A bug in the statute: AI finds errors in German regulations – and what that means for warning letters
Your contact person
What happens when you point an AI at the Federal Law Gazette the way a security researcher points tools at someone else’s code? Two authors tried it and report a whole series of previously unnoticed errors in German regulations.
We wanted to know whether this also works where it costs our clients money: in the regulations on which warning letters for breach of statutory duty are based.
The result is sobering and instructive at the same time.
Overview
- A bug report for the Federal Law Gazette
- Why the citation requirement of all things?
- We took a look ourselves
- What does this mean for warning letters based on breach of statutory duty?
- The legislator should be reading along
- Frequently asked questions about citation errors in German regulations
- Further information
A bug report for the Federal Law Gazette
On 28 October 2026, Felix Ringe and an anonymous co-author published an essay entitled “Legal exploits may emerge at scale”, which is currently doing the rounds in legal tech circles. Their thesis is that statutes are code written in natural language and therefore, like software, contain vulnerabilities. Such vulnerabilities rarely surface today because courts smooth them over through interpretation and because nobody searches for them systematically. Large language models change that, since legal review becomes cheap and can be repeated at scale.
The authors tested their approach at a point where interpretation hardly helps: the citation requirement in Article 80(1), sentence 3 of the German Basic Law (Grundgesetz, GG). A regulation (Rechtsverordnung) issued by the executive must cite the statutory provision that authorises it. If the authorisation required for a specific rule is missing from the preamble, that rule is void under settled case law, as the Federal Constitutional Court (Bundesverfassungsgericht) already held in its judgment of 6 July 1999 (case no. 2 BvF 3/90). The authors published only three findings whose exploitation they consider harmless: a confidentiality rule in the Occupational Diseases Regulation, the addition of Mali to the list of countries subject to an airport transit visa in 2015, and the exemption of soldiers serving at NATO’s JSEC command in Ulm from working-time protection. In each case the ministry cited different subsections in an amending regulation from the one it actually needed.
Why the citation requirement of all things?
For a machine, the citation requirement is a rewarding field of inquiry. It requires a simple comparison between what an amending regulation provides and what its preamble cites, and that comparison does not tolerate generous interpretation. As recently as 2020, the Federal Administrative Court (Bundesverwaltungsgericht) stressed that a regulation must in principle cite every authorisation it relies on (decision of 16 January 2020, case no. 3 B 51.18). The Higher Administrative Court of North Rhine-Westphalia (OVG Nordrhein-Westfalen) accepted a narrow exception for small amendments that only make sense when read together with the original, correctly cited regulation (judgment of 27 October 2014, case no. 3 A 1217/14).
What makes the issue relevant in practice is a procedural point. Unlike an Act of Parliament, a regulation may be reviewed by any ordinary court, which may disregard a void provision in the individual case without referring the question to the Federal Constitutional Court. The objection can therefore be raised in any ordinary proceedings, including preliminary injunction proceedings following a warning letter.
We took a look ourselves
We applied the approach to the regulations we deal with daily in competition law and compared the more recent amending regulations against their enabling provisions. We worked from the official texts in the Federal Law Gazette and on gesetze-im-internet.de; the AI did the groundwork and we did the assessment ourselves.
The result is better for the ministries than the essay might suggest. The fourth amendment to the Tobacco Products Regulation (Tabakerzeugnisverordnung) of 2023, which extended the ban on characterising flavours to heated tobacco products, correctly cites the relevant authorisations in Sections 5 and 6 of the Tobacco Products Act. The two most recent amendments to the Passenger Car Energy Consumption Labelling Regulation (Pkw-EnVKV) of 2024 and 2026, which introduced CO2 classes and new label templates, are correctly based on Section 4 of the Energy Consumption Labelling Act (EnVKG). At most, the 2024 reference to where the EnVKG was last amended is out of date, which has no consequences. The December 2025 amendment to the Cosmetics Regulation is also in order. Finally, the Price Indication Regulation (Preisangabenverordnung) was amended in 2026 only by Acts of Parliament, to which the citation requirement does not apply.
