May you read your employees’ AI prompts? GDPR, works councils and policy
Short answer
An employer may only monitor AI use if it is necessary and proportionate, and staff must know beforehand. Routinely reading individual prompts is rarely proportionate. Aggregated insight, with individual access only for a concrete incident, often is. A system able to monitor behaviour or performance needs the works council’s consent or consultation in the Netherlands, Germany and France.
Why organisations want to know
There are good reasons to want to see something of AI use: establishing whether sensitive data ends up in prompts, investigating an incident, or understanding which tasks staff do with AI in order to support them better. At the same time, prompts are personal. They show what someone struggles with, what they do not know and how they think.
So the question is not whether you may have insight, but how much, for what, and with which safeguards.
What the rules say
| Rule | What it means for insight into AI use |
|---|---|
| GDPR: lawful basis, purpose limitation, proportionality | The purpose must be set beforehand, and you choose the least intrusive way to reach it. Routine reading “for control” is rarely proportionate. |
| Transparency | Staff must know beforehand what is recorded, why and who can see it. Covert monitoring is only allowed in exceptional cases. |
| Netherlands: Article 27(1)(l) Works Councils Act | Arrangements for systems suited to monitoring attendance, behaviour or performance need the works council’s consent. |
| Germany: § 87(1) no. 6 BetrVG | Technical systems capable of monitoring behaviour or performance are subject to co-determination by the works council. |
| France: Labour Code L.1222-4 and L.2312-38 | Staff must be informed before any collection device; the CSE must be informed and consulted beforehand on means of monitoring staff activity. |
| EU AI Act | Emotion recognition in the workplace is prohibited. Analysing prompts for someone’s mood or state of mind quickly falls under it. |
Note that this applies even when you do not intend it. An AI service that keeps all prompts per user and makes them searchable for administrators is capable of monitoring behaviour, and therefore already subject to these rules.
A balanced set-up: three levels of insight
- Anonymous, as the default. The organisation sees aggregated patterns: which kinds of questions, which models, how often blocked data occurs. Enough to steer and improve, without tracking individuals.
- Per department, when there is a reason. The same insight per team, for capacity and to see where training is needed. With groups large enough that individuals cannot be identified.
- Per user, only for an incident. Reading individual prompts only on a concrete suspicion, after approval by two administrators and recorded in an audit log. Not for day-to-day control.
Set the chosen level out in policy, have the DPO review it, and put it before the works council. See also Writing an AI policy and A DPIA for generative AI.
How it works in werqly AI Control
In werqly AI Control exactly this choice is a setting: anonymous (the default), per department, or per user with approval from two administrators. Every change of level is itself recorded in the audit log, visible to the DPO and available to show the works council.
Because the models run on a node of your own in your server room, the prompts are nowhere else. No outside AI vendor keeps them under its own terms, and you set the log retention yourself. That gives you the insight you need for security, without a system that quietly tracks staff. See Shadow AI for why an approved environment is the best starting point.
Frequently asked questions
Questions on this topic
May an employer read staff’s ChatGPT conversations?
Only with a clear purpose, if it is necessary and proportionate, and if staff know beforehand. Routine reading is rarely proportionate. With a business account an administrator can often see conversations; set out beforehand whether and when that happens.
Does the works council have a say over AI tools?
If the system is capable of monitoring attendance, behaviour or performance, yes: consent in the Netherlands (Article 27 Works Councils Act), co-determination in Germany (§ 87 BetrVG) and prior consultation of the CSE in France. An AI service that records prompts per user quickly qualifies.
Is a DPIA needed if we log staff AI use?
For large-scale or systematic monitoring of employees, yes: it appears on the national DPIA lists of several supervisory authorities. Even without those lists, logging prompts is processing with risks that belongs in a DPIA.
How long may AI logs be kept?
No longer than needed for the purpose. For security investigations a period of a few months is common; aggregated statistics can be kept longer. Set the period in policy and make sure the environment enforces it technically.
Sources
- Dutch Data Protection Authority — Monitoring employees
- Germany — § 87 Betriebsverfassungsgesetz (co-determination)
- CNIL — Monitoring the activity of employees (French)
- AI Act — Regulation (EU) 2024/1689, Article 5
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.