Can the works council actually stop a vishing simulation in Germany?

Yes. Co-determination over technical devices designed to monitor employee behaviour is a genuine veto, and where the parties do not agree a conciliation committee decides in their place. Whether a device is designed to monitor is judged objectively, so calling the platform a training tool does not help.

Can we record simulated calls in Germany?

We would advise not recording the audio at all. Recording the non-publicly spoken word of another without authorisation carries up to three years, being a party is not authorisation, and there is no business exception. Capture structured outcomes instead and the exposure disappears rather than being argued about.

Does German law ban automated outbound on ordinary numbers?

No. We looked and found no German rule restricting automated outbound to a class of number, and the regulator states that dialler use and call centre calling behaviour are not regulated as such. Our own product restriction here is conservative rather than legally required, and we would rather say so.

Which basis should we document?

Legitimate interests under Article 6(1)(f), with an assessment and an impact assessment. Not the employment provision in the federal act: it is still printed unamended, but the Federal Labour Court held in 2025 that it must be left unapplied for want of the safeguards the GDPR requires.

Compliance

Voice phishing simulations in Germany

Phone numbers in GermanySelf-provisioned after approval

Germany is the country where the timeline is set by your own works council rather than by any regulator: its agreement is a genuine precondition for a voice phishing simulation, and where you cannot reach one a conciliation committee decides in your place. The paperwork for the number is documentary and ordinary. The negotiation inside your business is the part to start early.

Phone numbers

Supplied by Callstrike

Local numbers in Germany, after a one-time approval.

Running a simulation

Permitted, once the works council agrees

Co-determination here is a veto, not a consultation, and it is judged objectively.

Consent

The works agreement, not the person

And a works agreement discharges co-determination without curing anything else.

Getting a phone number in Germany

One approval per country, completed in the console.

Self-provisioned after approval

Your company files its regulatory details once for this country. Once that is approved, your team provisions numbers directly from available inventory. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

German clearance is the most documentary in this batch and it is all about matching. You establish who the company is with an extract from the commercial register, a trade licence or a tax notification letter, and the address you give has to be the one that appears on that document, inside the area the number's prefix covers, and not a post box. A German geographic number carries a link to its own local area, so you cannot hold a Munich number for a Hamburg office because it makes the pretext better. Once the clearance is through, your own team rents German numbers directly.

One thing to know before you design the campaign, and it is ours rather than Germany's. Where the panel below the seam shows a restriction on automated outbound, that is a conservative product gate we applied ourselves. We went looking for a German rule of the kind France genuinely has and there is none; the regulator says in its own words that neither dialler use nor call centre calling behaviour is regulated by law as such. Ask us rather than assuming a prohibition, and plan the origination path domestically: a call showing a German number handed over from a foreign network has its number suppressed rather than delivered.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03Search the inventory and rent your numberYour team
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Proof of registrationDocument must match the supplied Business Registration Number (Nummer der Firma [ex. HRB 000000], VAT ID, or tax number [Steuernummer])	Excerpt from the commercial register, Tax ID number notification letter
Proof of business identity	Excerpt from the commercial register, Trade license, Tax ID number notification letter
Proof of addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable. Must match the address appearing on the official registration document.	Excerpt from the commercial register, Trade license, Tax ID number notification letter

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Germany?

The position in short, before your counsel reads the detail below.

Yes, and the German answer turns on an internal negotiation rather than an external permission. The works council has a co-determination right over the introduction and use of technical devices designed to monitor the behaviour or performance of employees, and a platform of this kind is one. Whether a device is designed to monitor is judged objectively, so a supplier telling you the product is a training tool rather than a monitoring tool is describing a distinction the Federal Labour Court has already rejected.

It is a real veto and the statute says so in the very next paragraph: where no agreement is reached a conciliation committee decides, and its award substitutes for the agreement. Either side can trigger it and the chair is appointed by the labour court if the parties cannot agree on one. You cannot introduce this unilaterally in a German business that has a works council, so the realistic plan is a works agreement negotiated in advance with time budgeted for it. Where no council has been elected, the right does not attach at all.

Two warnings about what the works agreement does and does not do. It discharges co-determination; it does not make otherwise unlawful processing lawful, and the Court of Justice has held that a court may review the necessity of the processing in full regardless of what the council signed. And the basis underneath it is legitimate interests, not the employment provision still printed unamended in the federal data protection act, which the Federal Labour Court held in 2025 must be left unapplied for want of the safeguards the Regulation requires. A programme documented on that provision is documented on nothing.

