ChatGPT at work: five rules for a safe start
5 min read
Short answer
ChatGPT can be used safely in a company once five things are settled: which data is off limits, which tools with suitable contracts are provided, that results are checked before use, that staff are trained, and that you start with one concrete use case. Bans rarely help, clear rules almost always do.
What does this mean for your company? Book an intro call
In many companies, staff have long been using ChatGPT and similar tools, often without management knowing. Bans rarely help. Clear rules almost always do.
1. Settle which data is off limits
Personal data of customers and staff, trade secrets and confidential contracts do not belong in freely available AI tools. Every processing of personal data needs a legal basis (Art. 6 GDPR). Write the rules down and explain them with examples: what may go in, and what may not?
2. Provide suitable tools
People who get good tools are less likely to use private accounts. Business plans with a data processing agreement (Art. 28 GDPR) or European providers are usually the better choice. Make sure inputs are not used to train the models.
3. Always check the results
AI tools phrase things convincingly but are sometimes wrong. Every answer that leaves the company or influences decisions is checked by a person. This applies in particular to figures, legal statements and quotations.
4. Train your staff
Since February 2025, the EU AI Act requires companies that use AI systems to ensure their staff have sufficient AI literacy (Art. 4 AI Act). A short, practical training is a good start: what can the tools do, where are their limits, and which rules apply in our company?
If your company has a works council, involve it early. If a tool can be used to monitor behaviour or performance, the works council has a say under German law (§ 87(1) no. 6 BetrVG).
5. Start small, then expand
Start with one concrete use case, such as pre-sorting emails or drafting standard texts. Measure the benefit, then expand. Whether a bigger step pays off is covered in Is process automation worth it?
Julius Launhardt helps small and mid-sized companies introduce AI safely and with a plan: rules, tools and training that fit their own business. More on the IT, data and AI security page.
Frequently asked questions
May staff use private ChatGPT accounts for work?
It is not advisable. Private accounts lack suitable contracts, and you have no control over what data is entered. It is better to provide business plans or European alternatives.
What does the EU AI Act require from my company?
Since February 2025, companies that use AI systems must ensure their staff have sufficient AI literacy. Further obligations depend on how you use AI.
Do I need a contract with the AI provider?
As soon as personal data is processed, usually a data processing agreement under Art. 28 GDPR. Business plans from the major providers offer one, free private accounts usually do not.
Does the works council have to agree?
It may. If your company has a works council and the tool can be used to monitor behaviour or performance, a right of co-determination can apply. Involve it early.