German Firms Face July-August Regulation Avalanche as Bundestag Approves Facial Recognition Powers

Bundestag approves real-time facial recognition at train stations; EU vehicle distraction warning system takes effect; shadow AI risks rise; NIS2 registration deadline looms.

The Bundestag’s July 10 vote to allow real-time facial recognition at train stations and AI-driven movement-pattern analysis marks the latest addition to a cascade of European regulatory deadlines hitting German businesses this summer. The reform of the Federal Police Act (Bundespolizeigesetz) now goes to the Bundesrat for a decision in autumn, with Union and SPD praising the security gains while Greens and Left lawmakers rejected the surveillance expansion.

Parallel to the policing overhaul, a slew of mandatory compliance obligations are piling up across corporate Germany. Since July 7, all new vehicles sold in the EU must be fitted with the Advanced Driver Distraction Warning system (ADDW). The system uses in-cockpit cameras to track head position, gaze direction and eye movements, alerting drivers when distraction is detected. At speeds above 20 km/h, the alarm triggers if a driver is distracted for more than six seconds; above 50 km/h, the threshold drops to 3.5 seconds. Manufacturers insist data processing stays local to the vehicle and no biometric identification takes place, but critics warn of serious privacy intrusions, especially for professional drivers who face constant monitoring throughout their workday. The system can be manually shut off but resets each time the ignition is turned.

Distinct but equally pressing: the rise of “shadow AI” inside companies. A June study by ESCRIBA found that 42.7 percent of employees use AI tools without official approval for internal emails, and nearly 13 percent process sensitive customer data with them. That behaviour becomes a costly risk from August, when the EU AI Act’s transparency requirements take effect. Maximum fines reach €35 million or 7 percent of global annual turnover. In Germany, the Federal Network Agency (Bundesnetzagentur) will enforce compliance.

Advertisement

As regulators across Europe tighten enforcement and penalties climb, the same logic applies to workplace safety: a single missing risk assessment can leave your business exposed. Yet many employers underestimate how many hazards go undocumented until an incident forces the issue. A free Risk Assessment Toolkit gives you 41 ready-to-use templates and checklists to document risks, stay compliant, and protect your team. Download the free Risk Assessment Toolkit

For IT security chiefs, a more immediate clock expires on July 31: the registration deadline under the NIS2 directive. Violations can trigger penalties up to €10 million. Lawyers advising companies stress that IT security, data protection and labour law must now be integrated into a single strategy. That includes mandatory working-time recording, a requirement that has applied since a September 2022 ruling by the Federal Labour Court (BAG).

Meanwhile, the Bundesrat has also approved reforms to the Federal Data Protection Act (BDSG) that institutionalise the Data Protection Conference (Datenschutzkonferenz) and create a national one-stop-shop for research and business, meant to cut red tape. And the federal government is planning to tighten the requirement for a medical certificate from the first day of sick leave, though individual companies would still be able to deviate from that rule.