AI Policy in the Company: What It Must Contain for ChatGPT and Co. to Be Used Safely

The question tends to arrive late in projects, sometimes only once the system is already running: are our people actually allowed to use it like this? A clerk has pasted the contact list into a chat window to draft invitation emails. The head of sales has contract drafts pre-reviewed - in a private account, because there simply is no company account. Nobody forbade it, nobody allowed it. That is exactly the state most mid-sized companies operate in this September.

In October 2025 the industry association Bitkom surveyed 604 German companies with at least 20 employees. In 8 percent, the use of private AI tools is widespread; 17 percent report isolated cases; another 17 percent suspect it without knowing for sure. Together that is 42 percent of companies observing or assuming shadow AI. Only 23 percent, meanwhile, have set binding rules - the year before it was 15. The gap between usage and rules is the normal state.

This article answers the questions that actually come up when writing such a policy: which obligations sit behind it, what the Trade Secrets Act requires, which version of a chat service tolerates which data, which sections the policy needs, who may adopt it and which technical access makes the ban unnecessary. It is written from the perspective of someone who sets up these rulebooks with companies, not from a lawyer's; where individual interpretation decides, we say so.

In brief: An AI usage policy is not a statutory document in its own right, but without one, three obligations become hard to meet: AI competence under Article 4 of the AI Act, data protection when third-party services are used, and secrecy under the Trade Secrets Act. Under its § 2 no. 1, information is only a protected trade secret if reasonable confidentiality measures exist; unregulated input into external AI services is the opposite of that. What makes a policy effective is three contents: a positive list of approved systems, a matrix assigning data classes to systems, and a review duty before results are used. A total ban without an alternative counts as proven failure: in the 2025 WalkMe survey, 46 percent of employees said they would keep using unapproved AI despite an explicit ban. The solution is a company account with a data processing agreement and training use excluded.

Is an AI usage policy legally required?

No. No statute demands a document by that name, and anyone selling you an "AI policy obligation" is selling a term that appears in no regulation. Four obligations do, however, converge on the same result, because they can neither be met cleanly nor evidenced without written rules.

The first is AI competence under Article 4 of the AI Act: since February 2025, deployers must take measures for the AI literacy of the staff working with the systems; since the Digital Omnibus that means supporting the development of that competence. Anyone who lets ChatGPT be used professionally is a deployer. The policy defines who may do what - only from that follows who needs which instruction.

The second is data protection. As soon as employees enter personal data into a third-party service, the provider is a processor, and without a contract under Art. 28 GDPR the processing is unlawful. For providers outside the EU the requirements on third-country transfers under Art. 44 et seq. GDPR come on top; the EU-US Data Privacy Framework covers certified US providers but does not replace the contract. Without a decision on which service is approved for which data, each person makes that decision alone, on the private account of their choice.

The third is the Trade Secrets Act, covered in detail below: it protects only those who protect themselves. The fourth concerns only certain deployments: for high-risk systems under the AI Act, employees must be informed from 2 December 2027 before the system is put into service (Art. 26 para. 7), and that includes a rule on who uses the system and how. On top comes commercial pressure: tenders and audits now regularly ask how AI is handled, and a policy is the shortest honest answer.

How large is shadow usage really?

Larger than most boards assume, and it is growing faster than the rulebooks. Four independent surveys draw the same picture:

The most important sentence in this table sits in the last row. A ban does not change behaviour; it changes the visibility of behaviour. KPMG and the University of Melbourne measured the same point in their global Trust in AI study 2025: 57 percent of employees use AI without the employer's knowledge, 63 percent do not label AI output as such.

What that can cost is shown by the best-known case: in 2023, according to media reports, Samsung engineers entered internal source code and meeting notes into ChatGPT. The group then prohibited generative AI on company devices, but by then the code was already with the provider. In mid-sized companies the case looks less spectacular and is therefore more frequent: the quote for a major customer with its terms, three applications with names, an invoice with a VAT identification number. Each of these inputs is, depending on account and settings, a transfer to a provider outside the EU without a contract. The IBM report Cost of a Data Breach 2025 puts the average cost of a breach in organisations with high use of unapproved AI tools at 4.63 million US dollars, around 670,000 US dollars more than without such shadow AI; the figures are calculated across large companies, the mechanism is the same.

What does the Trade Secrets Act require?

That the holder protects the secret itself before the law does. That is the point that surprises most companies.

§ 2 no. 1 GeschGehG defines a trade secret by three criteria: the information is not generally known and therefore of commercial value, it is the subject of reasonable confidentiality measures by its holder, and there is a legitimate interest in keeping it secret. The middle criterion is a precondition, not a recommendation. Anyone who cannot evidence reasonable measures has, in a dispute, no trade secret but merely information they would have liked to keep secret.

§ 4 GeschGehG then prohibits obtaining, using or disclosing a trade secret without authorisation; §§ 6 to 8 give the holder claims for injunction, removal, destruction, surrender and information, § 10 a claim for damages, and § 23 makes intentional violations a criminal offence. All of that only helps once the first hurdle is cleared. For AI use that means: the policy that regulates what may go into which service is not a compliance exercise but the evidence that establishes protection in the first place.

