PIPELINEGuide
GDPR and AI tools: what employees are allowed to enter
AI tools are used in practically every business — usually without rules. The distinction that actually helps in everyday practice.
AI tools are used in practically every business, usually without clear rules. What matters is the distinction between free consumer accounts without contractual safeguards and business accounts with a data processing agreement and European processing. A simple traffic-light rule with three categories is something a team will reliably remember; a blanket ban only leads to invisible use on personal devices.
01
The real risk
It's rarely about malicious intent. Someone has a customer email summarized, someone else throws in a draft contract. Both are understandable, and both can be problematic depending on the tool and the data involved.
02
The crucial distinction
Free consumer accounts without contractual safeguards are unsuitable for personal or confidential data. Business accounts with a data processing agreement, excluded training, and European processing are a different matter. This distinction belongs in every usage policy because it's constantly relevant in everyday work.
03
What works in practice
A traffic light: green for general tasks without personal data, yellow for internal content in a secured tool, red for health data, personnel data, client and patient content. A team will remember three categories, not twelve.
04
What the policy must include
Which tools are permitted, what data may be entered, who decides in case of doubt, and what to do if something does get entered by mistake. That last point is almost always missing and is the most important.
05
Banning doesn't help
A blanket ban leads to use on personal devices — that's the worst possible situation because it's invisible. A secured account with clear rules is more practical and safer.
06
An everyday example
An employee summarizes a customer complaint in a free AI tool to respond faster — without malicious intent, but with personal data in an account without contractual safeguards. A clear traffic-light rule would have prevented that beforehand; a ban after the fact comes too late.
Questions
Frequently asked questions
Is a data processing agreement enough?
It's necessary, but not sufficient on its own. It also requires a legal basis, purpose limitation, deletion concept, information for data subjects, and review of whether data is transferred to third countries.
Can we have job applications processed?
For structured capture under certain conditions, yes. For hiring decisions, the EU AI Act imposes significantly stricter requirements — systems that decide on access to employment are classified as high-risk.
What about locally running models?
Models on your own infrastructure solve the transfer problem because no data leaves the premises. They require more setup and often deliver weaker results for complex tasks — for sensitive areas, it's still often the right approach.
Next step
Let's talk briefly about whether this makes sense for you.
A twenty-minute conversation is usually enough to clarify whether a project makes sense. If not, we'll say so — that's cheaper for both sides than an offer nobody needs.