Hamburg regulator adopts OpenAI model to handle privacy complaint surge

Managing a massive workload

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) is facing a significant administrative challenge. In 2025, the regulator received 4,220 complaints under Article 77 of the GDPR, which represented a 62 percent increase compared to the year before. This surge has outpaced the growth of the agency's staff, creating a pressing need for more efficient processing methods.

To address this, the authority has adopted a chatbot called LLMoin to help draft correspondence regarding these privacy complaints. The tool was originally built for the Hamburg administration on top of an OpenAI model. By using the system to generate drafts, the regulator aims to handle the rising volume of inquiries more effectively while maintaining its oversight duties.

The move is particularly notable because the HmbBfDI is a supervisory authority that typically tells companies how to use AI lawfully. By adopting the tool itself, the watchdog is now operating under its own interpretation of the rules it enforces. The authority maintains that humans still decide every case and provide the necessary legal reasoning for all outputs.

The 'wrapper' approach to AI

The technical architecture of LLMoin is designed as a wrapper rather than a standalone model. The Hamburg Senate has not trained its own model or fine-tuned an existing one for the system. Instead, LLMoin channels inputs and outputs through a modular design that allows the underlying model to be swapped out easily without changing the primary software.

Currently, the system runs on OpenAI's GPT-5.6 Terra model hosted in a Microsoft Azure cloud. The HmbBfDI reviewed the system when it was running on GPT-4.1 and concluded that the safety measures were sufficient for the newer model as well. This modularity allows the city to adapt to different protection requirements or geopolitical situations in the future.

The regulator's core philosophy is that the model itself is likely not anonymous. They argue that it is hardly feasible to know the specific methodology developers use to determine if a model is truly anonymous. Therefore, they take a pragmatic approach by accepting the model may contain personal data and focusing on the system surrounding it to prevent that data from leaking out.

Safety through system layers

To ensure privacy, the HmbBfDI relies on several layers of technical and organizational safeguards. One primary method is retrieval-augmented generation, or RAG. This allows the system to find information in curated databases rather than relying solely on the model's internal knowledge. Responses linked to these databases can be deleted or corrected much more easily than data stored in model parameters.

The system also uses specific prompts and filters to guide the AI's behavior. A system prompt tells the model not to make independent decisions and not to output personal data that the user has not already provided. Additionally, an output filter suppresses results that are classified as impermissible, such as content involving hate, sexuality, violence, or self-harm.

The authority notes that while filters can suppress undesirable outputs, they do not count as a way to delete data from the model. Because 'machine unlearning' is not yet technically mature, the regulator focuses on preventing the extraction of data. They conclude that the focus of the law should be on the AI system's behavior rather than the internal state of the model.

Who is affected by this shift

The impact of this decision extends beyond the city of Hamburg. The Senate Chancellery has made LLMoin available to all Hamburg authorities and several other German federal states. Each agency is responsible for deciding how they will use the tool within their specific departments and workflows.

For businesses, this provides a potential blueprint for using third-party models like OpenAI's. The HmbBfDI's logic suggests that a company can use a model that may hold personal data from its training, provided the tool wrapped around it stops that data from coming out. This shifts the burden of proof from the model's training data to the system's output controls.

However, there are still strict limitations on how the tool can be used. The Hamburg Senate has only approved it for personal data with standard protection requirements. It is explicitly excluded from use cases that would be considered high-risk under the EU AI Act. These high-risk obligations are currently scheduled to become due by December 2, 2027.

What comes next for AI policy

The HmbBfDI is moving toward a more localized infrastructure for higher-security needs. Preparations are underway to use models hosted locally by Dataport, the public administration's IT service provider. A configuration planned for 2027 envisages an AI model hosted on-premises to handle data with higher confidentiality requirements.

This transition reflects a broader trend of balancing the need for AI efficiency with data sovereignty. The authority mentions that the current cloud setup can be adapted in the future based on the geopolitical situation. This suggests that the city is preparing for a world where cloud-based AI might face different regulatory or security hurdles.

Ultimately, the Hamburg case study serves as a candid account of how regulators are navigating the 'erasure gap.' Since it is currently impossible to delete specific data from a trained model's parameters, the focus remains on building robust filters and grounding mechanisms. This pragmatic approach will likely influence how other European authorities interpret the GDPR in the age of large language models.

