Artificial Intelligence in the Workplace

Whether Copilot, ChatGPT or industry-specific solutions – artificial intelligence (AI) has long since become part of everyday business life. Employees use AI tools to draft texts, analyze data, write code and support customer communication. Many companies, however, still lack a clear position: some actively encourage the use of AI and provide their own systems, while others largely prohibit AI. In practice, the latter often leads to the uncontrolled use of “shadow AI”, where employees secretly or informally use external tools – frequently via private accounts and without any company guidelines, particularly on handling sensitive data.

AI Act: Legal framework for using AI?

With the European Artificial Intelligence Act (AI Act; in German: KI-Verordnung, KI-VO), the EU is creating a binding legal framework for the use of AI systems. The Act follows a risk-based approach: the higher the risk, the stricter the requirements. It distinguishes in particular between prohibited AI systems (e.g. certain manipulative or surveillance systems), high-risk AI systems (for example in HR or healthcare), AI systems with limited risk and AI with minimal risk.

The AI Act differentiates between so-called providers and deployers of AI systems. Providers are those who develop an AI system or have it developed and place it on the market or put it into operation, for payment or free of charge, under their own name or brand. Deployers are those who use an AI system on their own responsibility. Purely private, personal use of AI by individuals is not covered by the AI Act. Companies, however, are generally regarded as deployers within the meaning of the Act and must comply with the requirements applicable to deployers of AI systems.

For deployers of AI systems that are neither prohibited nor classified as high-risk, the AI Act in its current version provides only a few specific obligations. These include in particular transparency requirements and the obligation to ensure an appropriate level of AI competence. To build AI competence among employees, companies can offer targeted training or e‑learning programs so that AI systems are used safely and in compliance with the rules. These measures also serve as evidence that the company is meeting its organizational duties. It would nonetheless be a mistake to conclude that only limited action is required. Even when using AI systems, all the “usual” requirements must still be observed: data protection law (in particular the GDPR), protection of trade secrets, copyright, competition law, IT security, employment law and internal compliance rules.

Why an internal AI policy makes sense

Even though the AI Act only imposes specific obligations on certain systems and roles, the use of AI in companies is legally and organizationally complex. Without clear guidance, there is a considerable risk that individual employees will decide on their own which tools to use – with the potential result that data is disclosed without control, legal requirements are breached and liability risks are triggered. There are also reputational risks, for example if incorrect or discriminatory AI results become public or confidential information is fed into AI models.

An internal AI policy is therefore a key instrument to structure the use of AI, ensure compliance with legal requirements and clearly allocate responsibilities within the company. It creates transparency, defines responsibilities and makes the handling of AI understandable for employees. The specific content can vary depending on the company’s size and industry.

Employment law implementation: From paper to everyday practice

An AI policy should not just exist “on paper”; it must be effectively implemented in day‑to‑day work. Employment law plays a central role here. Once the policy has been drafted, the question is how to introduce it in a binding way vis‑à‑vis employees and how to ensure compliance.

At the individual employment law level, the AI policy can in many cases be introduced as part of the existing workplace rules by exercising the employer’s contractual right to issue instructions. Where the policy imposes more far-reaching obligations or significantly changes working conditions, explicit contractual incorporation or an addendum to the employment contract is advisable (e.g. through amendments to existing contracts or by adjusting standard contract templates for new hires). It is important to communicate its binding nature clearly and to make the policy available to employees in written form.

Where the AI policy regulates employee behavior, involves performance monitoring or introduces technical systems that can be used to monitor performance or behavior, the co‑determination rights under the Works Constitution Act (Betriebsverfassungsgesetz) or the relevant state public sector staff representation laws must usually be observed. The introduction and design of the policy should therefore be coordinated at an early stage with the works council or staff council and, where appropriate, set out in a works agreement. This not only strengthens its binding force under employment law but also increases acceptance in the workplace.

The AI policy should also clearly define what constitutes a breach (e.g. use of non‑approved tools, entering confidential data into external systems, ignoring documented processes) and what employment law consequences may follow. Depending on the severity, measures may range from verbal warnings to formal written warnings and, in serious cases, conduct‑related dismissal. Transparent procedures, a graduated sanctions regime and documented compliance processes help to avoid conflicts and to act in a traceable manner if disputes arise.

To ensure that the AI policy is actually put into practice, clear responsibilities are also needed (e.g. IT, data protection, HR, compliance) for monitoring adherence to the policy and assessing new AI applications. Any technical monitoring measures must comply with employment law requirements, in particular personality rights and co‑determination rights. In addition, the policy should specify how it will be updated to reflect legal and technical developments and how employees will be informed about changes.

Act now to minimize risks and harness opportunities

The use of AI in companies is not a short‑lived trend but a lasting structural change. Companies that do not actively manage their use of AI risk violations of the law, loss of rights and liability cases. A well‑thought‑out AI policy is therefore not “nice to have”, but a central management tool. It reduces risks, creates transparency and enables AI to be used where it delivers genuine added value – in a legally compliant and controlled way. If it is made binding within employment relationships, taking into account co‑determination rights, transparency and information obligations as well as clearly defined sanctions, the use of AI in the company can be designed in a legally secure, fair and sustainable manner for employees and employers alike.