Trade secrets and AI in Germany: the GeschGehG for the Mittelstand

A drawing of a machined part, a supplier price list, the parameters of a welding process refined over ten years: in a German industrial SME, real value often sits in a handful of files. Today those files are flowing into generative AI tools, sometimes without management knowing.

German law sets a simple condition: a trade secret is only protected if the company has taken appropriate confidentiality measures. Pasting a drawing into a public chatbot can weaken that protection. Here is how the Mittelstand can stay in control.

The GeschGehG in two minutes

The Trade Secrets Act, the Gesetz zum Schutz von Geschäftsgeheimnissen (GeschGehG), has been in force since 26 April 2019. It transposes the EU Trade Secrets Directive 2016/943.

Section 2 defines a trade secret. Information only qualifies if it meets three conditions:

• it is not generally known or readily accessible, and therefore has economic value;

• it is the subject of appropriate confidentiality measures (angemessene Geheimhaltungsmaßnahmen) taken by its lawful holder;

• there is a legitimate interest in keeping it confidential.

The second condition changes everything. Before 2019, the intention to keep information secret was often enough. Now, in a dispute, the company has to show what it actually did to protect the information. No measures, no trade secret, and no claim against whoever used it.

What teams really send to AI

In an engineering office or a purchasing department, generative AI is genuinely useful: summarising a specification, translating a quote for a foreign customer, comparing bids, drafting a manual. The problem is the raw material of those requests.

• extracts from drawings and bills of materials, with dimensions and tolerances;

• purchase prices, discounts and terms negotiated with suppliers;

• machine settings, material recipes or test results;

• customer lists with volumes and margins.

Each of these can be a trade secret. Once sent to a consumer service, it leaves the company's perimeter. Depending on the provider's terms, it may be stored, reviewed by humans or used for training. We walk through this scenario in our anatomy of an AI data leak.

Why a policy memo is not enough

Many companies responded with an internal memo: no confidential data in ChatGPT. It is a good start, but in court the question will be whether the measures were appropriate given the value of the information and the known risks.

A rule nobody can apply day to day carries little weight. A technician in a hurry does not reread the policy before asking for a translation. And management has no record of what actually left. AI use is now a known risk, so the measures have to address it with technical controls, not only instructions.

Appropriate measures, adapted to AI

The law gives no closed list. Commentators generally group measures into three families: organisational, legal and technical. Applied to generative AI, that looks like this:

1. Classify information: identify the drawings, prices and processes that really matter, and label them.

2. Choose approved tools: AI services under an enterprise contract, with no reuse of data for training.

3. Check at the moment of sending: detect sensitive information in the prompt or file before it leaves.

4. Train on real cases: show teams what a trade secret looks like in their own job.

5. Document: keep evidence of the rules, the controls and the incidents handled.

The last point is often forgotten. Yet it is what lets you prove, when it counts, that the company took the issue seriously.

Suppliers and customers too

In manufacturing, the secrets are not only yours. An automotive subcontractor receives its customer's drawings under a non-disclosure agreement. If those drawings end up in a public AI tool, the contract is at stake, and sometimes the business relationship.

Large customers increasingly ask about this in supplier audits. Being able to show an AI usage policy that is enforced technically is becoming a sales argument. For companies that want to go further, our article on sovereign AI for European CISOs covers the hosting options.

The role of the Betriebsrat

A tool that analyses what employees send to AI touches on workplace monitoring. In Germany, the works council has a co-determination right over technical systems capable of monitoring employee behaviour. It has to be involved from the start. We covered this in a dedicated article: rolling out generative AI with the works council.

The good news is that protecting secrets and respecting employees point in the same direction. A solution that anonymises data instead of blocking everything, and keeps only the incidents that matter, is easier to get approved.

How ZeusLock helps the Mittelstand

ZeusLock runs on employees' devices and browsers. It spots sensitive data in prompts and files: part numbers, prices, customer names, personal data. Depending on the rule, it warns, blocks or replaces the data with a realistic value of the same format, so the AI's answer stays useful. Our article on format preserving anonymization explains how.

Every incident is logged. Those logs become concrete evidence in the confidentiality measures file the GeschGehG expects.

Key takeaways

The GeschGehG only protects secrets the company protects itself. With generative AI, those measures have to act at the moment an employee sends a request, and leave a trace. Classify, equip, train and document: that is what will make the difference in a dispute.

Want to see how ZeusLock protects your drawings and supplier data without slowing your teams down? Book a demo.