Is monitoring employee AI use legal?

The details differ everywhere. The shape does not.

A DLP product that transmits the raw prompt to a server for inspection is collecting the full content of employee communications, including whatever personal content they typed. A product that detects locally and transmits a redacted event record collects a data type, a count, a confidence score, a masked snippet and a destination.

Both achieve the stated purpose. Only one is the less intrusive means, and “could you have achieved this with less?” is precisely the question a DPIA asks.

When an administrator cannot read an employee’s messages because the system never received them, the proportionality analysis becomes materially easier.

European Union. GDPR applies to employee monitoring as processing of personal data. Expect a lawful basis (usually legitimate interest with a documented balancing test rather than consent), a DPIA for systematic monitoring, transparency obligations, and national employment law on top. Works council consultation is required in several member states and should start before the technical work.

United States. Primarily state by state. A number of states have specific electronic monitoring notice requirements, and the list changes. Sectoral rules may also bear on how the monitoring data itself is handled.

United Kingdom. UK GDPR plus the ICO’s employment practices guidance; similar shape to the EU, without the works council mechanism.

Elsewhere. Canada, Australia and Brazil all have distinct regimes. Do not generalise from the US or EU position.

The legal work is the long pole, not the deployment. Run them in parallel and start the slowest first.

"Generally yes, with conditions" is true and unhelpfully smooth. The conditions differ enough between jurisdictions that a single global rollout plan is usually the thing that stalls.

In Germany, works councils have co-determination rights over technical systems capable of monitoring performance or behaviour, and a tool of this kind falls squarely in scope. That is a negotiation with a defined counterparty, not a notification, and it is routinely the longest pole in the schedule. France requires consultation with the CSE and prior information to staff, and has a regulator with firm views on proportionality. The Netherlands and the Nordics sit closer to Germany than to the United States in practice.

In the United States the floor is lower, with notice and consent rules varying by state and a handful of states requiring explicit notice for electronic monitoring. Lower is not none, and a rollout that satisfies German requirements will generally satisfy everything else, which is the practical argument for designing to the strictest jurisdiction you operate in rather than to an average. None of this is legal advice and all of it should be confirmed with counsel in each country.

The notice is where most of the legal risk is actually managed, and it is usually written last, in a hurry, by somebody who was not in the technical conversation.

A notice that holds up says what is inspected, which for an on-device control is the text in a composer at the moment of sending; at what point inspection happens, which is before transmission rather than continuously; what is recorded, which should be a category, a masked snippet and a destination; what is not recorded, which is the message; who can see the records and for what purpose; how long they are kept; and who to contact to ask about them.

The sentence most often left out is the one about what is not collected, and it is the sentence staff most want. A notice that lists capabilities without limits reads as a warning rather than as an explanation, and it produces exactly the suspicion the notice existed to prevent. The limit here is that no notice makes an disproportionate control proportionate: if the system records more than the purpose requires, saying so clearly does not fix it.