Technical details and rules

The HmbBfDI's review was based on a specific legal benchmark: EDPB Opinion 28/2024. This opinion addresses how personal data may be 'absorbed' by model parameters during training. The regulator identifies three scenarios for this, concluding that the focus must remain on the AI system's handling of the data rather than the model's internal state.

The authority admits that enforcing data subject rights, such as the right to erasure, is currently unfeasible at the parameter level. They state that methods for model-internal deletion are still a field of scientific research that has not reached technical maturity. Consequently, they do not establish binding criteria for enforceable erasure obligations directly applicable to the AI model itself.

By adopting this stance, Hamburg is moving away from its previous position that models do not hold personal data. While their earlier views were challenged by researchers in 2025, the new standard aligns with the European Data Protection Board. This shift ensures that Hamburg's privacy watchdog remains compliant with unified EU standards while still utilizing modern AI tools to manage its workload.

Implementation and constraints

The Senate Chancellery has established global guidelines that every agency using LLMoin must follow. These rules strictly prohibit the processing of data requiring a high level of protection or the use of the tool for automated decision-making. Users are also forbidden from trying to retrieve personal data from the model's general knowledge base.

The tool is designed to be a helper for administrative tasks rather than a replacement for human judgment. It is used to shorten texts, filter important content, and generate documents in a typical administrative style. By providing configurable parameters for writing style and length, the system allows staff to maintain a consistent voice across the city's communications.

The HmbBfDI's case study serves as a roadmap for other public bodies facing similar workload pressures. It demonstrates how a regulator can justify the use of a commercial AI model by building a protective shell around it. This approach allows for the benefits of large-scale language processing while maintaining the necessary guardrails for public data protection.

The role of RAG and grounding

Retrieval-augmented generation, or RAG, is a key component of the LLMoin system. It allows the chatbot to pull information from a vector database of curated data provided by specific authorities. Because this data is stored in a database rather than the model's parameters, it can be easily deleted, corrected, or restricted through standard permission mechanisms.

The HmbBfDI notes that RAG provides a protective effect because it limits the model's reliance on its own training data. However, they clarify that this protection only applies to the search function. Outside of that specific function, the protective effect depends entirely on how the individual user interacts with the tool and the information they provide.

Prompt-based grounding is another method used to reduce risk when personal data is involved. In this scenario, users paste the relevant context directly into the prompt and instruct the model to base its answer only on that material. This is currently the most common way personal data is handled within the system, as staff enter information from specialized procedures to generate draft texts.

Future of local hosting

While the current system uses a cloud-based arrangement with Microsoft Azure, the city is looking toward local alternatives. The HmbBfDI is preparing for a transition to models hosted on-premises by Dataport. This move is intended to accommodate data with higher confidentiality requirements and to address potential geopolitical concerns regarding cloud data.

The move to local hosting would represent a significant shift in how the city manages its AI infrastructure. It would allow for more granular control over where data is processed and who has access to the underlying hardware. This transition is part of a long-term strategy to ensure that AI tools remain available even if cloud providers face regulatory changes.

The HmbBfDI's documentation makes it clear that the goal is to maintain a balance between technological capability and legal safety. By creating a modular system that can switch between cloud and local models, Hamburg is building a flexible framework for the future of government AI. This approach allows the city to scale its services without compromising its commitment to data protection.

Regulatory precedents

The Hamburg case study is a landmark document for the intersection of AI and privacy law. It provides a clear, pragmatic path for using large language models in a government context. By acknowledging that models are likely not anonymous, the regulator avoids the impossible task of proving total data absence and focuses instead on output safety.

This logic applies to any business or government entity building on someone else's model. If a system can be shown to prevent the extraction of personal data through filters, prompts, and RAG, it may be considered compliant even if the underlying model was trained on vast amounts of data. This 'system-level' focus is becoming the standard for AI governance in the European Union.

The HmbBfDI's adoption of LLMoin shows that AI is no longer just a tool for the private sector. As public agencies face increasing demands and shrinking resources, the use of AI to manage administrative burdens will become more common. The Hamburg experience provides a blueprint for how to do this while staying on the right side of the law.

Summary of safeguards

The HmbBfDI identified ten specific safeguards that, when viewed as a whole, provide sufficient mitigation for the risks of using LLMoin. These measures were chosen based on their ability to achieve safety while considering the costs of implementation. The regulator emphasizes that there is no single solution, but rather a combination of technical and organizational options.