The advertising rule people expect to bite does not. Germany's automated-calling provision is scoped to advertising on its face, and the act it sits in reaches only a commercial act promoting the supply of goods or services. An authorised test of your own workforce promotes nothing. What is genuinely hard here is recording: the criminal code punishes recording the non-publicly spoken word of another with up to three years, being a party to the call is not authorisation, and there is no business exception. The German design answer is to record no audio at all.

What your company needs to do

6 items, in the order you will need them.

Open the works council conversation before you buy anythingGermany-specificThis is the German critical path and it is measured in weeks rather than days. Bring the purpose, the scope, what is collected, who sees it, how long it is kept and what it will never be used for, and expect to negotiate rather than to present. Where no works council has been elected, the right does not attach.
Record no audioGermany-specificEverything the exercise needs to evidence, whether the call was answered, whether a credential was disclosed and where the person disengaged, is capturable as structured data. That removes a criminal exposure instead of arguing about it, and it is a better answer than any recipe we could publish for a provision with no business exception.
Document legitimate interests, and cite the right provisionThe employment provision in the federal act is still printed unamended and reads perfectly well, which is exactly why programmes keep resting on it. Use the Regulation's own balancing ground, write the assessment, and treat an impact assessment as mandatory rather than advisable.
Acquire the number by allocation, not by agreementGermany-specificGerman law permits presenting a number only where you hold a right of use in it, and the regulator's own gloss is that such rights come from allocation and that a contract is not enough. Presenting a client's number under a contract with them is the paradigm spoofing case here, even though Ireland's regulator expressly permits exactly that arrangement. Do not carry the Irish answer across the border.
Originate inside GermanyGermany-specificProviders must ensure a German national number is displayed only where the call is handed over from the German network, and must suppress the display otherwise, with roaming excepted. An offshore campaign does not produce a suspicious German call. It produces a call with no number at all, which is worse for realism than a slow clearance.
Plan for the AI transparency duty rather than around itThe European duty to tell a person they are dealing with an AI system, and to disclose artificially generated audio, has applied since August 2026. The exception on the face of the text is for use authorised by law to detect or prosecute criminal offences, and a works council's sign-off is not that. Note also that deploying a high-risk system at the workplace carries its own duty to inform workers' representatives first.

The controls that do the work

How Callstrike is configured, and which provision in Germany each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

The Court of Justice has held that a court may review in full whether the processing was necessary, whatever the works council agreed, so necessity is the question a German programme has to answer twice. The call ends the instant an employee starts to give up a credential, which means the exercise measures susceptibility while the credential itself is never spoken into the system. That is the shortest possible answer to a full review of necessity, and it is the single most persuasive fact in a works agreement negotiation.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

Co-determination attaches because the platform is objectively capable of monitoring behaviour, and the negotiation that follows is about what the exercise does to the people in it. A second voice that breaks character the moment the call ends, with vishing training in writing the same day, is a concrete concession you can put into the works agreement itself, alongside the commitment that results are never individualised into a performance record.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Germany's employee instrument is collective, so this is not what unlocks the programme and it does not stand in for the works agreement. What it produces is the transparency layer the legitimate interests assessment depends on: a dated record of what staff were told, or a hashed copy of the works agreement or policy you already rely on with a signed attestation of the scope it covers.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the route to take while the works agreement is still being negotiated, and in Germany that is often months of value rather than a footnote. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module. A call a person opens in their own browser is not a telephone call, so the number-presentation rules and the cross-border display suppression have nothing to attach to.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

A genuine veto, and a basis the courts have taken away

Start with the trap, because it is the one a careful reader is most likely to fall into. Germany's employment-specific processing provision, section 26(1) of the federal data protection act, is still printed in the official consolidated text, unamended, with nothing on the page to suggest a problem. The Federal Labour Court held in May 2025 that it must be left unapplied, because it does not provide the safeguards Article 88(2) of the GDPR requires, following the Court of Justice's ruling that national employment provisions failing those conditions must be disregarded. So a programme documented on section 26 is documented on a provision the courts have removed from play, and the text will never tell you.

