ChatGPT in the Company: Employee Rules

ChatGPT can be used safely in a company only when employees have clear written rules: what can and cannot be entered into the chat, which tasks the tool is suitable for and which it is not, and who must verify the result before using it. Without such rules, employees decide for themselves what data to input, and often client lists, contract texts, or personal data end up in ChatGPT - all of which a small company should protect. Practical rules must be so clear that they can be directly transferred into the employee AI guide.

ChatGPT is the most popular generative AI tool in Lithuanian companies - used by marketing, sales, customer service, and administrative employees. The problem is that in most micro-enterprises (1 - 30 employees), no one has officially decided how this tool should be used. This is called shadow AI: employees use tools at their own discretion, without management oversight.

Is it even legal to use ChatGPT at work?

Yes, using ChatGPT at work is legal - neither EU nor Lithuanian law prohibits the use of generative AI for business purposes. However, the company is responsible for what is input and how the results are used. Two legal frameworks must be considered:

• GDPR (General Data Protection Regulation). If you input personal data into ChatGPT (client names, emails, CVs, health, or financial information), you are processing personal data and must have a legal basis and inform the data subjects. More on this in the article AI and Personal Data: GDPR Requirements.
• EU AI Act (Regulation (EU) 2024/1689). Its Article 4 on AI literacy has applied since 2 February 2025. It requires providers and deployers to take measures to support the development of AI literacy among staff and relevant persons, considering their knowledge, experience, training, context, and the people affected. Rules for general-purpose AI models began applying on 2 August 2025, subject to transitional provisions. Most remaining obligations, including transparency under Article 50, applied from 2 August 2026. High-risk AI listed in Annex III must comply from 2 December 2027, while high-risk AI embedded in products regulated under Annex I must comply from 2 August 2028.

In other words: usage is allowed, but order is required. And order starts with written rules. It is also important to understand that responsibility cannot be "transferred" to the tool provider - if an employee inputs a client’s personal data, the employer is liable, not OpenAI. Therefore, for a small company, it is cheaper and simpler to set limits in advance than to explain an incident later.

What ChatGPT rules should be set for employees?

Good ChatGPT rules are short, specific, and understandable to someone who is not a lawyer or IT specialist. Below is a minimal set suitable for a small Lithuanian company.

These rules naturally fit into a broader document - the AI Usage Policy in the Company - which covers all AI tools, not just ChatGPT.

What can and cannot be done with ChatGPT at work?

Many employees find it easier to work with concrete examples rather than abstract formulations. Provide them with a clear list.

Examples of generally lower-risk uses:

• Writing and editing drafts of marketing texts that do not contain non-public information
• Summarising publicly available texts or articles
• Generating ideas, structures, or headline options
• Translating texts that do not contain personal or confidential data
• Explaining concepts or formulas, aiding learning

Examples to restrict under company policy:

• Entering personal data of clients or employees into an unapproved tool into an unapproved tool into an unapproved tool
• Uploading non-public contracts, invoices, or pricing
• Generating legal, medical, or financial documents without expert review
• Making decisions about people (hiring, firing, pricing) based solely on ChatGPT responses
• Publishing AI responses as final facts without verification

This "allowed/not allowed" list is the core of the Employee AI Guide. This is the guide employees open when they doubt whether a particular task should be performed with ChatGPT.

How to protect data that employees enter into ChatGPT?

The most important thing to know is that the free and personal version of ChatGPT, by default, may use entered conversations to train the model. Business versions (ChatGPT Team and Enterprise) do not do this - entered data is not used for training. This is a fundamental difference that every employee must understand.

Practical steps for a small company:

1. Decide on the version. If employees work with sensitive information, it is worth switching to the paid Team version with data protection guarantees.
2. Disable chat history for training. Even in the personal version, settings allow disabling the use of chat history to improve the model.
3. Implement a "no personal data" rule. The simplest and most reliable protection is to never enter anything you would not want to see publicly.
4. Assign responsibility. One person in the company should oversee the list of AI tools and rules.

When employees understand the differences between versions and why personal data should not enter the chat, they are better placed to reduce GDPR risks; lawful processing still requires a case-by-case assessment.

How to implement ChatGPT rules so they work?

Rules that sit on a shelf protect nothing. Three practical measures can help put them into use: written guidance, an optional knowledge check and a tools register.

• Written document. This can be a half-page AI usage policy plus a one-page employee guide. Clarity is more important than length.
• Employee familiarisation. Article 4 of the EU AI Act requires measures to support AI literacy. This means employees must not only receive the rules but also understand them. In practice, this is implemented through short training sessions with knowledge checks and certification, so you can prove that familiarisation took place. These documents and training are not mandatory legal requirements, but they help demonstrate that the company has taken steps to foster AI literacy.
• AI tools register. Record that the company uses ChatGPT, for what purposes, and who is responsible. This is part of the AI Tools Register.

The entire set of documents - the AI usage policy, tool register, compliance record, and employee AI guide - along with AI literacy training, knowledge checks, and certifications, nebedirbam.lt automatically prepares for a fixed €149 + VAT (€299) , tailored specifically to your company. If you first want to try the AI basics training yourself, there are also free AI literacy training. The free path is for one signed-in participant; team training is included in the paid documentation package.

Example of ChatGPT rules you can use tomorrow

Here is a short text you can send to your team as a reference point:

"We can use ChatGPT for work, but we must not enter personal data of clients or employees, non-public contracts, pricing, or other confidential information into unapproved accounts. Approved use must follow the company’s data protection rules. We must always verify ChatGPT responses - it can make mistakes and invent facts. Final content sent to clients or published publicly must be reviewed and approved by a responsible employee. If you are unsure whether a task is suitable for ChatGPT, ask your manager."

This example does not replace a full policy, but it is clear and understandable to everyone. Later, you can expand it into a complete document.

Common mistakes when using ChatGPT in a company

Small Lithuanian companies most often make the following mistakes:

• Assuming "no one uses it here." In practice, employees are already using ChatGPT - just no one has officially noticed. This is shadow AI.
• Completely banning it. A total ban does not eliminate usage - it simply moves it to personal accounts, where there is even less control.
• Forgetting verification. Knowledge checks can help assess whether the training was useful, but neither a test nor a certificate is universally required by Article 4 of the AI Act.
• Not linking to GDPR. ChatGPT rules without data protection rules leave the biggest risk - data - uncovered.

More similar mistakes and how to avoid them can be found in the list of all articles.

Brief summary

ChatGPT is a useful tool in a company, but only with rules. The minimal set: no personal or confidential data in chats, always verify facts, final responsibility lies with a human, use approved versions, and label AI-generated content. Written guidance, staff briefings, optional knowledge checks and a tools register are practical ways to organise these measures. Article 4 requires measures supporting AI literacy; it does not prescribe this particular document and testing package.

The official text of the EU AI Act can be found on the EUR-Lex website (eur-lex.europa.eu), and practical information on the implementation of the AI Act is available on the European Commission’s Digital Strategy page (digital-strategy.ec.europa.eu).

Note: The legal information in this article is based on the official requirements of Article 4 of the EU AI Act (Regulation (EU) 2024/1689), as presented on AI Act Service Desk and the European Commission’s Digital Strategy page.