Using AI in Your Business

Home › AI law › Using AI in your business

Most companies do not develop AI; they use it: chatbots, Copilot in Microsoft 365, translation and transcription services, AI features in CRM or HR software. Legally, you are then a deployer under the AI Act and a controller under the GDPR. We help you set up the roll-out so that it works day to day and stands up to scrutiny.

ChatGPT and Copilot at work: what needs to be clarified

The first question is which version is used. With consumer accounts, inputs may be used for training depending on the settings, and there is usually no data processing agreement. Business and enterprise plans generally exclude training on customer data by contract and offer an agreement under Art. 28 GDPR, sometimes with processing in the EU. Expressly prohibit employees from using private accounts for work.

Copilot for Microsoft 365 can access all content the individual user is authorised to see. Overly broad sharing in SharePoint or Teams suddenly becomes visible. Review your permissions concept before the roll-out.

AI policy for employees

A written AI policy sets out which tools are approved, what data may be entered and how results must be checked. Typical content:

• List of approved services and accounts; no private accounts for business data
• Data classes: what must never be entered, such as trade secrets, health data or client data without approval
• Duty to check results for accuracy before they leave the company
• Labelling of AI content where Art. 50 AI Act or customer contracts require it
• Contact person and reporting route for errors and incidents

Data protection for AI tools

Every processing of personal data needs a legal basis under Art. 6 GDPR and a contract with the provider. If the provider is based in the US, we check certification under the EU-US Data Privacy Framework or the standard contractual clauses. High-risk uses, such as analyses of employees or customers, require a data protection impact assessment (Art. 35 GDPR).

Trade secrets and confidentiality

Under the German Trade Secrets Act (GeschGehG), trade secrets are only protected if you can show reasonable confidentiality measures. Allowing confidential documents to be copied into external services unchecked puts this protection at risk. Professionals bound by secrecy are also subject to section 203 of the German Criminal Code (StGB); service providers may only be involved under the conditions of section 203(3) StGB. Non-disclosure agreements with customers may also rule out the use of external AI.

Copyright in AI output

Purely AI-generated texts and images are generally not protected by copyright because there is no human creation. You may use them, but so may your competitors. Conversely, a result may contain third-party works, and you are liable for publishing it. For marketing, code and product design we recommend a review routine and documentation of the human contribution.

Works council and co-determination

Whether the works council has co-determination rights depends on the set-up. The Hamburg Labour Court denied such a right where employees could only use ChatGPT via their own browser accounts and the employer had no access to usage data (order of 16 January 2024, 24 BVGa 1/24). For company-wide licensed systems such as Copilot that generate log data, section 87(1) no. 6 of the Works Constitution Act (BetrVG) is regularly engaged. Information rights under section 90 BetrVG and the right to call in an expert (section 80(3) BetrVG) also apply. A framework works agreement for AI avoids separate negotiations for every new tool.

Obligations as a deployer under the AI Act

Since February 2025 you must take measures to ensure the AI literacy of your staff (Art. 4). Since August 2026 transparency obligations apply: deepfakes and AI-generated text on matters of public interest without editorial control must be labelled. If you use AI in a high-risk area, for example to select applicants, the deployer obligations of Art. 26 apply from 2 December 2027.

Roll-out checklist

1. Record purposes and tools in use, including shadow IT.
2. Determine the risk class under the AI Act.
3. Review licences and contracts: training on customer data, storage location, data processing, liability.
4. Update data protection documentation, with an impact assessment if needed.
5. Define permissions and data classes.
6. Adopt an AI policy and involve the works council.
7. Train staff and document the training.
8. Review use and incidents after six months.

FAQs

May employees use ChatGPT with a private account for work?

We advise against it. There is then no contract with the provider, no control over the data and no evidence of confidentiality measures.

Do we have to label AI-generated text on our website?

Under Art. 50(4) AI Act only text that informs the public on matters of public interest and has not undergone editorial review. Deepfakes must always be disclosed. Customer contracts or platform rules may go further.

Is employee consent enough instead of a works agreement?

No. In employment, consent is often not freely given, and it does not replace co-determination.

Related topics

• AI Act
• Data protection
• AI literacy under Art. 4 (in German)
• Microsoft 365 and data protection (in German)
• AI in HR (in German)