Key components of this defense include the output filters that catch hate speech and violence, the system prompts that set boundaries for the AI, and the RAG system that grounds the AI in factual data. These layers work together to ensure that the model behaves as a tool for drafting rather than an autonomous agent making decisions about citizens.

The case study concludes that while the technology is still evolving, the current framework is sufficient for standard protection requirements. It allows the Hamburg administration to handle a 62 percent increase in complaints without needing to hire a proportional number of new staff. This balance of efficiency and security is the core of the HmbBfDI's new AI policy.

The erasure gap and research

One of the most significant hurdles identified in the report is the 'erasure gap.' Because personal data can be absorbed into a model's parameters, it is currently impossible to delete specific pieces of information once the model is trained. The HmbBfDI notes that methods for 'machine unlearning' are still in the research phase and have not reached technical maturity.

The regulator points out that the European Data Protection Board (EDPB) has not yet established binding criteria for how to handle these erasure requests. This leaves a gray area in current law where a data subject's right to be forgotten cannot be fully satisfied at the model level. For now, the focus remains on preventing the model from outputting that data in the first place.

The HmbBfDI's stance is that as long as the system prevents the output of unlawfully processed training data, the model can be used. This pragmatic stance allows for the continued use of powerful AI tools while acknowledging the current limitations of the technology. It places the responsibility on the system operators to maintain strict controls over what the AI is allowed to say.

Impact on public agencies

The availability of LLMoin to other German federal states marks a significant expansion of Hamburg's AI infrastructure. By sharing the tool, the city is helping other public agencies manage their own administrative burdens. Each agency, however, retains the autonomy to decide which specific tasks are suitable for the chatbot.

This shared model allows for a standardized approach to AI safety across different regions. It ensures that the same high-level safeguards—like content filters and RAG—are applied consistently. This consistency is vital for maintaining public trust in government technology and ensuring that data protection standards are not diluted as AI becomes more common.

As more agencies adopt these tools, the experience gathered by Hamburg will become increasingly valuable. The regulator's findings on how to handle privacy complaints will likely inform future guidelines for other types of government work. This collaborative approach to AI deployment helps create a unified standard for how public services can modernize safely.

The path to 2027

The roadmap for Hamburg's AI usage extends into the late 2020s. With the provisional agreement reached in 2026, the obligations for high-risk AI systems under the EU AI Act are set to become due by December 2, 2027. The city is already preparing for these requirements by establishing clear boundaries for what LLMoin can and cannot do.

By excluding high-risk use cases from the current chatbot, Hamburg is avoiding the most stringent regulatory hurdles while still reaping the benefits of AI. This phased approach allows the administration to build experience with 'standard' AI tasks before moving into more sensitive areas. It is a measured strategy that prioritizes safety and compliance over rapid, unguided expansion.

The HmbBfDI's case study serves as a living document of this transition. It shows a regulator moving from theoretical debate to practical application. As the technology matures and local hosting becomes available, Hamburg will continue to refine its AI strategy, providing a real-world example of how to navigate the complexities of modern data protection.

Technical constraints and goals

The HmbBfDI is clear that modifying a model to make it anonymous is currently technically unfeasible. Because of this constraint, the entire strategy is built on handling extraction risks at the system level. This means the goal is not to 'clean' the model, but to build a 'wrapper' that ensures the model's internal contents never reach the end user.

The system prompt is a key part of this, but the regulator warns that it is not a substitute for technical safeguards. It serves as a layer of guidance, telling the model how to behave, but it is backed up by actual filters that block prohibited content. This multi-layered defense is what the HmbBfDI considers sufficient for public administration use.

The ultimate goal is to provide a tool that can handle the massive influx of data protection complaints without compromising the rights of citizens. By using a modular design, the city ensures it can adapt to new models as they are released. This balance of technical flexibility and strict regulatory oversight is the hallmark of Hamburg's current AI policy.

The role of the Senate Chancellery

The Hamburg Senate Chancellery plays a central role in the deployment of LLMoin. They are responsible for the global guidelines that every agency must follow when using the tool. These guidelines are the primary mechanism for ensuring that the AI is used for its intended purpose and does not violate any privacy laws.

The Chancellery's oversight ensures that high-risk AI systems are excluded and that personal data with high protection requirements are not processed by the chatbot. By providing a centralized tool with built-in safety features, the Senate Chancellery makes it easier for individual agencies to adopt AI without having to build their own complex security infrastructures.