ChatGPT (serving as an example for Large Language Models (LLMs) using generative artificial intelligence (AI)) is supposed to make our daily lives easier. But can it also help us in our working lives? Particularly in companies’ HR departments, AI can change the way we work. Job advertisements, application rejections, job reference letters, or termination related decision-making and much more can be generated automatically. Even legal assessments on which the decision-making is based can be provided by AI.

Despite all these positive aspects, the question arises as to what legal implications and risks the use of ChatGPT entails. Due to the current lack of a legal basis, the following 10 pitfalls should be on your radar to avoid costly mistakes when using AI.

Be aware of liability risks

Even if an employee uses ChatGPT without the employer’s consent, the employer can be held accountable for any legal violations resulting from the use of an AI tool. Ideally, employers exactly know which and to what extent AI tools are used by its employees. To this end, it is advisable to create general company policies that outline how permissible tools are used and transparently explain to employees the dangers of using ChatGPT.

Unwanted disclosure of business secrets

Using ChatGPT bears the risk that employees unknowingly disclose confidential company information and even trade and business secrets, in order to achieve a better output. According to the operators of ChatGPT, the platform uses the disclosed data to further expand its services. Thus, the contributed information, trade and business secrets may be suggested as output to other users and spread uncontrollably. In such an event, an injunctive relief, claims for damages and claims for information against the employee may be considered for the violation of the provisions of the German Trade Secrets Act (“Geschäftsgeheimnisgesetz”). However, there are no direct claims against the provider of ChatGPT itself and the trade and business secrets remain in the system of ChatGPT. Therefore, it is crucial to direct employees to never infiltrate sensitive data in ChatGPT.

Be aware of the nonactuality of the data

The data used by ChatGPT is not always up-todate, which may lead to incorrect work products when using ChatGPT. Double-checking the generated work products is inevitable (even if this may change in the near future and the provided date are the most recent available on the www). Undetected, erroneous data may cause damage to the company or its customers, for which the company may be held liable.

Creation of a binding policy for use/non- use

The establishment of an internal policy is advisable to restrict and/or clearly define the use of ChatGPT for employees. Legally, an employee can use ChatGPT as a work tool even without the employer’s instruction, since the rendered service is not directly transferred to a third party. German law does not provide any requirements in this regard. However, in view of the existing technical issues, an employer may, within the scope of its right to issue instructions (Section 106 of the Trade, Commerce and Industry Regulation Act – “Gewerbeordnung”), exercise reasonable discretion to influence the use of ChatGPT. Thus, the employer can determine whether and for which tasks ChatGPT can be used, for example with regard to the use of ChatGPT for writing texts. A violation of such a policy by an employee may result in a warning, but also, depending on the individual case, in termination. The decisive factor is how serious the violation of the employer’s policy is.

Possible participation rights of the works council

If employers want to offer the use of ChatGPT within the daily work, possible information and consultation rights of an existing works council must be considered. Employers must inform and consult the works council about plans for work procedures and processes, including the use of AI. In individual cases, works councils have genuine co-determination rights when AI is used, such as in determining personnel selection measures for new hires, transfers, redeployments and terminations or if the data allow conclusions to be drawn about the employee’s performance or conduct. Even though the use of ChatGPT as pure work tool currently does not trigger any co-determination rights, the legal situation in this regard should be closely monitored and the individual use is key.

Right to information

To minimize its liability risk in the use of ChatGPT, the employer may demand information about the use of AI from the employees under certain conditions. A right to information arises from the employment relationship if there is a legitimate interest, such as the employer’s interest in how the work performance owed is performed by the employee and whether this results in potential liability. Due to the liability implications, such a legitimate interest can be assumed if the employee performs a large part of his contractually owed work performance through the use of ChatGPT.

Disciplinary measures in case of (mis)use

An employer can, of course, also prohibit the use of ChatGPT for daily work, which employees must comply with. In this case, continuous use of ChatGPT by an employee constitutes a breach of employee duties, entitling employers to take actions under labour law. A written warning and – in the worst case – dismissal may be issued as a consequence of violations. However, the nature and extent of the consequence must be examined separately and carefully in each individual case.

Avoid violations of the General Equal Treatment Act

The use of AI tools in the job application process could lead to a violation of the General Equal Treatment Act (“Allgemeines Gleichbehandlungsgesetz”). ChatGPT’s results are based on mass data sets that cannot be verified by the employer. Thus, the tool is only as good as the data sets provided to it (by humans) and any outcomes determined by ChatGPT may be based on discriminatory principles. In the event of discrimination, the affected applicant may be able to claim immaterial damages and thus also file a lawsuit in order to pursue a legal dispute.

Comply with data protection law

The use of ChatGPT in HR processes should be in compliance with data protection law. While there are currently many open questions regarding the transfer, storage and processing of the data, companies should at least try to reduce the related risks in the individual case for the time being. For example a person concerned has a right not to be a subject to an exclusively automated decision insofar as it has a legal or comparable negative effect. The complete and exclusive use of an AI tool for the creation of job reference letters or for decision-making in the application process constitutes a violation of the General Data Protection Regulation (“Datenschutzgrundverordnung”), especially Section 22 para. 1.

Watch out for the copyright of others

The AI-based text generators are trained and up-dated with large amounts of texts and data that come from various (unknown) sources. It cannot be readily assumed that the data used is not copyrighted, which may lead to the use of an AI-based work product resulting in copyright infringement by the user. This may also lead to possible claims for damages or an injunctive relief by the copyright owner, for which the employer of the employee causing such infringement may be held liable.

Download pdf: 10 pitfalls in German employment and labour law when using ChatGPT