On September 1, the community talk "Regulation & Compliance in HR" took place: Dr. Martin Grentzer, one of the board members of aconso AG and Community Ambassador,gave the opening impulse on three upcoming deadlines – and one question that ties them together: Who's actually watching you, and can your system pass the audit? Sometimes it's the pension insurance fund, sometimes the EU, sometimes your own employees in court.
Appointment: 1: January 1, 2027 – §8 BVV and the audit-proof payroll record
From January 1, 2027, payroll documents relevant to audits must be available electronically and in an audit-proof format – changeable only in a traceable way, much like a receipt that can no longer be forged. The reason: Germany's statutory pension insurance is digitizing its own audit process (known as euBP). Anyone being audited will need to deliver in minutes, not weeks.
The discussion made clear that the technology is largely there – the sticking point lies in the details, such as clear, "audit-proof" document naming conventions that many systems still lack. One participant said what she'd really like is a bundled export by date range, instead of the current manual process.
Solution: Treat the personnel file as an audit-proof, exportable system – with clear labeling, employee ID, and date range – so documents can be bundled and provided without manual effort in the event of an audit. Done right, this covers §8 BVV, GDPR deletion deadlines, and evidence in a whistleblower case all at once.
Appointment 2: The EU AI Act
The EU AI Act is Europe's framework law for artificial intelligence. It tiers obligations by the risk level of the application – from light-touch requirements for low-risk systems to strict rules for high-risk systems such as AI-driven candidate screening or promotion decisions.
Martin warned against a common misunderstanding: while the high-risk obligations for AI systems were pushed back to December 2, 2027 via the Digital Omnibus (published in the EU Official Journal on July 27), other requirements are already in force. Labeling obligations for AI-generated content have applied since August 2, 2026, and the requirement to ensure AI literacy across teams has been in effect since February 2025 – covering anyone using tools like ChatGPT or Copilot in daily work. Just how wide the gap is between operational use and regulatory control is underscored by the latest SAP Value of AI Report (with Oxford Economics): only 11% of companies rate their AI governance as fully adequate, while 57% still have no fixed process for human oversight.
One participant from a highly automated company shared what such a framework can look like in practice: a company-wide works agreement on AI, staff training, and the rollout of a secure tool like Copilot instead of public chatbots. The works council was brought in early, and there was little meaningful pushback.
Solution: Build a company-wide AI inventory and a competency program now, backed by a works agreement that governs usage, boundaries, and an approved, enterprise-secure tool. Bring in the works council and data protection early, rather than reacting once the system is already in place.
Appointment 3: Pay Transparency and the Employee Data Act
Germany missed the EU deadline for transposing the pay transparency directive – but German courts are already interpreting existing law in line with it. Anyone waiting for the final text of the law is waiting for something that, in court, is already effectively in force. New is the concept of "work of equal value," governed by four EU criteria that traditional collective bargaining agreements don't currently capture; whether such agreements will be exempted remains an open question.
A quick poll in the room showed that many companies already have transparent salary bands in place, regardless of collective bargaining status – but expect to need to sharpen them further once the law arrives.
Solution: Treat pay structure and data processing today as if the laws already existed – for example, through clearly documented salary bands visible to employees, and clean documentation of data processing in the employment relationship.
Takeaway: What HR should do now
Three topics, three auditors, three different levels of readiness across the community – but the common thread stays the same. Whatever happens to the exact deadlines, three steps are worth taking regardless: first, build an AI inventory and a competency program – knowing what tools are actually running in-house today means no surprises in 2027. Second, think of the personnel file as an audit-proof system, not a filing cabinet. And third, bring in the works council and data protection early, because co-determination is a door, not a brake.
"Automate the routine, so HR has time for people. But never forget: only people bear responsibility. AI can support – it can't decide, and it isn't liable." - Dr. Martin Grentzer
The HR Frontrunners Community now counts 223 members across 10 countries – most recently we met on August 27 for a dinner in Berlin, with more dates coming up: October 15 in Munich and December 1 with BioNTech on "HR Priorities 2027".
Join the HR Frontrunners Community and help shape the future of HR.
US
DE
EN
CH
