The ministerial draft bill for the Annual Tax Act 2026, published by the German Federal Ministry of Finance (BMF) on May 19, 2026, proposes a targeted but far-reaching amendment to Section 29c of the German Fiscal Code (AO). This provision governs the processing of personal data by tax authorities for purposes other than those for which the data was originally collected. As such, it serves as the central sector-specific legal basis for the use of automated processes – and, going forward, expressly for AI systems – in German tax administration.
These developments are also relevant for nonprofit organizations in Germany, as they may increasingly become subject to data-driven audit approaches by the tax authorities. At the same time, the requirements for maintaining consistent, digitally accessible documentation are likely to become more stringent.
What changes does the draft bill propose?
The draft bill primarily introduces the following amendments to Section 29c AO:
- Revision of Section 29c(1), sentence 1, no. 4 AO: The provision is substantively revised.
- Addition of new sentences to subsection (1): In particular:
- Sentence 2 expressly extends the scope of the provision to AI systems; and
- Sentence 5 introduces a one-year deletion period for the personal data processed under the provision.
- No further amendments: Numbers 1–3 and 5–6 of Section 29c(1) AO, as well as subsections (2) and (3), remain unchanged.
- Amendment to Section 30(6) AO: The draft clarifies that data protected under Section 30 AO may also be retrieved for further processing for the purposes specified in Section 29c(1), numbers 4–6 AO.
The draft bill does not include a consolidated version of the amended Section 29c AO.
According to the draft bill, the revised no. 4 now expressly covers AI systems within the meaning of Article 3(1) of Regulation (EU) 2024/1689 (the EU AI Act), including their ongoing operation.
When personal data may be used for AI (Section 29c(1), Sentence 1, No. 4 AO)
Under the proposed amendment, personal data may be further processed if doing so is necessary for the development, testing, or modification of automated processes used by the tax authorities because either the original, unaltered data is required or anonymization or pseudonymization is impossible or would require disproportionate effort. Through a cross-reference, the provision is expressly made applicable to AI systems, including their ongoing operation.
The draft bill identifies several typical situations in which this requirement may be met. These include the need to reliably link personal data originating from multiple separate databases where creating suitable test data is not practical, as well as situations in which an AI system’s functionality would be impaired without access to such data. In doing so, the legislature addresses a common practical requirement of AI systems: the need to train models using current production data rather than artificially generated datasets.
A deletion period with practical challenges
The proposed legislation is currently only a draft bill and has not yet entered into force. If enacted, the new provision would require the tax authorities to delete personal data processed for the purposes of Section 29c(1), sentence 1, no. 4 AO within one year after the “completion of the measures” referred to in that provision. While determining the starting point of this period is relatively straightforward for clearly defined development or testing projects, it becomes considerably more difficult in the case of AI systems that remain in continuous productive use – the scenario that is expected to become the standard in future administrative practice. In such cases, it is unclear when the relevant measures can be considered completed.
Accordingly, if the amendment to Section 29c AO enters into force, affected taxpayers should actively exercise their data protection rights. Depending on the circumstances, it may be advisable to first submit a request for access under Section 32c AO in conjunction with Article 15 of the GDPR and, if appropriate, subsequently file a request for erasure under Section 32f AO in conjunction with Article 17 of the GDPR with the competent tax authorities.
Would you like to receive news like this in your inbox every month? Subscribe to our newsletter “German Nonprofit Update”.
Practical implications for tax compliance in German nonprofit organizations
Tax audits are expected to become increasingly data-driven, automated, and AI-assisted. German tax authorities are likely to rely more heavily on data-based audit methodologies, making consistent, digitally analyzable documentation more important than ever.
Specifically, nonprofit organizations in Germany should already begin focusing on strengthening the documentation of tax-relevant matters; particularly transfer pricing documentation relating to transactions between a nonprofit limited liability company (gGmbH) and its sister company, the allocation of activities to the appropriate tax categories in accounting and cost center accounting, and the quality of digitally maintained data. Whether existing privacy notices – for example, those provided to donors – will need to be updated remains to be seen. Finally, where clients use AI in their own operations, efforts should be made to establish consistent compliance structures that align with the requirements of the EU AI Act, the GDPR, and Section 32c AO.
We would be pleased to assist you with any questions regarding tax compliance, AI-related regulatory requirements, or other compliance matters.
