User, operator, provider: what the AI Act actually demands of you

The expectation of an episode with a lawyer is a list of prohibitions. This episode delivers the opposite, and that is the actual point: law and compliance can play along instead of only preventing.

The 70 per cent question

The opening clears away a yardstick that is rarely spoken aloud in compliance discussions. An AI result is rarely perfect. But the question is not whether it is perfect, it is what it is measured against.

In non-critical processes, a result at 70 per cent quality can be entirely sufficient. Perfection was not the yardstick before either: the draft from a colleague under time pressure, the quick search between two meetings, the summary of a set of minutes were never error-free.

Note the restriction contained in that sentence. It applies to non-critical processes. The actual work consists of drawing that line, and that is a domain task, not a legal one.

As a counter-example of effective communication serves the anecdote of the lawyer with a fountain pen appearing on TikTok in caution mode. Pure fear-mongering brings nobody along, and people then simply use the tools without guidance.

The biggest platitude

“Data protection is not a sacred cow. It stands on equal footing beside other legal interests, all of which have to be reconciled.”

The sentence is the core statement of the episode and ends a debate that runs in circles in many companies. Data protection is a legal interest. Other legal interests stand beside it, and the task consists of weighing them, not of ranking them.

Nowhere does it say that things are not allowed. It says under what conditions they are allowed, and meeting those conditions is work rather than impossibility.

Concretely this concerns the question of US hosting, which holds up many projects. In Hermann's assessment that is currently not a knock-out criterion, provided it is properly documented. The documentation here is not a formality but what makes the weighing traceable in a dispute.

Which role you have

For classification under the AI Act, the question of role is the most important, and it is frequently answered wrongly.

A law under reconstruction

That the AI Act is already being adjusted although it is not yet fully in force, Hermann explains from the Brussels process: many participants, many individual interests, and at the end a compromise that does not fit together at the edges.

For practice a consequence follows that goes beyond the legal. Anyone waiting for final clarity waits a long time. Hermann's own approach in his company: no case-by-case answers to the question “am I allowed to?”, but principles and guardrails.

The difference is considerable in practice. A case-by-case decision ties up capacity, takes time and creates uncertainty among everyone who did not ask. A guardrail answers a hundred questions in advance and makes clear where consultation is actually needed.

The private sphere

One section concerns everyday life and is more practically useful than it first appears. The General Data Protection Regulation simply does not apply in a purely private context, which is the so-called household exemption.

It gets interesting at the boundary. A recording device or a camera pair of glasses that moves from the private setting into a public one leaves this exemption. A vehicle's sentry mode is a similar case: technically privately motivated, in effect a recording of public space.

Important here: beside data protection law stands criminal law, and there the household exemption does not apply. The confidentiality of the spoken word is protected regardless of the motive for recording.

How the profession is changing

At the end it becomes fundamental. When knowledge and skills become a commodity, classic contract review disappears as a service. What remains is experience, empathy and strategic foresight, that is exactly the parts that cannot be derived from a database.

The pointed formulation from the panel: the lawyer of the future orchestrates agentic networks that pass legal advice on to other systems. In Hermann's own working day that is partly reality already, with everyday AI for research and Noxtua, a German system trained on a legal data base.

Conclusion

The episode delivers three sentences that can actually be used in a compliance discussion.

First: ask about the yardstick before you argue about quality. What is the result compared against, perfection or the previous state.

Second: replace “data protection does not allow that” with the question of which legal interests have to be weighed against each other here and who documents that weighing.

Third: clarify your role before you give anything outward. The transition from user to provider happens faster than the accompanying documentation comes about.

And replace case-by-case approvals with guardrails. That is the only route in which law produces speed instead of braking it.