An interim manager uses AI to analyze client documents or prepare a proposal. The provider initiated the engagement, organized the contracts, and oversees the assignment. However, he had nothing to do with the AI account that was used.
Does that mean the issue is settled for him?
Not necessarily. When it comes to AI in interim management, it depends on what services the provider is obligated to deliver, how the contractual relationships are structured, and who makes decisions regarding data processing. Responsibility does not automatically follow the user account.
In this article, the term “provider” refers to the interim management service provider, not the provider of the AI tool.
Effective as of October 22, 2026. This document addresses German contract law and the GDPR.
No. There is no blanket liability for all AI-related activities carried out by a manager placed through the agency.
However, the provider’s own obligations may arise from its contracts, its actual involvement, and its role under data protection law. Under certain circumstances, the provider may also be held liable for misconduct on the part of the manager it has appointed.
The key question, therefore, is not only, “Who entered the data?” but also, “Who assumed what responsibilities toward whom?”
Two simplified scenarios are helpful for this analysis.
The provider facilitates a direct contract between the client and the interim manager. In such cases, the provider is generally obligated to provide the agreed-upon placement services and, if applicable, any additional tasks expressly undertaken. This does not automatically make the provider responsible for the entire subsequent execution of the assignment. However, the provider’s own obligations regarding selection, disclosure, or confidentiality may still be relevant.
The provider is itself the customer’s contractual partner for services under the engagement and appoints an interim manager for this purpose. It must then be determined what obligations the provider has assumed toward the customer and what tasks the manager performs to fulfill those obligations.
In practice, additional agreements may be entered into. Therefore, the specific service descriptions and the actual performance of the services are decisive, not merely the designation “provider contract.”
If the provider engages an interim manager to fulfill its own contractual obligations, that manager may act as an agent. Under Section 278 of the German Civil Code (BGB), a debtor is generally liable for the fault of such persons as if it were its own fault.
The fact that the manager works independently does not automatically preclude this attribution.
If the provider uses AI to perform the tasks it has undertaken and thereby breaches a relevant obligation, this may also affect the provider. However, there must be a relevant connection to the performance of the contract. Not every action taken during an ongoing engagement falls under this category.
In addition, for a contractual claim for damages to exist, the relevant requirements must be met, in particular a breach of duty, fault for such breach, and resulting damage. The legal basis is § 280 of the German Civil Code (BGB).
“That was the independent manager” is therefore a statement of fact. It is not yet a complete liability assessment.
A hypothetical example: A service provider provides services to a client for a sales project and assigns an interim manager for that purpose. The client contract prohibits the disclosure of confidential documents to unauthorized AI services.
This requirement is neither included in the agreement with the manager nor explained at the start of the project. The manager uploads internal sales documents to his own AI account.
However, this is not just about the upload. It must also be determined whether the provider has appropriately organized and communicated its own obligations.
This example illustrates a typical interface: the customer contract, the manager contract, and the on-the-job training must all align. Careful provisions are of little use if only one of the parties involved is aware of them.
A contractual service chain is not automatically a chain of data processors.
Under data protection law, the role is determined by who, in the context of the respective processing, determines the purposes and essential means, and who processes personal data on behalf of another party in accordance with instructions. The European Data Protection Board explains this distinction in its guidance on controllers and processors.
For example, a provider may be responsible for its own pool of candidates. However, the processing of customer data within a client engagement requires a separate review. Similarly, an interim manager is not automatically a data processor simply because the contract refers to them as a contractor.
The classification should be based on specific processing operations. A billing address does not in itself constitute a data protection role.
If data processing is being carried out on behalf of a controller and an AI service is to be used as an additional processor, the requirements set forth in Article 28 of the GDPR apply in particular.
This includes obtaining prior specific or general written authorization from the data controller and the contractual transfer of the relevant data protection obligations.
If the provider itself is the first processor, it is liable to the controller under Article 28(4) for ensuring compliance with the obligations of any additional processor engaged. This requires a specific division of roles, not merely a business involvement in the engagement.
The European Data Protection Board also emphasizes that data controllers must know the identity of the processors and subprocessors they engage. It is necessary to assess their safeguards; the extent of this assessment depends, in particular, on the risk involved. This is explained in its opinion on the engagement of processors and subprocessors.
Therefore, approval by the provider does not automatically replace the required consent of the customer or a necessary legal basis under data protection law.
For practical implementation, providers should coordinate five key points in particular:
The review should also address any potential discrepancies between the client’s claims and the provider’s recourse options against the manager. An internal right of recourse does not automatically relieve the provider of its own obligation to the client.
Not every risk originates with the manager in question.
Providers can use AI themselves to summarize profiles, prepare client briefings, or communicate with candidates. This process may involve the processing of personal or confidential information.
These processes must be evaluated on a case-by-case basis. Approval for AI use in a client project does not automatically extend to its use in a company’s own recruiting or placement process. Conversely, the fact that a tool has been approved for internal use does not necessarily mean that client documents may be processed using it.
If data may have been transmitted to an AI service without authorization, a swift, coordinated process is needed: stop further transmissions, trace the incident, secure evidence appropriately, and review protective measures.
In the event of a data breach, a processor must notify the controller immediately. The controller then assesses any additional reporting and notification obligations. A contractual reporting procedure must not delay compliance with legal obligations.
Not every unexplained use of AI automatically constitutes a reportable data breach. However, it should not be passed back and forth between the provider, manager, and customer until no one wants to take responsibility for it anymore.
Service providers benefit from a standardized approach to project kickoff, AI approvals, and incident reporting. Supplementary AI training can help clarify the rules by using typical project scenarios as examples.
An AI Officer can coordinate these organizational processes, but does not replace either contract review or data protection assessment.
K11 Consulting provides support in the areas of governance, data protection, and information security. K11 Law Firm can assist with the legal coordination of contractual relationships.
Service providers are not automatically liable for every instance in which an interim manager uses AI. However, they are not absolved of responsibility simply because the account used belongs to someone else.
The key factors are the contract model, the obligations assumed, the actual data processing activities, and the organization of the collaboration.
Those who align client requirements, management agreements, and practical approvals create a more robust foundation for AI in interim management. Responsibilities should be clarified before the project begins, not only after the first problematic upload.