Tech and AI Health and Safety in Germany: The 4 Layers of Compliance

Your Berlin office opened eight months ago. The lease is signed, payroll runs, the works council question came up once and was deferred. Somewhere in that period you also became liable to an accident insurance institution you have probably never corresponded with, and you almost certainly have not appointed the company doctor that German law requires you to appoint.

This is the single most common position for a UK or US technology business operating in Germany. Not negligence, and rarely a lack of intent. The difficulty is structural: German occupational safety is not one system with one regulator, it is four layers that stack, and three of them have no direct equivalent in British or American law. A group policy written in London satisfies the first layer at best.

These are the four, in the order they bite.

Layer 1: The statutory baseline under the ArbSchG

The Arbeitsschutzgesetz implements the EU Framework Directive 89/391/EEC into German law, and its central obligation will look familiar. Section 5 requires a documented Gefährdungsbeurteilung, an assessment of the hazards associated with the work, and section 6 requires the results and the measures to be recorded.

Two details catch foreign employers out. The first is that documentation is not optional at any headcount in the way UK employers are used to, and an inspector will ask to see the document itself rather than an account of your process. The second matters far more for technology businesses: since 2013 the Act has explicitly required psychische Belastung, psychosocial load, to be assessed as part of the same exercise. In the UK the equivalent sits in HSE guidance. In Germany it is statutory, and for a company running on-call rotations, incident escalations and release crunch, it is the assessment most likely to be missing and most likely to be asked about.

Display screen work is also positioned differently. There is no standalone regulation as there is in Britain. The requirements live in an annex to the Arbeitsstättenverordnung, the workplace ordinance, which means a UK-format DSE assessment will not map cleanly onto what a German inspector expects to see.

Layer 2: The people you are required to appoint under the ASiG

The Arbeitssicherheitsgesetz requires every employer to appoint two functions, and this is where the gap between a British and a German arrangement is widest.

The first is a Fachkraft für Arbeitssicherheit, the occupational safety specialist, commonly shortened to Sifa. Broadly comparable to the competent person concept British employers already work with, though the qualification route is prescribed.

The second has no UK equivalent at all. You must also appoint a Betriebsarzt, an occupational physician. Not an employee assistance programme, not a private medical scheme, not an occupational health provider engaged when someone goes off sick. A named company doctor, appointed, with defined duties and a defined time allocation. British employers routinely assume that health surveillance in an office environment is discretionary. In Germany the appointment itself is the duty, independent of whether anyone ever needs to see them.

DGUV Vorschrift 2 sets the minimum hours for both roles based on headcount and the risk classification of your activity. Software and data businesses sit at the lower end, which makes the requirement inexpensive and makes failing to meet it harder to justify.

Layer 3: The accident insurance layer, and the second inspectorate

Germany runs what is usually called the dual system, and it is the layer that surprises people most. Alongside state law enforced by the regional labour inspectorate, there is an entirely separate structure of statutory accident insurance institutions, the Berufsgenossenschaften, coordinated nationally by the DGUV.

Membership is not optional and not something you elect into. Registration with the relevant institution follows from operating in Germany at all, and contributions are levied on payroll and risk class. In return the institution carries the cost of occupational injury and illness, which is why it also has statutory authority to write binding prevention rules, the Unfallverhütungsvorschriften, and to send its own inspectors to your premises.

The practical consequence is that two different bodies can inspect the same office against overlapping but not identical requirements, and satisfying one does not discharge the other. The DGUV publishes its prevention framework in English, which is the most useful starting point for a foreign parent trying to understand what its German entity is actually subject to. EU-OSHA's overview of the German national OSH system sets out how the two halves fit together.

Layer 4: Co-determination, if there is a Betriebsrat

The fourth layer is not a safety regulation at all, and it is the one that stops global rollouts dead.

Where a works council exists, section 87 of the Betriebsverfassungsgesetz gives it genuine co-determination rights over arrangements concerning health and safety, not merely a right to be consulted. In practical terms your German entity cannot unilaterally implement a group health and safety policy, a monitoring tool, an incident reporting platform or a homeworking standard. It has to be agreed.

Works councils have become substantially more common in German technology employers over the past decade, and the interaction with monitoring software is where negotiations most often stall. A group platform that records who completed which training and when is a health and safety system to the parent company and a performance monitoring system to the works council, and both readings are defensible. Firms that discover this at rollout lose a quarter. Firms that raise it during scoping generally do not.

What each layer requires, and what foreign employers miss

| Layer | Core requirement | What UK and US firms typically miss | |---|---|---| | ArbSchG | Documented Gefährdungsbeurteilung, reviewed and recorded | Psychosocial load is statutory, not guidance. DSE sits in the workplace ordinance | | ASiG | Appointed Sifa and appointed Betriebsarzt | The company doctor appointment. There is no British equivalent to omit by analogy | | DGUV and BG | Registration, contributions, compliance with autonomous rules | That a second inspectorate exists at all, with its own binding regulations | | BetrVG | Co-determination on health and safety arrangements | That group policies and monitoring tools require agreement before rollout |

Score yourself honestly. Most UK and US technology groups operating a German entity satisfy the first layer partially, the second not at all, the third by accident because the contributions are collected regardless, and the fourth only once a works council forces the issue.

Getting this right without duplicating everything

The instinct after reading the above is to run Germany as a separate compliance island. That is expensive and it does not survive the second country.

The workable pattern is one methodology and one register across the group, with the local statutory instrument produced properly in each jurisdiction. Your Gefährdungsbeurteilung, your French DUERP and your UK risk assessments can share a single evidence trail while each satisfying its own national test, which is precisely where health and safety consultants and software are worth more together than separately. Regular health and safety audits then verify each entity against its own law rather than against a translated group standard, and certification to ISO 45001 gives the parent a single framework the German entity can sit inside without conflict.

Where Arinite fits

Arinite works with locally qualified practitioners in Germany, so your Gefährdungsbeurteilung is produced under German law by someone qualified under German law, while you keep one point of contact and one view of the whole group. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with IT and software and AI and data businesses, and our global health and safety consultants coordinate the jurisdictions around Germany that usually come next.

If you have a German entity and no clear answer on layers two and four, our international health and safety consultants can establish where you stand. A free gap analysis will tell you in one call which of the four layers you are actually meeting.

Related Articles

• DGUV and UVV Explained: 8 Things UK and International Businesses Must Know
• Health and Safety for Tech, AI and Software Companies: 7 Mistakes to Avoid
• Tech Health and Safety in the Netherlands: 7 Priorities for Amsterdam and Global Firms
• Gefährdungsbeurteilung: 4 Pflichten jedes Arbeitgebers und die 3 häufigsten Fehler (German language, useful for local teams)