Your team uses ChatGPT without agreements

Make short agreements and teach your team to work safely with AI

AI tools such as ChatGPT are easy to use. Many people already use them at work, sometimes without management knowing. But without rules nobody knows which data ends up where.

Do you recognise any of these situations?

• You don't know which AI tools your people use, or with which account.
• Someone pastes a client email or a contract into a chatbot to summarise it.
• Texts from AI go to clients without anyone reading them through.
• There is nowhere to report a mistake or a doubt.

Which rules apply to ChatGPT at work?

There is no separate law for ChatGPT. But the privacy rules of the GDPR and the EU AI Act do apply. In 2024 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) warned about data breaches via AI chatbots. Employees had entered personal data of clients or patients into them. The AP recommends clear agreements: is it allowed, and if so, with which data?

The account matters too. With personal ChatGPT accounts, free or paid, OpenAI may use conversations to train its models, unless you turn that off. With the business versions this does not happen by default. You can read more about this in Is ChatGPT safe for businesses?

In addition, Article 4 of the EU AI Act requires businesses that use AI to take measures for the AI literacy of their people. Since July 2026 not every employee has to reach a fixed level. Taking measures remains mandatory.

Which agreements do you make with your team?

1. Make a list. Which AI tools does your team use, for what and with which account? Such a list is also called an AI register.
2. Make short agreements. Which tools are allowed, which data does not go into them, and who reads an AI text before it goes out? That is your AI policy. One page is often enough, as in this example of an AI policy.
3. Explain. Show what AI does well, where it goes wrong and how to check an answer.
4. Review it again later. Tools and work change. Adjust the agreements accordingly.

How I help you with this

In AI policy & training I spend half a day with your team drawing up the rules for AI use and an overview of your AI tools. Would your team then like to practise on its own work? The team training lasts one day, for up to 12 people. I come to your business, anywhere in the Netherlands. The first conversation is free. In it we discuss what suits your team and what it costs.

Frequently asked questions

This is an explanation in plain language, not legal advice.

Sources: AP: AI chatbots and data breaches (in Dutch), OpenAI: data controls, OpenAI: enterprise privacy, Regulation (EU) 2026/1744 and European Commission: AI literacy Q&A. Consulted on 7 October 2026.