What is left is Article 6(1)(f) of the GDPR, legitimate interests, with a documented assessment. That is now forced rather than merely preferred. Consent is the wrong answer here as everywhere, and the German authorities have said so specifically in the context of recording telephone calls. Treat an impact assessment as mandatory rather than advisable.

Now the part that makes Germany different in kind. The works council has a co-determination right over the introduction and use of technical devices designed to monitor the behaviour or performance of employees. A vishing platform is such a device, and the Federal Labour Court has held that whether a device is designed to monitor is judged objectively: the employer's subjective intention does not matter. So a supplier telling you the platform is a training tool rather than a monitoring tool is describing a distinction the court has already rejected.

It is a real veto and the statute says so in the very next paragraph. Where no agreement is reached, a conciliation committee decides, and its award substitutes for the agreement between employer and works council. Either side can trigger it, the chair is appointed by the labour court if the parties cannot agree on one, and the award is reviewable only for exceeding the bounds of discretion within a short window. That is categorically different from a consultation duty. You cannot introduce this unilaterally in a German business with a works council, and the realistic plan is a works agreement negotiated in advance, with time budgeted for it.

One qualification that matters and is often missed: the right attaches to a works council that actually exists. The threshold in the statute is the point at which one may be elected, not one at which it exists automatically. No council, no section 87 right.

And one warning about what the works agreement does. It discharges co-determination. It does not make otherwise unlawful processing lawful. The Court of Justice held in December 2024 that a collective agreement in this field must comply with Articles 5, 6 and 9 of the GDPR as well, and that the parties' margin of discretion on whether processing is necessary does not prevent a national court from carrying out a full review. German case law says the same from the other direction. So a works agreement is how you satisfy the works council. It is not how you satisfy the GDPR, and a court will review necessity in full regardless of what the council signed.

Recording is a criminal question, and the answer is probably do not

In most of this cluster recording is a compliance question. In Germany it is section 201 of the criminal code, and the exposure is personal.

It punishes with imprisonment of up to three years or a fine whoever, without authorisation, records the non-publicly spoken word of another person onto a sound carrier, and separately whoever uses such a recording or makes it accessible to a third party. Attempt is punishable. Note the phrase the whole analysis turns on: the non-publicly spoken word of another. Being a party to the call is not authorisation, so Germany does not have the participant exception that Sweden's offence carries on its face, and the one-party framing that works elsewhere is simply wrong here.

There is no business exception. The only justification wording anywhere in the section attaches to the separate limb about public disclosure, not to the recording itself. Prosecution generally requires a complaint, which is a procedural comfort and not a legal one, since the person best placed to complain is the employee whose call you recorded.

Whether a prior general disclosure, in a staff notice, a works agreement or an IT policy saying that simulated calls may be recorded, makes a later covert recording authorised for these purposes is not something we could settle. The statute gives no answer beyond the word itself, and the German data protection authorities' decision on recording telephone calls expressly excludes the employee side in its closing sentence. So this is unresolved, and it is unresolved in a jurisdiction where the downside is a criminal conviction rather than an administrative fine.

That leads to a design recommendation rather than a legal argument, and it is the most useful thing on this page. Do not record the audio. Everything a simulation actually needs to evidence, whether the call was answered, whether a credential was disclosed, at what point in the script the person disengaged, can be captured as structured data by the operator without a sound recording of the employee's spoken word ever existing. That removes the exposure rather than arguing about it, and it is a materially better answer than any recipe we could publish.

Advertising is the trigger, and an AI voice is not the trigger

Germany's automated-calling rule sits in the unfair competition act, and its scope is the strongest claim on this page.

The provision makes an unreasonable nuisance unlawful, and treats as such, among other things, advertising using an automatic calling machine without the prior express consent of the addressee. The operative words are advertising. The act as a whole reaches only a commercial act, defined by reference to promoting the supply of goods or services. An authorised security test against your own workforce promotes nothing, so the rule is not engaged. That is a statement about what the rule covers, not a way around it, and it is the German counterpart of the direct-marketing limit that makes the United Kingdom page work.

Nothing in the telecommunications act or the digital services data protection act adds a general automated-calling rule on top. The Bundesnetzagentur says so in its own words on its public page about predictive diallers: neither the use of a telephony dialler nor the calling behaviour of call centres as such is regulated by law. What the agency does police is harassing calling behaviour, with published expectations about calling outside working hours and about repeated attempts, enforced as unlawful use of a number rather than as a dialler rule.

