ChatGPT and Copilot safely in the workplace: GDPR and AI Act in a workable policy

The two rules everything comes back to

Almost every AI incident in the workplace can be traced back to two mistakes: personal data or trade secrets in a prompt to a tool that is not allowed to do anything with them, and AI output that is adopted unchecked. So the policy does not need to be long. Rule one: what you would not email to an outsider does not go into a prompt to an unapproved tool either. Rule two: AI output is a draft; a human checks it and remains responsible. Everything else is detail.

Work with tool levels instead of a list of bans

The difference between safe and unsafe rarely lies in the tool itself; it lies in the agreements around it. A workable framework has three levels:

• Green: tools provided by the company on business terms, such as Copilot within your own Microsoft tenant or a business ChatGPT account where data is not used for training. Internal information may be used here, within the rules.
• Amber: free public chatbots. Allowed for general questions and texts that contain no internal or personal information at all. No customer names, no order data, no photos of the shop floor.
• Red: tools that process personal data of employees or customers without a data processing agreement, and any use that prepares decisions about people (rosters, appraisals, job applications) without human review. That touches directly on the GDPR and on the prohibited and high-risk categories of the AI Act.

Applied to the shop floor of a distribution centre or factory

Generic office advice falls short here; these are the situations we encounter in practice:

• Planning: optimising trips and staffing with AI is perfectly fine, but as soon as individual drivers are assessed in an identifiable way, stricter requirements apply. Keep the human in the decision and record that.
• Quality and QA: summarising audit reports and HACCP documentation can save a lot of time; do it in a green tool and have the QA officer sign the result, because responsibility does not shift to the model.
• Customer service: complaints and correspondence contain personal data by definition. Green tools only, and anonymise where possible.
• Recruitment and HR: the highest risk of all. AI that is involved in job applications or workforce planning affects employees' rights; put human review and transparency in place before you automate anything here.

A data breach involving AI is simply a data breach

If a customer file accidentally ends up in a public chatbot, treat it as what it is: a possible personal data breach under the GDPR, with the usual assessment and, if necessary, a notification to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) within 72 hours. Write this scenario explicitly into the policy, including who the employee reports it to. A culture in which reporting is safe prevents incidents from going underground, and that is exactly where shadow AI becomes dangerous.

What has applied since 2 August 2026

The AI literacy obligation in Article 4 of the AI Act has applied since 2 February 2025 to organisations that use AI professionally, and so also to those that use nothing more than ChatGPT or Copilot. Since 2 August 2026, the Regulation has been largely applicable. For workplace use, one thing is specifically new: if you use a chatbot or AI phone assistant with customers or job applicants, you have had to disclose since that date that they are communicating with AI (Article 50). The Autoriteit Persoonsgegevens and the RDI (Dutch Authority for Digital Infrastructure) are being given a coordinating supervisory role, but the Uitvoeringswet AI-verordening (the Dutch act implementing the AI Act) is not yet in force at that point; the formal national enforcement regime will follow later. In the meantime, the Article 4 obligation simply applies. There is no mandatory certificate or number of hours; what counts is what you can demonstrate: trained employees, an adopted policy and a record of who was trained in what. That can be put in place in time: the policy from this article plus a training day for the people who work with AI, for example as in-company AI training on your own work processes, is a practical way of implementing the measures Article 4 asks for, and at the same time delivers what really matters: employees who use AI productively and safely instead of on the quiet.