Using ChatGPT at work has become routine. What is often missing is a written rule on what may be entered and what may not. That gap creates exposure on two fronts — the GDPR and the AI Act — and a direct operational risk: trade secrets and confidential data ending up on external servers.
The risks of using ChatGPT or Copilot without rules
- Personal data leaving the company
One employee pastes a CV to summarise it. Another enters customer details to draft an email. The data goes to the provider and, on consumer plans, may be used to train models. Without a lawful basis, information to the people concerned and an assessed transfer, that is a GDPR breach.
- Trade secrets leaking
In 2023 Samsung engineers entered proprietary source code into ChatGPT to debug it; the company then restricted generative AI tools internally. The risk is losing a competitive advantage through an involuntary disclosure.
- Wrong decisions without human review
Staff use AI answers directly — replies to customers, operational decisions — without checking them. The model can produce false information, biased answers or wrong legal or medical advice. The company remains fully responsible.
- Missing transparency
Some uses carry disclosure duties under Article 50 of the AI Act: a customer-facing chatbot, deepfakes, AI-generated text published on matters of public interest.
What the AI Act requires — Articles 4 and 50
A company whose staff use commercial AI tools is a deployer under the AI Act (Regulation (EU) 2024/1689). Two provisions apply directly:
Applicable since 2 February 2025. As reworded by Regulation (EU) 2026/1744 from 27 July 2026, providers and deployers must take measures to support the AI literacy of the staff and others who operate or use AI systems on their behalf. The amended text no longer requires a guaranteed level for each person; it still requires the company to act. In practice: training, internal material, and records of both.
Applicable since 2 August 2026. Providers must ensure that people know when they are interacting with an AI system and that generated content is marked. Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless it has undergone human review and someone holds editorial responsibility. A company that builds its own customer chatbot on top of a model is the provider of that chatbot.
If AI is used for decisions about people — recruitment, scoring, performance assessment — the high-risk rules may apply as well; see high-risk AI classification.
What the GDPR requires when staff enter data
Entering personal data into ChatGPT, Copilot or any other commercial AI tool is processing under the GDPR and needs, at the same time:
- A documented lawful basis — usually legitimate interest, with a written balancing test
- Information to the people concerned (employees, customers, candidates): the privacy notice should mention the use of AI tools
- A data processing agreement with the provider — offered on business plans, not on consumer accounts, where the provider acts on its own terms
- An assessment of the transfer outside the EU: the EU-U.S. Data Privacy Framework where the recipient is certified, otherwise standard contractual clauses
- An entry in the record of processing activities (Article 30)
- A DPIA where the processing is likely to result in a high risk
- A way to honour data subject rights (access, erasure, objection)
The plan matters. On consumer plans, conversations may be used to train models unless the user opts out. Business plans and API access are, under the providers’ current terms, not used for training by default and come with a data processing agreement. Terms change, so the check is part of approving a tool, and is repeated.
If you monitor how staff use AI tools
Logging prompts or reviewing employees’ use of AI tools is monitoring of electronic communications at work. In Romania, when it relies on legitimate interest, Article 5 of Law no. 190/2018 allows it only if all of the following are met:
- the employer’s interest is duly justified and prevails over the employees’ interests and rights
- employees have been informed in advance, completely and explicitly
- the union or, where there is none, the employee representatives were consulted before the monitoring was introduced
- less intrusive means have previously proved ineffective
- the data is kept for a period proportionate to the purpose, no longer than 30 days except where the law provides otherwise or in duly justified cases
A group-wide monitoring setup configured elsewhere rarely meets the consultation and 30-day conditions out of the box. More on the national rules for staff data: employee data in Romania.
What an AI use policy should contain
- 1Approved and prohibited tools
An explicit list — for example, the company’s business account of a given assistant approved, consumer accounts of the same tool prohibited. The decision should follow a risk assessment of each tool: contract terms, use of data for training, where data is stored.
- 2Data that must never be entered
Unless the tool has been approved for it: personal data of customers and employees (CVs, appraisals, contracts), trade secrets, proprietary source code, unpublished financial information, confidential correspondence.
- 3Human review
Any AI output used in a deliverable or a decision is checked by a competent person before use. The policy should state this explicitly.
- 4Transparency towards customers
Where Article 50 applies — a customer-facing chatbot, deepfakes, AI-generated text published on matters of public interest — the policy sets out the wording and placement of the disclosure.
- 5Incident reporting
What an employee does on noticing data entered by mistake, a discriminatory answer or abnormal behaviour of a tool: whom to inform and how quickly. A personal data breach may have to be notified to ANSPDCP within 72 hours.
- 6Responsibilities
Who approves new tools, who monitors use, who updates the policy, who trains staff — typically the DPO or a designated AI lead, with IT and HR.
- 7Training
Initial training and periodic refreshers, with the material and attendance records kept. This is the most direct evidence of the measures Article 4 of the AI Act expects.
Putting the policy into practice
- Formal approval by management, so the policy is a binding internal rule and a breach of it can be acted on
- Communication to all staff through a documented channel, with acknowledgement of receipt
- Initial training when the policy is launched
- Individual acknowledgement by each employee who uses AI tools
- A channel for reporting incidents
- A periodic review, and an update whenever tools or the legal framework change
- Periodic checks that the policy is followed in practice
In Romania, a policy that sets obligations for employees is usually brought in through the internal regulations (regulamentul intern), which the Labour Code requires to be communicated to employees and which take effect for them from that moment.
The minimum rules — a summary
For orientation only; it does not replace a policy adapted to the company:
- DO — use the approved tools for ideas, summaries of public texts, general translation and drafts that will be checked.
- DO NOT — enter personal data (names, email, phone, CNP, address), unpublished financial information, trade secrets, proprietary code, employee appraisals or customer data, unless the tool is approved for that use.
- CHECK — any AI output used in a deliverable or decision is validated by a competent person first.
- REPORT — any incident (data entered by mistake, a discriminatory answer, a serious error) to the DPO or AI lead without delay.
Frequently asked questions
Is using ChatGPT at work against the law?
Not in itself, but without internal rules it very likely leads to breaches. When staff enter personal data, trade secrets or confidential information, that data goes to the provider’s servers — processing that has to meet the GDPR. Separately, Article 4 of the AI Act requires the company to take measures supporting the AI literacy of the staff who use these tools.
What does the AI Act require from a company whose staff use ChatGPT?
As a deployer: measures supporting AI literacy (Article 4), in force since 2 February 2025 and reworded on 27 July 2026; and, since 2 August 2026, the Article 50 transparency duties where they apply — disclosing deepfakes, and AI-generated text published to inform the public on matters of public interest unless it has passed human editorial review. If AI is used for decisions about people, such as recruitment, the high-risk rules may apply.
What does the GDPR require when personal data goes into ChatGPT?
A lawful basis, information to the people concerned, a data processing agreement with the provider (available on business plans, not on consumer ones), an assessment of the transfer outside the EU, an entry in the record of processing activities, and a DPIA where the processing is likely to result in a high risk.
Can we monitor how employees use AI tools?
In Romania, monitoring employees through electronic communications on the basis of legitimate interest is subject to Article 5 of Law no. 190/2018: the interest must be duly justified and prevail, employees must be informed in advance, completely and explicitly, the union or employee representatives must be consulted, less intrusive means must have proved ineffective, and the data must in principle be kept no longer than 30 days.
What should an AI use policy contain?
Approved and prohibited tools; categories of data that must never be entered; human review of AI output before it is used; transparency towards customers where required; an incident reporting procedure; clear responsibilities; and a training programme with records of attendance.