1. Two markets are changing at the same time

Dietary supplements are no longer a niche market. According to a market analysis by the Dietary Supplements Working Group of the German Food Industry Association, the German market is valued at approximately 4.3 billion euros, with sales of about 415 million packages.

More decisive than size is the shift in focus. Alongside vitamin and mineral intake, exercise, and general well-being, “healthy aging” is emerging. As a result, the purpose of the product is changing in the customer’s perception: away from addressing a specific deficiency, toward prevention, optimization, personalized nutrition, and extending healthy life expectancy. Longevity is not a legally defined market, but rather a horizon of expectations—and precisely for that reason, it is a market in which personalized advice is sold, not just product information.

At the same time, AI is becoming part of customer communication, not just content production. The evolution spans packaging, websites, influencers, and chatbots, leading to personalized advisors and, in the future, agents who combine products, suggest intake plans, fill shopping carts, and make adjustments later on. The appeal is obvious: Consumers don’t want to know what’s in Product X; they want to know which product is right for them. One-to-many marketing is evolving into ongoing one-on-one communication.

This leads to the question posed in this article: What happens when a heavily regulated communications sector encounters systems that only formulate their messages through dialogue? Both legal issues can first be considered separately—and only then brought together.

2. Health Claims Without AI

Dietary supplements are foods. Their advertising is subject to a ban with exceptions: Health claims are prohibited unless they are authorized and the conditions for their use are met (Art. 10(1) HCVO); general health claims must be accompanied by an authorized claim (Art. 10(3) HCVO). Claims relating to diseases are prohibited (Art. 7(3) LMIV). If a product is presented as a means of treating or preventing diseases, the question of whether it should be classified as a “presentation drug” may also arise (Section 2(1)(1) AMG).

What matters is not the wording itself, but the overall impression on the average consumer; the Federal Court of Justice (BGH) confirmed this in October 2025 with regard to collagen drink ampoules, even in cases involving overt beauty claims (I ZR 135/24). The broad scope of the term is also demonstrated by the preliminary ruling proceedings in Case C-721/24 (Vista-Life Pharma), a referral from the Brussels Court of Appeal: The case concerns the question of whether information regarding frequency of intake and method of use can constitute health claims if it is linked to a health benefit.

The standard is media-neutral. Packaging, online stores, TV, influencers, or sales pitches do not change it—they only affect how well it can be controlled. The classic approach, therefore, is: product, message, review, approval. The message exists before a consumer reads it.

3. AI Communication Without Health Claims

Second point of departure, setting health claims aside for now: A company uses a generative bot, and the bot says something incorrect. “It was the AI” is hardly a valid excuse when the system is being used specifically for the company’s own customer communications—it speaks on behalf of the company, on its platform, about its products.

The focus of due diligence thus shifts from individual statements to the system as a whole: selection, knowledge base, prompts, guardrails, testing, monitoring, escalation, human oversight, and documentation. The transparency requirement under the AI Act (Art. 50, effective August 2, 2026) is a separate matter; however, it only addresses whether the user recognizes the AI, not whether the statement is permissible. With regard to liability, the law of unfair competition, contract law, tort law, and organizational duties remain applicable. In addition, there is a parallel development: In October 2026, the Bundestag passed a resolution to modernize product liability law. Under this resolution, software is to be classified as a product regardless of its form of delivery; this explicitly applies to AI systems as well.

This turns the question “Was this sentence unlawful?” into: Was the system designed in such a way as to sufficiently prevent unlawful sentences?

4. When the two systems collide

Health claims legislation regulates statements. Generative AI dynamically generates statements. The obvious conclusion from this connection is that an AI-generated health claim remains a health claim. The communication channel does not create any regulatory leeway. What is no longer viable is the method used to regulate it.

Escalation Ladder · Six Levels, One Threshold

These levels are not legally equivalent, and no single statement need be conspicuous on its own. An advisor can cross the line within just a few responses—and the approach will vary depending on the conversation with each client.

Traditional: Formulate a statement, verify it, and approve it. Generative: Build, constrain, test, and monitor a system that generates statements.