What counts as a reasonable measure depends on the value of the information and the size of the company. For AI use five building blocks have proven themselves:

Which data may go into which system?

The heart of every usable policy is not a list of permitted tools but a matrix: data classes on one side, system tiers on the other. Four classes and four tiers are enough for a mid-sized company.

The reading is simple: one cell fully answers the question "May this information go into this system?" What sits on the website may go anywhere. What carries a name, a price or a contract clause does not belong in a consumer account - full stop. The last row follows its own rules that have nothing to do with data protection in general but with criminal and professional law; the details are in the article on LLM hosting for secrecy-bound professions.

Two additions make the matrix workable. First: "company account" means an account held by the company with a data processing agreement and training use switched off - not the paid tier of the same consumer account that stays tied to the person. Second, the matrix belongs in the policy as an annex, not in the running text. New systems enter the annex without the document having to be renegotiated.

Which ChatGPT version falls into which tier?

The answer is not in the law but in the provider's terms, and it differs considerably by type of access. The following overview applies to ChatGPT according to OpenAI's statements on its Enterprise Privacy, Help Center and Data Processing Addendum pages, checked on 14 September 2026; for other providers the structure is the same, the terms have to be checked afresh before every contract.

With the matrix and the version table, the question "may I enter that?" can be answered without asking in almost all cases. That is the purpose of the exercise: not bans, but decidability at the desk. How the business plans of ChatGPT, Claude and Gemini differ in price and administration is covered in the platform comparison for companies.

What goes in? Nine mandatory sections

A policy meant to carry weight in operations needs nine sections. The core of tools, data classes and review duty has to fit on one page, because a policy nobody reads is not a reasonable confidentiality measure either; the tool list and the matrix belong in the annex.

1. Scope and purpose. Who it covers (employees, freelancers, contractors with access) and what it governs: the use of generative AI for work purposes, regardless of who owns the account.
2. Approved systems as an annex. A positive list rather than a ban list, with version and access: which account, which provider, who grants access. What is listed is allowed, everything else is unevaluated. New systems are reviewed as annex amendments, not improvised at the desk.
3. The data matrix. The table from the previous section, adapted to your own classes. It is the only place where the document becomes concrete.
4. Absolute prohibitions. Professional secrets, unanonymised applicant data and health data go into no external system. Expressly not approved as well: consumer accounts for anything beyond public data, browser extensions with access to page content, and dictation or translation services without a contract.
5. Labelling duties. AI-generated content that leaves the company must be labelled under the conditions of Article 50 of the AI Act - mandatory for deepfakes and synthetic content, and for texts on matters of public interest without editorial review; it does not apply to quotes, emails and internal documents.
6. The review duty. AI results are working hypotheses, not results. Whatever goes to customers, authorities or into code unchecked is personally co-carried by the responsible person. This single line prevents more damage than any tool list.
7. Ownership, reporting channel and violations. A named owner of the policy, a contact person for doubtful cases who answers within five minutes, and a low-threshold point to report when something wrong entered a system - without blame, otherwise nobody reports. For deliberate violations, graded consequences from a reminder to measures under employment law.
8. Training. Who is trained, how often and on what, with documented attendance. This doubles as the Article 4 measure and records it; details on tiered training are in the article on the AI competence duty.
9. Review and amendment. One fixed date per year, one responsible name, and the rule that the annex is updated with every new system.

Who adopts the policy - and when does the works council enter?

The usage rule itself is a management instruction: it governs work conduct - how work is to be done - which management may in principle issue alone. The Hamburg Labour Court made that clear on 16 January 2024 (24 BVGa 1/24): the ChatGPT policy in dispute concerned work conduct and was therefore not subject to co-determination.

It is different for the system through which the rule is enforced. A company account on a chat service whose usage logs the employer can inspect is a technical device within the meaning of § 87 para. 1 no. 6 BetrVG: it can monitor behaviour and performance, and that capability suffices under settled case law. Introducing that access is subject to co-determination, no matter how the usage policy is worded. The cleanest solution is therefore usually a two-layer structure: the policy governs work conduct, a works agreement governs the system and its logs. If logging is built to count transactions rather than people, the agreement stays short. What belongs in it is covered in the article on works councils and AI adoption.

In practice: even where no co-determination right exists, early involvement is the faster route. A policy written against the workforce is read as a surveillance measure and fought accordingly. One written with it gets followed.

Why does the company account replace the ban?

Because a ban does not prevent use but makes it invisible, and because the alternative costs less than a single data breach.

A company account is at first only a contract: business version or programming interface, data processing agreement, training use excluded, data processing in the EU where possible. With that, public and internal data are approved immediately, and the largest part of everyday needs is covered: texts, summaries, translations, research.

