems.net
T-Systems, AI Foundation Services: Enterprise Trust (retrieved 16 October 2026): docs.llmhub.t-systems.net
OVHcloud, Shareholders & Governance (5 December 2025): corporate.ovhcloud.com
OVHcloud, AI Endpoints (retrieved 16 October 2026): ovhcloud.com
OVHcloud, Specific Conditions for Public Cloud Services (version of 26 August 2026): contract.eu.ovhapis.com
OVHcloud, Data Protection Agreement, German version (version of 17 October 2025): contract.eu.ovhapis.com
Scaleway, About Scaleway (retrieved 16 October 2026): scaleway.com
Scaleway, Understand the Generative APIs Privacy Policy (as of 3 October 2025): scaleway.com
Scaleway, Contracts (retrieved 16 October 2026): scaleway.com
Scaleway, Security and compliance (retrieved 16 October 2026): scaleway.com
Nebius, YNV announces successful completion of the divestment of its Russia-based businesses (15 July 2024): nebius.com
Nebius, AI Cloud regions (retrieved 16 October 2026): docs.nebius.com
Nebius, Token Factory Legal Quick Guide (retrieved 16 October 2026): docs.tokenfactory.nebius.com
Nebius, Token Factory Terms of Service (retrieved 16 October 2026): docs.tokenfactory.nebius.com
Nebius Group, Privacy statement (retrieved 16 October 2026): group.nebius.com
Mistral AI, Regional inference (retrieved 16 October 2026): docs.mistral.ai
Mistral AI, Trust Center: Subprocessors (retrieved 16 October 2026): trust.mistral.ai
Mistral AI, Zero data retention (retrieved 16 October 2026): docs.mistral.ai
Mistral AI, Do you have SOC 2 or ISO 27001 certification? (12 August 2026): help.mistral.ai
Mistral AI, Data Processing Addendum (retrieved 16 October 2026): legal.mistral.ai
Aleph Alpha, Platform (retrieved 16 October 2026): aleph-alpha.com
Aleph Alpha, Cohere und Aleph Alpha unterzeichnen Vereinbarung (16 September 2026): aleph-alpha.com
DeepL, DeepL infrastructure and data protection (updated 12 October 2026): support.deepl.com
Black Forest Labs, Privacy Policy (retrieved 16 October 2026): bfl.ai
Federal Office for Information Security (BSI), Kriterienkatalog C5 (retrieved 16 October 2026): bsi.bund.de
European Commission, proposal for a Cloud and AI Development Act, COM(2026) 502 final, Council document 10104/26 (3 June 2026): data.consilium.europa.eu
Heuking, Betriebsvereinbarungen als Rechtsgrundlage für die Datenverarbeitung (10 January 2025): heuking.de
DIN, DIN EN ISO/IEC 27555:2025-09 (retrieved 16 October 2026): din.de
Datenschutzkonferenz, Standard-Datenschutzmodell, Baustein 60 Löschen und Vernichten, version 1.0a (2 September 2020): datenschutz-mv.de
Datenschutzkonferenz, Standard-Datenschutzmodell, Baustein 51 Zugriffe auf Daten, Systeme und Prozesse regeln, version 1.0 (1 November 2021): datenschutz-mv.de
Datenschutzkonferenz, Standard-Datenschutzmodell, Baustein 43 Protokollieren, version 2.0 (valid since 1 June 2026): datenschutz-mv.de
European Data Protection Board, Guidelines 01/2025 on Pseudonymisation, version for public consultation (16 January 2025): edpb.europa.eu
Court of Justice of the European Union, press release No 107/25 on C-413/23 P (4 September 2025): curia.europa.eu
Presidio, documentation (retrieved 16 October 2026): data-privacy-stack.github.io
Explosion, spaCy model metadata de_core_news_lg-3.8.0 (retrieved 16 October 2026): raw.githubusercontent.com
Protect AI, llm-guard, repository (archived on 9 July 2026): github.com
LiteLLM, PII, PHI Masking with Presidio (retrieved 16 October 2026): docs.litellm.ai
Sentient Dynamics, market research on open AI models and hardware (16 October 2026), internal and not public

About the author

Sebastian Lang writes for Sentient Dynamics about AI in business.

Subscribe to the newsletter | Sebastian on LinkedIn