Incorrect AI company information: the portal operator is liable

A register notice for the wrong company

A medium-sized family business builds and sells conservatories and terrace roofs. On a business information portal, a commercial register notice from June 2023 appeared under its name: the company was to be struck off for lack of assets, with a two-month period for objections. For a business that depends on orders and creditworthiness, that is dangerous news. The only problem was that it was not true. Kiel Regional Court turned the case into a clear rule: anyone who lets an AI publish company information is liable for its errors as if for their own statements.

The portal operator evaluates mandatory publications from the Federal Gazette, the commercial register and the insolvency register fully automatically. Software links the data and displays it to users according to a fixed pattern. On its "About us" page it cites big data and artificial intelligence for this. Its error analysis showed that the notice belonged to a different company. Somewhere in the chain between the insolvency court, the local court and the company register, the entry had been assigned to the wrong company, and the software had not noticed.

In July 2023 the business demanded deletion and a cease-and-desist undertaking. The operator deleted the notice immediately and blocked it. It did not sign the undertaking. The business therefore took the matter to Kiel Regional Court.

The ruling of Kiel Regional Court

By judgment of 29 February 2024 (case no. 6 O 151/23), Kiel Regional Court ordered the operator to refrain from claiming that the business was being struck off for lack of assets. Each breach carries an administrative fine of up to 250,000 euros. The operator must also reimburse 527 euros in pre-litigation legal costs. The court set the value in dispute at 10,000 euros.

The court dismissed part of the claim. The business wanted the operator barred from spreading any false information about it at all. The claim does not go that far. An injunction must be limited to the specific statement that the court has weighed up. Both sides therefore shared the costs of the proceedings.

A company's reputation is protected

The decision rests on the general personality right of businesses. A GmbH, too, has a right to its social standing, that is, to how it is seen in public, and a medium-sized business lives on its reputation. The notice about the impending deletion struck precisely at that reputation and at its creditworthiness. Anyone reading it could seriously be deterred from doing business with the company. There was also the matter of reach: in searches for the company name, the portal appeared in second place.

The court weighed this interest against freedom of expression and information. The operator did not even seek to rely on it. It saw itself as a search engine that merely serves its users' interests and does not spread any opinion of its own. The court took a different view: by processing the data, the operator makes a statement of its own.

The balancing exercise was clear-cut, because the notice was an untrue statement of fact, and untrue assertions are not worthy of protection. The fact that the operator was unaware of the inaccuracy did not help it. A company does not have to accept that false facts weaken its economic position.

Whoever deploys the AI is the interferer

The heart of the judgment is attribution. The operator argued that it had played no part in the automated process. The court did not accept this. Under civil law, an interferer is anyone who causes an impairment, even without fault. Anyone who deliberately makes use of an AI to answer users' search queries is a direct interferer.

The software was inadequately programmed for cases like this one, because it failed to detect the misattribution. In the court's view, that risk is borne by whoever deliberately deploys the software. A second consideration comes on top: the operator bundles the mandatory publications relating to a company on its page and links them together. From the perspective of a reasonable average user, it thereby adopts the content as its own and visibly assumes responsibility for it.

The note in the terms of use stating that the data were obtained fully automatically and might be "partly or even largely erroneous" was irrelevant. The same applied to the disclaimer as to accuracy and completeness. The operator also saw itself as a host provider, that is, a provider that merely stores third-party content and enjoys a liability privilege for it. The court left open whether that was the case, since the privilege concerns only criminal liability and damages in any event, not the claim for injunctive relief.

Immediate deletion is not enough

The operator had removed the notice promptly after the complaint. That made no difference to the claim for injunctive relief. Once a right has been infringed, there is a presumption that the infringement will be repeated. The interferer must dispel this risk of repetition, and the courts set a high bar for that.

The operator achieved the opposite. It stated that it publishes third-party data from mandatory publications without checking them, and that the electronic commercial register is unreliable, which leads to incorrect displays. That made it clear that the same error could recur at any time. Normally, a cease-and-desist undertaking backed by a penalty dispels the risk of repetition, that is, a promise not to repeat the statement, secured by a contractual penalty. That was precisely the undertaking the operator had refused to give after the warning letter.

Liability for AI errors in practice

The reasoning applies to any company that lets software or AI publish content, such as automatically generated company profiles or product descriptions. Whoever deploys the software answers for its statements as if they were their own. A disclaimer in the terms of use changes nothing. Because the claim for injunctive relief does not require fault, due care offers no protection against the claim itself, though it does help prevent false statements arising in the first place. Checks therefore make sense wherever the software visibly reaches its limits, for instance with similar company names.

For companies about which false information is circulating, the case shows the way. The first step is a written demand to the operator: deletion and a cease-and-desist undertaking. If the undertaking is not forthcoming, the claim can be pursued in court, even if the notice has long since been deleted. The application should identify the specific false statement, as there is no such thing as a blanket ban on all false information. The operator must reimburse the pre-litigation legal costs, though without VAT if the affected company is entitled to deduct input tax.