Sample · Part I · Sections 1 – 3 · Why have rules at all

What a set of rules can achieve and what it cannot

A set of usage rules does not change what an AI tool can do. It changes who uses it for what, which information goes into it, and who bears the consequences.

1.1 Three effects

It makes visible what is happening anyway. The German data protection supervisory authorities describe the starting position unusually directly: without clear rules there is a risk that employees will use AI applications “on their own initiative and without control”, and it must be assumed that this is “currently the reality in many companies and public bodies”. Rules that name the tools provided by the company and open up reporting channels bring that use out of the invisible.

It moves decisions to where they belong. Without rules, each member of staff decides case by case whether a customer’s address may go into an external system. With rules, the company decides that — once, in advance, and the same way for everyone. The Austrian Economic Chamber puts the same thought in terms of tool selection: it is for company management alone to decide whether an application is permissible.

It can itself be a protective measure to which legal consequences attach. Under Union law, information is a trade secret only if, among other things, “it has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret”. Protection therefore depends on an act of the holder, not on the value of the information alone.

1.2 Four expectations it does not meet

It creates no freedom from liability. Who is liable follows from the applicable law and not from whether a document exists. The Economic Chamber puts it the other way round: clear rules are a means of reducing the liability risk — not of excluding it.

It does not replace the selection decision. A rule referring to “approved tools” is worthless as long as nobody has decided which those are and by what measure. Section 5 deals with that decision.

It has no effect if nobody knows it. The supervisory authority places two requirements side by side: instructions should be issued and documented. A filed document meets only the second. Section 9 deals with bringing rules into force.

It answers no legal question. Internal rules may restate, summarise or tighten the law in force. They cannot change it — and where a legal question is open, internal wording does not close it.

1.3 What this handbook means by “rules”

What is meant is a written, dated set of provisions, made known to the workforce, stating whether, on what conditions and for what purposes which AI tools may be used at work. Whether they are called an instruction, a directive, a guideline or a works agreement is a question of national law and of company practice; the supervisory authority names the service or operating instruction and the service or works agreement side by side, without preferring either.

Which of those forms carries which binding effect in a given Member State is national employment law and is not dealt with in this handbook (Section 13).