Germany's federal data protection commissioner has recommended that the federal government create a clear statutory framework for automated analysis of health data, including validation of AI models against bias from unrepresentative training data

What the BfDI actually asked for

The operative sentence in the press release of 11 September 2026 is one line long, and it is a recommendation that binds nobody: "Zudem sollten klare gesetzliche Rahmenbedingungen für automatisierte Auswertungen von Gesundheitsdaten geschaffen werden." Our translation: in addition, clear statutory conditions should be created for automated analysis of health data. The verb is sollten, the conditional. There is no addressee named in that sentence beyond the Bundesregierung named in the sentence before it.

The press release does not use the words künstliche Intelligenz or KI anywhere. If you stop at the release, the story is about automated analysis in the abstract.

The paper published the day before is where artificial intelligence appears, and it too is a recommendation with no legal effect. Its fourth recommendation is headed "Schaffung eines klaren gesetzlichen Rahmens für die Auswertung von Gesundheitsdaten", the creation of a clear legal framework for the analysis of health data, and reads: "Mehr als zwei Drittel befürworten eine automatische Auswertung der Gesundheitsdaten, z. B. durch künstliche Intelligenz. Damit der Einsatz von künstlicher Intelligenz im Gesundheitswesen gelingen kann, braucht es einen klaren rechtlichen Rahmen."

The two conditions follow, and they are the substance. In our translation, the BfDI says such a framework would have to satisfy two central requirements: first, it would have to take account of the fact that AI models can contain personal data; second, it would have to provide for validation of AI models in order to exclude systematic bias caused by unrepresentative or one-sidedly selected training data. Both are the authority's statement of what a future law should contain. Neither is law.

The release and the paper do not say the same thing

This is worth separating out, because most coverage will quote the release. The release says automated analysis of health data. The paper says automatic analysis, for example by artificial intelligence, and then adds the training data and personal data conditions. A reader who only sees the release cannot tell that the recommendation reaches model validation at all.

The same divergence shows up on a number. The release reports that 83 percent want to be able to specify in fine-grained terms who may view which data. The paper reports that 83 percent want as many settings options as possible in future, then reports separately what those respondents said they would actually switch on. Same figure, two different descriptions of what was asked.

That is our reading of the two documents side by side, not something either document says about the other.

What the numbers are numbers of

The survey is a BfDI self-published statistic and should be written as such. The BfDI says INFO GmbH conducted a telephone survey (CATI) on its behalf, with 1,500 respondents drawn from statutorily insured residents of Germany aged 18 and over, in the field from 4 to 18 November 2025. The paper and the release were published in September 2026. The fieldwork is roughly ten months older than the recommendation it supports.

On objections, the BfDI says that among statutorily insured people who objected, 55 percent gave data protection and data security concerns and a general lack of trust as the reason, and 35 percent said they did not want to give everyone access to their record. Neither document states how many people have objected. We give the percentages the BfDI gives and decline to attach any scale to them, because no denominator is published in either document.

On uptake the BfDI reports gematik's figure of 5.85 million active users measured by registered health IDs, which the paper puts at just under eight percent of the statutorily insured. The BfDI's own survey put the share who downloaded and registered for the app at 12 percent, and the paper says this sits above the gematik-reported share of registered health IDs. The paper offers reasons for non-use rather than treating the gap as failure: 42 percent said they are healthy and see no need, 26 percent said they have had no time, 11 percent found the activation process too complicated.

On the AI question itself the two documents differ again in strength. The paper's body says more than two thirds can imagine such analyses on the basis of their ePA data. The recommendation box on the same document says more than two thirds support automatic analysis, for example by artificial intelligence. We report both formulations rather than choose the stronger one.

Two dates for research use, and we do not reconcile them

The press release opens with a trigger: from the end of October 2026, data from the medication list can for the first time be extracted from the ePA in pseudonymised form for research purposes, on the condition that the insured person has not objected. That is an opt-out arrangement described in the authority's own voice.

The paper published the day before says something different: probably from the beginning of 2027, insured persons can voluntarily make their health data available in pseudonymised form for research. That is a voluntary arrangement, a different date, and a broader category of data.

The two statements are not obviously about the same thing, and neither document cross-refers to the other on this point. We report the conflict rather than picking one. We did not open the underlying statutory provisions, so we do not say which mechanism governs which data, and we do not treat either date as settled.

The paper also records that the federal cabinet is pursuing a Gesetzentwurf zur Digitalisierung im Gesundheitswesen (GeDIG), a draft bill, and that a legislative change has opened the possibility of data-supported analysis of insured persons' health data for detecting rare diseases and cancers. A draft bill is not law, and the paper does not identify the enacted change by name or date, so we do not describe its content.

What this does not do

It creates no obligation on anyone. It is not a supervisory measure, not an order, not a fine, and not a formal guidance instrument. A DPO who reads it and changes nothing is not out of compliance with anything.

It is also not an AI Act implementation document. Germany's market surveillance and enforcement arrangements for the EU AI Act run on a separate track, and neither the release nor the paper claims to be part of that work.

What it does do is put a national supervisory authority's position on the record at a moment when the ePA opt-out architecture is being built out. If a framework for automated health data analysis is drafted in Germany, the validation and training data conditions in this paper are now a published starting position that a federal authority can be held to. That is our characterisation of its practical weight, not a claim about its legal effect.

What we did not verify

What we opened: the full text of Pressemitteilung 13/2026 on the BfDI's own server, read as extracted page text; the BfDI press release index, where the item stands in the first row dated 11.09.2026; and the six page Datenbarometer publication "Befragungsergebnisse und Empfehlungen" in PDF, dated 10.09.2026 on its landing page, read end to end including the four recommendations and the survey method box.

What we did not open: the full survey dataset at datenbarometer.de, the gematik source for the 5.85 million figure, the GeDIG draft bill, the EHDS Regulation provisions the paper refers to on restricting access to electronic health data, the statutory provisions governing the October 2026 medication list extraction and the objection right, and the BfDI's earlier ePA Datenbarometer press release of 18 December 2025. We therefore describe each of those only as this paper describes them.

What we refuse to claim: we do not say Germany is regulating AI in healthcare, because a recommendation is not a rule and neither document claims otherwise. We do not say anyone is obliged to validate a model, because the validation condition is what the BfDI says a future framework should require. We do not say how many insured people have objected to the ePA, because neither document gives that number, and we attach no scale word to the 55 percent figure for the same reason. We do not resolve the conflict between the end of October 2026 date in the release and the beginning of 2027 date in the paper. German passages are reproduced with ASCII quotation marks in place of the typographic marks used by the authority, which is a house typesetting convention and not a change to any word; English renderings are marked as our translation and are never presented as the authority's own English.

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.

Related briefings

• Germany designates the Bundesnetzagentur as its AI enforcer
• The EDPB's anonymisation guidelines for generative AI
• The CJEU's SCHUFA ruling on automated decisions
• Europe AI regulation tracker
• AI Regulation News hub