Of all places, we found something in the Food Information Implementing Regulation (Lebensmittelinformations-Durchführungsverordnung, LMIDV). Its Section 6(2) makes it a criminal offence to place highly perishable food on the market after its use-by date and refers to EU law for that purpose. Attaching criminal sanctions to directly applicable EU provisions in this way requires a regulation under Section 62(1) no. 1 of the German Food and Feed Code (LFGB). The provision was recast by Article 3 of the dairy products adjustment regulation of 24 November 2025 (Federal Law Gazette 2025 I No. 280) and has applied in that version since 14 June 2026. However, Section 62 LFGB is missing from the preamble of that regulation, whereas the original regulation of 2017 had cited it properly. Somewhat awkwardly, in September 2026 the ministry published a correction of exactly this amending provision (Federal Law Gazette 2026 I No. 265) without noticing the missing authorisation.
This is, of course, no licence to sell expired minced meat. In substance, the new version merely updated the references to EU law, and the explanatory memorandum speaks of formal adjustments. If the new version is void, in our view the old 2017 version, which rests on a correctly cited authorisation, simply continues to apply. Anyone relying on the defect in criminal proceedings therefore gains nothing. The finding does show very clearly how such errors arise: the preamble of an earlier regulation is copied, the new authorisations are added, and an old one gets lost along the way.
What does this mean for warning letters based on breach of statutory duty?
A large share of the rules on market conduct enforced through Section 3a of the German Act against Unfair Competition (UWG) are found not in statutes but in regulations: price indications, labelling obligations for food, cosmetics, tobacco, energy consumption and much more. If the specific provision complained of is void because of a citation error, there is no rule on market conduct and the breach-of-statutory-duty claim falls away. For the recipient of a warning letter, this is an objection the other side is usually not prepared for.
Expectations should nonetheless be kept in check. Many obligations also follow directly from EU regulations, which the German citation requirement does not affect, and much can additionally be challenged as misleading conduct or the omission of material information under Sections 5 and 5a UWG. If a defective new version falls away, the predecessor rule often revives, as our example shows. A genuine exploit in Ringe’s sense only exists where the void rule is new, has no predecessor and no other provision requires the same thing.
Recipients of warning letters can nevertheless include the check in their defence, and with little effort:
- trace the provision complained of back to the amending regulation that gave it its current wording,
- compare the preamble of that regulation with the authorisation required for exactly this rule,
- check whether, if the rule is void, an older version, an EU provision or another UWG provision establishes the same prohibition,
- raise the objection only where, after this check, nothing actually remains.
Conversely, a claim resting solely on a recently amended provision of a regulation deserves a second look before a warning letter is sent. We have reported before that a party can be left with the costs of a warning letter despite a justified claim (in German) if the warning letter relies on the wrong provision. A void provision is a particularly unpleasant example.
The legislator should be reading along
Ringe and his co-author conclude that the legislator must harden its rule-making, if necessary with the same tools. We agree. If a law firm can review several years of regulations for citation errors in a single morning, a ministry can do the same before promulgation. We have asked elsewhere whether lawyers may in future be liable for not using AI (in German). That question does not arise for desk officers in federal ministries, although a legal duty to draft the preamble carefully has existed since 1949.
How we work with AI ourselves and where we draw the line is described on our page LHR & AI (in German). The experience from this small sample matches everything we describe there: the machine finds a surprising amount in a short time, but whether a finding is worth anything is still decided by the lawyer.
Frequently asked questions about citation errors in German regulations
What does the citation requirement in Article 80(1), sentence 3 GG require?+
Is a provision with a citation error automatically invalid?+
Does a court have to refer the question to the Federal Constitutional Court?+
Can a citation error help against a warning letter under Section 3a UWG?+
Does the citation requirement also apply to amendments made by an Act of Parliament?+
Received a German warning letter for breaching a regulation?
We review the allegation in full, including whether the provision relied on is valid at all. You will usually receive an initial assessment within 24 hours.
Further information
- Abmahnung: Wann man trotz berechtigter Forderung auf den Kosten sitzen bleibt (in German)
- Frisst das Anti-Abmahn-Gesetz seine Kinder? (in German)
- LHR & KI – Künstliche Intelligenz in unserer Kanzlei (in German)
- Felix Ringe: Legal exploits may emerge at scale (28 October 2026)
- Our fields of activity
- Our successes
Related posts
Multiple awards.