For confidential data the technology comes in that makes the difference between a rule and its enforcement: an own integration that sits between employees and provider. It removes personal data before handover or replaces it with placeholders, it enforces the data classes technically rather than by trust, and it logs transactions, not people, so that co-determination stays short. Such an interface is sensibly operated within the EU and filters before anything leaves the company.

For protected data what remains is a system under own control or a provider that signs the obligation under § 203 StGB. That is more expensive, but concerns only the smallest part of the data and the smallest circle of employees.

The result is a rule that can be kept because keeping it is more convenient than circumventing it: the approved tool is reached faster than the private account, it can do more, and it does not ask.

Why do most policies fail?

Five recurring patterns, all traceable to a document without an operation behind it.

Total ban without alternative. Prohibiting AI while providing no approved tool produces shadow usage. The 46 percent from the WalkMe survey are the empirical answer to every policy that only says no.

Template without company reference. A downloaded model policy governs data classes the company does not have and omits the ones it does - professional secrets in a law firm, design data in mechanical engineering.

One rule for all data. Treating everything the same protects nothing. The blanket ban on public texts gets ignored just like the one on contract clauses, and in the end effectively neither applies.

No owner, no date. Vendors change models, processing locations and training terms every quarter. A policy dated 2024 lists systems that no longer exist in 2026 and fails to mention the ones everyone uses.

No answer to the one question. "Which tool for which task?" If an employee cannot answer that in two sentences, the policy is a compliance file, not a working rule.

How does the rule reach operations?

In three weeks, if the works council is involved early. The document is the smaller part.

Week 1: classes and policy. The data classes are gone through with the departments; each department names its typical inputs, and the mapping emerges from real examples rather than definitions. The policy is written and presented to the data protection officer.

Week 2: access and contract. The business version or programming interface is procured, the data processing agreement concluded, training use excluded, EU processing set. Consumer accounts are not merely blocked but made superfluous; the gap is large, since per Bitkom 26 percent of companies provide accounts while 42 percent see shadow usage. If confidential data is to be processed, the integration with filtering begins.

Week 3: training and information. A short training session on real inputs from week 1, with an attendance list. Information of the works council if a company account with logs is introduced; information of the workforce in any case. From then on the policy applies, and from then on it is a reasonable confidentiality measure.

After that, repetition decides: one refresher per year, documented, and a review date in the owner's calendar.

Frequently asked questions

Conclusion

The real finding is the gap: 42 percent of companies see or suspect shadow AI, 23 percent have rules. The Trade Secrets Act protects only those who protect themselves, and the GDPR permits only what is regulated by contract. Neither speaks against ChatGPT in the company, but both speak against the unregulated state in which it runs in most businesses today.

A policy closes that gap not through length but through three short answers: which systems, which data, which review. Add a company account with a contract and documented training. The test of whether it works is one sentence long: can every employee say which data may go into which tool - without looking it up? If yes, the document is a working rule. If no, it is a file.

What the managing director is responsible for in AI adoption overall is set out in the guide Introducing AI in mid-sized companies.

This is not legal advice. Whether specific measures are reasonable within the meaning of the Trade Secrets Act and how confidentiality clauses should be worded is for a lawyer to clarify; providers' contract terms must be checked at the time of contracting.

This article was published on 15 September 2026. On 23 September 2026 the article on ChatGPT and trade secrets from 13 September 2026 was merged into it. On 18 October 2026 we aligned the statements on Article 4 with its wording after the Digital Omnibus.

Sources

• Bitkom Research, press release "Beschäftigte nutzen vermehrt Schatten-KI" (21 October 2025): representative survey of 604 companies with 20+ employees
• Bitkom, study report "Künstliche Intelligenz in Deutschland" (2025)
• Microsoft and LinkedIn, Work Trend Index Annual Report (2024): 78 % BYOAI, 80 % in small and mid-sized companies
• YouGov survey commissioned by SThree (November 2025): 5,391 STEM professionals in six countries
• WalkMe/Software AG, State of Digital Adoption Survey (2025): over 3,500 knowledge workers
• KPMG International and University of Melbourne, "Trust, Attitudes and Use of Artificial Intelligence: A Global Study" (2025)
• Cost of a Data Breach Report 2025 - IBM
• Samsung Bans ChatGPT, Google Bard, Other Generative AI Use by Staff After Leak - Bloomberg
• § 2 GeschGehG - definitions - Gesetze im Internet
• § 4 GeschGehG - prohibited acts - Gesetze im Internet
• § 23 GeschGehG - infringement of trade secrets - Gesetze im Internet
• Art. 28 GDPR - processor - dsgvo-gesetz.de
• Article 4 AI Act: AI literacy - artificialintelligenceact.eu
• Regulation (EU) 2024/1689 (AI Act): Art. 26 para. 7, Art. 50
• Enterprise privacy at OpenAI and Data Processing Addendum - OpenAI
• Hamburg Labour Court, decision of 16 January 2024 - 24 BVGa 1/24; commentary: First ruling on works council rights in the use of artificial intelligence - Bird & Bird