Copilot and the Works Council in Germany: the DPIA, the Works Agreement and the EU Data Boundary

Why the works council has a say

Under section 87(1) No. 6 of the Works Constitution Act, the works council co-determines the introduction and use of technical systems intended to monitor employees' behaviour or performance. The Federal Labour Court reads "intended" as objectively capable, whatever the employer actually plans, and Microsoft 365 meets that test because administrators hold audit logs and usage data. The court confirmed this for Office 365 in its decision of 8 March 2022, and held that a centrally administered tenant belongs with the central works council.

A 2024 Hamburg labour court ruling, summarised by Gleiss Lutz, found no co-determination right where staff used ChatGPT in a browser through private accounts the employer could not see. Those facts do not carry over to a Copilot tenant the employer runs. The council also has information rights under section 90, which now names the use of artificial intelligence, and under section 80(3) it may bring in an external expert to assess AI at the employer's cost once scope and fee are agreed.

What goes into the works agreement

Practitioner guides converge on a similar list of contents for a Copilot works agreement, for example a Pusch Wahlig article in Human Resources Manager and Aurum Consulting's 2026 overview. Expect the council to ask for most of these:

• scope, with permitted and prohibited use cases
• a ban on using Copilot usage data, logs and analytics to evaluate individual performance or behaviour
• who may access audit logs, and on what occasion
• retention and deletion, including rules for meeting transcripts
• how shadow AI and the free Copilot Chat are handled
• model choice and data location
• training and how it is documented
• a change process for new features and agents, often with a joint review after 6 to 12 months

The clause I would put first is the ban on performance evaluation from Copilot data. It addresses the council's main worry directly and costs an employer nothing if it never planned that use. It also matches the AI Act, which treats evaluating workers' performance as a high-risk use from 2 December 2027, so write it into the AI policy as well and let the two documents say the same thing.

The DPIA

No German authority has issued a Copilot-specific rule, but the German data protection conference says in its May 2024 guidance on AI that a DPIA under Article 35 GDPR will often be needed for AI applications. It also asks employers to provide company accounts rather than private ones, switch off training on inputs, involve the data protection officer and consider the works council. The conference followed with guidance on technical and organisational measures in June 2025 and, as its press release of 17 October 2025 announced, guidance on retrieval-augmented generation, which is the pattern Copilot uses when it answers from your files.

A useful input is the Hessian data protection commissioner's 137-page report of 15 November 2025, which concludes that Microsoft 365 can be run compliantly with specific measures and recommends a defined review before adopting new features such as Copilot. For the legal basis of employee data, the prevailing view after the CJEU's 2023 ruling in C-34/21, as Riehn Legal summarises, is to rely on Article 6(1)(b) or (f) GDPR rather than the general clause in section 26 of the Federal Data Protection Act. A works agreement still helps, but the CJEU held in C-65/23 that it must fully meet the GDPR, as CMS explains.

EU Data Boundary questions to settle first

Microsoft says it completed the EU Data Boundary on 26 February 2025, and its Copilot privacy documentation treats Copilot as an EU Data Boundary service for EU customers, with exceptions. Anthropic models offered in Copilot are currently outside the boundary. Web search queries sent to Bing fall outside the data protection addendum and the boundary, and Microsoft acts as controller for them, according to Microsoft's web search documentation.

Both are admin decisions, and the works council and the data protection officer will want to see them made before a pilot. Either switch Anthropic models off or document that transfer in the DPIA, and decide whether web search stays on. For transfers to US group companies or US providers, the EU-US Data Privacy Framework still stands after the General Court dismissed the Latombe challenge on 3 September 2025, but an appeal (C-703/25 P) is pending, so keep standard contractual clauses ready as a fallback.

The order of work, and a caveat on timing

I would start the section 90 briefing before configuring anything, then clean up permissions and configure the tenant, and negotiate the agreement once the council can see a real configuration. Negotiation time is the number everyone wants, and I have found no reliable published figure for it, so plan by dependencies rather than by a target date.

Entity structure is the other caveat. A works council normally covers its own establishment and employer, and a central works council forms only where one company has several councils under section 47. A group with two German companies may face two councils and two agreements, which your employment counsel should map out before you commit to dates. This is our reading, not legal advice.

How QueryNow helps

We prepare the technical side of a German Copilot rollout alongside your counsel: the tenant settings and data boundary choices, the permission clean-up, the feature and logging annex the works council asks for and the technical inputs to the DPIA. We start with a short discovery and then give a fixed price for the rest, working from Plano, Texas and Munich. Our Copilot GxP readiness page sets out the approach, and our Microsoft 365 work includes the digital workplace for Rockwell Automation across more than 28,000 employees in over 80 countries.