Generative artificial intelligence tools are increasingly being used by employees to draft documents, translate, summarise information or analyse data. Although they can streamline work, their use may pose risks to employers when employees enter confidential information, customer data or personal data into these applications.

Once transmitted to an AI tool, the information may be stored or processed under conditions that are not always known to the user. Employers must therefore establish clear rules regarding the use of these tools and ensure that employees are aware of the limits within which they may use them.

What are the employee’s obligations when using AI tools?

The use of AI tools does not remove the obligations that the employee has under their individual employment contract and labour legislation.

Under Article 39 of the Labour Code, an employee is responsible for observing workplace discipline, complying with the provisions of the internal regulations, and maintaining loyalty to the employer whilst performing their duties, as well as upholding professional confidentiality, where applicable. Furthermore, the parties may include a confidentiality clause in the individual employment contract, subject to the conditions set out in Article 26 of the Labour Code.

Consequently, entering confidential information into an AI tool cannot be justified simply by the employee’s desire to complete their tasks more quickly. The use of such applications must comply with the employee’s duties and the rules laid down by the employer.

What information should not be entered into unauthorised AI tools?

The employer should expressly specify the categories of information that may not be entered into unauthorised AI tools for professional use. This category may include the personal data of employees, customers or partners, non-public financial and commercial information, tenders and prices, contracts and commercial negotiations, customer or supplier databases, internal documents and information relating to company strategy, as well as information protected by contractual confidentiality obligations or which meets the legal criteria to be considered a trade secret.

Not all internal data is automatically a trade secret, but it may be confidential under contracts or the employer’s internal rules.

Particular attention must be paid to personal data. Removing a person’s name does not necessarily mean that the data has been anonymised, as identification may still be possible by combining other information, such as job title, location, age, salary or certain professional events.

For example, replacing an employee’s name with the phrase ‘Employee A’ is not sufficient if the document retains details that allow the employee to be identified. For data to be considered anonymous, it must no longer be possible to identify the individual by any means that could reasonably be used. If identification remains possible, the data may still be regarded as personal data, even if the name has been replaced with a code.

Employees must therefore also remove or generalise any other elements that could lead to the identification of an individual. If effective anonymisation is not possible, the data should not be fed into an unapproved AI tool.

Can the employer restrict or prohibit the use of AI?

In exercising their prerogative to organise and manage the business, as provided for in Article 40 of the Labour Code, the employer may set out the conditions under which AI tools may be used in the workplace.

Depending on the specific nature of the work and the risks identified, the employer may permit the exclusive use of certain AI tools, prohibit the input of certain categories of information, require prior approval for the use of certain applications, restrict the use of personal accounts for professional purposes, or limit the use of AI in certain activities, if the risks justify such a measure.

Before approving a tool, it is advisable for the employer to analyse the terms of use, how the provider processes the information entered, the possibility of using it to train or improve models, storage periods and deletion options. The use of a work account does not, in itself, guarantee the protection of information.

Why is an internal policy on the use of AI necessary?

To ensure that the rules are applied consistently, the employer may include provisions on the use of AI in the internal regulations or adopt a separate procedure. The document should specify which tools are approved, which categories of information must not be entered into them, under what conditions personal accounts may be used, when prior approval is required, what obligations employees have in verifying the results generated by AI, and how incidents must be reported, including the consequences of breaching the rules.

The provisions must be clearly communicated to employees so that they are aware of their obligations. An effective internal policy should not be limited to general prohibitions, but should also provide concrete examples tailored to the work carried out.

Is it sufficient to adopt an internal policy, or must the employer also train employees?

Adopting an internal policy is not sufficient if employees do not understand the risks associated with the use of AI tools.

Article 4 of Regulation (EU) 2024/1689 on artificial intelligence sets out the obligation for providers and operators of AI systems to take measures to ensure a sufficient level of AI literacy for staff and other persons using AI systems on their behalf, taking into account their knowledge, experience and training, as well as the context of use.

In practice, the training should explain what information may be entered into approved tools, why simply removing a name does not guarantee anonymisation, and how to proceed when an employee accidentally discloses sensitive information. The content of the training can be tailored to the activities of different departments, given that staff in human resources, finance, legal or sales may have access to different categories of confidential information and may face specific risks.

Can the employer monitor how employees use AI tools?

The employer has a legitimate interest in verifying compliance with internal rules on the use of AI tools. However, such checks must be carried out whilst respecting employees’ right to privacy and data protection legislation.

Where checks involve the monitoring of electronic communications or video surveillance in the workplace, the conditions set out in Article 5 of Law No. 190/2018 must be taken into account, including the justification of the legitimate interest, prior and explicit notification of employees, consultation with their representatives where appropriate, and compliance with the principle of proportionality.

Consequently, monitoring methods must be chosen in accordance with the intended purpose, without collecting information that is not necessary.

When can the use of AI result in disciplinary liability for an employee?

A breach of the rules governing the use of AI tools may give rise to disciplinary liability, in accordance with Article 247 of the Labour Code, if the act constitutes a disciplinary offence.

Liability does not occur automatically for every error. The employer must analyse the specific circumstances, the obligations breached, the existence of fault and the consequences of the act. For example, the situation of an employee who accidentally enters information into an approved system, without breaching a communicated rule, is different from that of an employee who deliberately transfers a customer database to an unauthorised system, despite being aware of the prohibition.

When determining the sanction, the criteria set out in Article 250 of the Labour Code must be taken into account, and its application must comply with the disciplinary investigation procedure and the guarantees of the right to a defence provided for in Articles 251 and 252.

How should an employer proceed if an employee enters confidential information into an AI tool?

In the event of an incident, the employer should act promptly to limit the consequences and to establish what information was transmitted, to which tool, at what time, and under what conditions it was processed or stored.

Depending on the nature of the incident, it may be necessary to involve those responsible for information security, data protection and legal compliance. If personal data has been involved, the employer must assess whether the situation constitutes a data breach and whether the notification obligations set out in Articles 33 and 34 of the GDPR apply. Notification to the supervisory authority must be made, where the legal conditions are met, within 72 hours of the controller becoming aware of the breach, and data subjects must be informed if the breach is likely to result in a high risk to their rights and freedoms.

Apart from this, the employer may assess whether the employee’s actions constitute a disciplinary offence. It is also important to check whether the incident was facilitated by a lack of clear rules, insufficient training or the use of tools that had not been properly assessed.

The use of artificial intelligence in the workplace requires adapting organisational rules to new ways of using information. By setting clear boundaries, training employees and managing incidents promptly, the employer can capitalise on the benefits of AI tools without neglecting their obligations regarding confidentiality and data protection.

***

Informative material. Internal policies on the use of artificial intelligence must be adapted to the employer’s business, the tools used and the applicable legal obligations.