According to the German digital association Bitkom, more than 40% of companies assume that employees use private AI tools at work. Company data is often even copied into private accounts. Dr. Anton Barrein, partner at activelaw in Hannover, Germany, discussed this with Florian Gontek of DER SPIEGEL. In his view, the employment law position is currently paradoxical.
Where the employment law position stands
Employers are often powerless
Without a clear rule, a breach can hardly be proven. In Barrein's assessment, a dismissal over AI use is still extremely difficult to enforce at the moment.
Ignorance protects, but not for much longer
Anyone who sends customer data to a private email address risks dismissal without notice. There is settled case law on this. With AI, by contrast, it is an open question whether employees need to know where their prompt goes. Barrein expects the first decisions soon.
Position makes the difference
A warehouse worker who happens to come across a recipe is to be assessed differently from a developer. For data protection officers and lawyers, things become considerably tighter.
What employers should do now
- Decide which tools are permitted. A traffic light system of green, amber and red has proven useful.
- Decide which data is off limits.
- Introduce a labelling requirement for AI content.
- Involve the works council where there is one.
- Provide training. The AI literacy obligation under Article 4 of the EU AI Act applies in any case.
In Barrein's view, an AI policy is not a bureaucratic exercise. In many cases it is the precondition for being able to sanction breaches at all and to prevent unwanted data outflows proactively.
What employees should do
If in doubt, they should ask first. That way they hand over responsibility and help to shape sustainable processes.
Source
The full interview was published in German by DER SPIEGEL (SPIEGEL+): KI im Arbeitsalltag: Wann heimliche Nutzung den Job kosten kann