5. Six Sensitive Areas

1. Attribution of output. Anyone who integrates an advisor into their own sales organization creates a commercial communication channel. AI-generated does not automatically mean third-party generated.
2. Claim, context, and individual needs. There is more than just a linguistic difference between “Vitamin B6 helps reduce tiredness and fatigue” and “Since you’re tired, you need vitamin B6”: The second statement implies an individual need. Whether the approval of a general claim covers its individualized application remains an open question—and is the central issue for every advisor.
3. Advertising or health counseling. The more personal information the system processes and the more it uses that information to draw individualized conclusions and make recommendations, the less its communication resembles traditional product advertising. Regulatory assessment cannot, therefore, be limited to individual sentences; rather, it must consider the dialogue, the system’s intended purpose, and the nature of the recommendations derived from it.
4. Classification of the product and software. If the presentation leans toward medical conditions, the question arises as to how the product should be classified. Regardless of this, the software itself may become subject to regulatory requirements if, based on its intended use, it serves purposes such as diagnosis or prevention (Art. 2 No. 1 MDR). The product and the Advisor must be assessed separately; the output affects both levels.
5. Personalization and health data. When the system asks about symptoms, medications, sleep, or lab results, it processes health data, which Article 9 of the GDPR subjects to a general prohibition on processing, with narrow exceptions. An advisor’s most economically attractive feature is therefore also its most sensitive one.
6. Liability, Contract, Organization. Between the brand, the integrator, the agent, and the model provider, it must be clarified who is responsible for the output, who is authorized to modify the system, what needs to be retested after a model change, and who grants indemnification. This division of responsibilities is established in the contract—or it is not.

In addition, there are issues that will only be mentioned here: differing claim regulations in various markets, vulnerable groups, and interactions with medications, as well as third-party shopping assistants that recommend products without the manufacturer’s involvement.

What an invalid output can cause

The consequences are not limited to the specific subject matter. Unlawful health claims or misleading statements may also be relevant under unfair competition law. Under the UWG, claims for removal and injunctions are particularly relevant (Section 8); competitors and eligible associations may issue cease-and-desist notices and pursue legal action against violations. If a cease-and-desist notice is justified, the costs must be reimbursed (Section 13(3)); depending on the case, claims for damages may also apply (Section 9).

In addition, food safety authorities may take action. Violations of the provisions of the Health Claims Regulation and the Food Information Regulation (LMIV) may result in administrative fines or criminal penalties under the German Food Code (LFGB)—depending on the facts of the case and the degree of fault (see §§ 59, 60 LFGB).

With AI systems, another layer comes into play: Internally, issues of recourse and liability arise between the brand, the integrator, the agent provider, and the model provider. A single problematic output can thus affect multiple legal frameworks simultaneously—food law, competition law, data protection law, and liability law.

Because the error can trigger these consequences simultaneously, it is not enough to check the output only after the fact.

6. Compliance Through Architecture

A disclaimer doesn't solve the problem. "This response was generated by AI" creates transparency, while "is not a substitute for medical advice" creates distance—neither of these makes an invalid output valid.

What remains is the integration of controls into the system’s architecture: verified product data, a database of permitted claims along with conditions of use, explicitly prohibited statements, rules governing what the system is allowed to ask, rules for the transition from information to recommendations, escalation rules for borderline cases, an output check prior to display, logging, and human oversight.

Eight Questions Before Go-Live

1. What kinds of statements is the system allowed to generate—and based on what verified data?
2. Is it permissible to paraphrase approved claims, or only to reproduce approved wording?
3. When is it appropriate to move from general information to a specific product recommendation?
4. What health-related information is it permitted to ask for—and on what legal basis under data protection law?
5. Which situations are blocked or escalated to a person?
6. How are the technical differences in claims processing procedures across markets accounted for?
7. How are outputs tested, logged, and retested after a model or version change?
8. Who is contractually responsible when a model provider, agent provider, or integrator makes a change?

7. Not Just a Risk

A well-designed advisor accesses only approved product data, uses only permitted claims, recognizes critical contexts, blocks references to illnesses, escalates borderline cases, and documents every interaction. In certain situations, it can therefore communicate more reliably than spontaneous human sales advice—which no one documents and hardly anyone reviews.

The regulatory unit of the future may therefore no longer be the individual claim alone, but rather the system that generates it: from the “Approved Claim” to the “Approved Claim Architecture.” The crucial question will then no longer be whether this claim is permissible, but whether this system is designed in such a way that its statements, recommendations, and actions remain within the legally permissible scope.

We work with companies to review these systems before rollout—from the basis for claims to guidelines for handling inquiries and escalations, all the way through to the contractual arrangements with the participating providers. To schedule a consultation: office@oc-legal.de

This article is intended for general informational purposes only and is not a substitute for advice in specific cases. As of October 2026.