The rule that does reach an AI voice here is European. Article 50 of the EU AI Act has applied since 2 August 2026. It requires a system built to interact directly with people to be designed so the person is informed they are interacting with an AI system, and requires whoever deploys a system generating or manipulating audio constituting a deep fake to disclose that the content is artificially generated, both at the latest at the time of the first interaction or exposure. The exceptions on the face of the text are use authorised by law to detect, prevent, investigate or prosecute criminal offence, and evidently artistic or fictional works, where the duty is narrowed rather than removed. An employer's authorisation for a test comes from its management, its works council or its contracts. That is not authorisation by law, and the two senses of the word must not be run together.

One element is genuinely open and we will not close it: whether a synthetic voice resembling no identifiable person satisfies a definition requiring resemblance to existing persons, objects, places, entities or events. Where the voice imitates a specific real person it is inside on any reading. Note also that a live operator does not take you outside, because the definition covers content that is generated or manipulated, and transforming a real voice in real time is manipulation. In Germany the choice between the two modes is an operational one, and neither changes which rules apply.

Two further provisions of that Regulation reach an employer directly and both are easier to comply with before a feature exists than after. The first prohibits using AI systems to infer emotions of a natural person in the workplace, in force since 2 February 2025, at up to thirty-five million euros or seven per cent of worldwide turnover, excepted only for medical or safety reasons; it is gated by the definition of an emotion recognition system, confined to inference from biometric data. The second applies even where the prohibition does not: emotion recognition is listed as high risk, and an employer deploying a high-risk system must inform workers' representatives and the affected workers before putting it into service at the workplace. That duty is European and runs alongside whatever the domestic body is entitled to.

The number you present, and a restriction that is ours rather than Germany's

Take the panel beside this section first, because it needs explaining and we would rather explain it than let you infer something untrue from it.

The panel shows that we do not sell German local, mobile or national numbers for automated outbound calling. That is our own conservative product gate. It is not a German legal prohibition, and we are not going to present it as one. We went looking for a German rule restricting automated outbound to a class of number, of the kind France genuinely has, and there is none. The national numbering plan defines no class for automated, machine-originated or mass calling and reserves no range for one. The use conditions attached to geographic numbers are about where the subscriber is, and those attached to mobile numbers are about the service being mobile. And the regulator says outright that neither the use of a dialler nor call centre calling behaviour is regulated by law as such. We are telling you that our gate is more cautious than German law requires, because the alternative is letting you believe a prohibition exists that does not.

What German law does regulate is which number you may present, and here it is strict. An end user may only set and transmit an additional number where they have a right of use in that number and it belongs to the German number range. The regulator's own gloss is that such rights of use can be acquired only by allocation, and that a contractual agreement is not enough. So presenting a client's number under a contract with them is the paradigm spoofing case in German terms, which is a materially different answer from Ireland's, where the regulator expressly permits exactly that arrangement. Do not carry the Irish answer across the border. Directory, mass-traffic, premium and short-code numbers, and the emergency numbers, may never be presented as the caller's number at all.

The rule that will break a campaign quietly is the cross-border one. Providers must ensure that a German national number is displayed as the caller's number only where the call is handed over from the German public telephone network. Where a call showing a German number is handed over from a foreign network, the number display must be suppressed, with mobile roaming excepted. So an offshore-hosted campaign does not produce a suspicious German call. It produces a call with no number at all, which is worse for realism than getting the paperwork wrong.

What the country matrix holds for Germany

Number types:: Local
Restricted for automated outbound:: Local, Mobile, National

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

No clearance to wait for, and a local-address rule that probably is not yours

There is no German licensing or clearance step for making calls. What exists is a number allocation regime, and the distinction inside it is the thing most descriptions get wrong.

The regulator may refuse an allocation it grants itself where the applicant has no address at which proceedings can be served, or, where the applicant is established abroad, is not reachable through a domestic authorised recipient. It may also refuse where facts suggest the applicant does not offer assurance of complying with the rules, particularly where orders have previously been made against them.

But that governs allocations the agency makes directly, meaning to carriers and to end users who apply to it themselves. An ordinary business buying a German number from a carrier receives a derived allocation instead, and the provision governing those contains no local-address and no company-registration requirement at all. It grants a right to non-discriminatory derived allocation. So we are not going to write that Germany requires a local address to hold a number, because for the way you will actually obtain one, it does not.

None of that is what the table above the seam is doing. That is the carrier establishing who you are and matching you to an address before it hands over a number, generated from its own current rules, and it is evidence of the carrier's onboarding rather than of a German legal condition. Both can be true at once, and confusing them is how the local-address claim got into circulation.

One genuine constraint on geographic numbers is worth planning around, because a distributed campaign will trip it. A German geographic number carries a link to its own local area, tied to the subscriber's residence or business seat in that area, and the right of use lapses if that connection ends. So you cannot hold a Munich number for a Hamburg office because it makes the pretext better.

NIS2 is in force here, and one supervisory framework is being withdrawn

Germany has transposed NIS2 and it is in force, which is worth knowing because several of its neighbours have not. The implementing act was promulgated in December 2025 and entered into force the following day, replacing the previous federal information security regime with a new consolidated one.

Two provisions bear on this work. The risk management measures include evaluating the effectiveness of the measures taken, and basic cyber hygiene practices together with security training. And there is an express set of duties on management, which changes who inside the organisation has to care about whether the programme happens.

In financial services, be careful which document you are working to. The supervisory requirements for IT that German institutions have used for years are being withdrawn: the insurance, capital management and payment versions ceased at the start of 2025 and the banking version is staged out with full repeal at the end of 2026. The live instruments are DORA, whose training obligation is unusually direct in requiring security awareness and digital operational resilience training as compulsory modules for all employees and senior management, and the threat-led penetration testing framework operated nationally under the European scheme, in which social engineering appears as a technique. As everywhere in this cluster, the Regulation itself does not name voice phishing, so cite what it says rather than what a vendor says it says.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in GERMANY. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored and no audio is recorded. The workforce is informed in advance.

Verify or correct each proposition below against primary German sources:

1. ⚠ BDSG s.26(1) is still printed unamended with no banner, but BAG 8 AZR 209/21 (8 May 2025) held it 'hat unangewendet zu bleiben' for want of Art 88(2) safeguards, following CJEU C-34/21. So the basis is GDPR Art 6(1)(f) with an LIA and a DPIA.
2. BetrVG s.87(1) Nr. 6 gives the works council a genuine veto, s.87(2) sends a deadlock to the Einigungsstelle, and 'designed to monitor' is judged objectively.
3. A Betriebsvereinbarung discharges co-determination only; CJEU C-65/23 (19 December 2024) preserves full judicial review of necessity.
4. StGB s.201 has no participant exception and no business exception; a prior general disclosure does not clearly make a later covert recording 'befugt'. Advise.
5. UWG s.7(2) Nr. 2 is scoped 'bei Werbung', and UWG s.2 confines the act to a geschaeftliche Handlung, so neither reaches an internal test.
6. ⚠ There is NO German rule restricting automated outbound to a class of number; the Bundesnetzagentur states diallers and call centre calling behaviour are not regulated as such. Confirm or correct.
7. TKG s.120 permits presenting an additional number only with a right of use acquired by allocation, and requires suppression for German numbers handed over from abroad.
8. TNV s.8 abgeleitete Zuteilung carries no local-address or registration condition.

Flag anything that has changed since September 2026, and advise on AI Act Arts 50 and 26(7) for a workplace deployment.

Common questions

Can the works council actually stop a vishing simulation in Germany?: Yes. Co-determination over technical devices designed to monitor employee behaviour is a genuine veto, and where the parties do not agree a conciliation committee decides in their place. Whether a device is designed to monitor is judged objectively, so calling the platform a training tool does not help.
Can we record simulated calls in Germany?: We would advise not recording the audio at all. Recording the non-publicly spoken word of another without authorisation carries up to three years, being a party is not authorisation, and there is no business exception. Capture structured outcomes instead and the exposure disappears rather than being argued about.
Does German law ban automated outbound on ordinary numbers?: No. We looked and found no German rule restricting automated outbound to a class of number, and the regulator states that dialler use and call centre calling behaviour are not regulated as such. Our own product restriction here is conservative rather than legally required, and we would rather say so.
Which basis should we document?: Legitimate interests under Article 6(1)(f), with an assessment and an impact assessment. Not the employment provision in the federal act: it is still printed unamended, but the Federal Labour Court held in 2025 that it must be left unapplied for want of the safeguards the GDPR requires.

Elsewhere in Western Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.