For months we have been talking about productivity, automation, AI agents that manage emails and make decisions. And that is fine. It is a necessary conversation.
But there is another conversation that almost no one is having. And from the legal sphere, it concerns me more and more:
Most companies I know are integrating AI tools into their processes without yet having asked themselves the basic questions. Not the technical ones. The usual ones: who is responsible if something goes wrong? what happens to confidential information? have we informed the people who need to be informed?
When an AI agent has access to corporate email, it is processing data about clients, employees and suppliers. The GDPR does not distinguish between a person and an automated system processing that information. The responsibility remains with the company. And the contract with the provider — the DPA, the Data Processing Agreement — matters much more than we usually check.
If that system also influences employment decisions, Article 64.4(d) of the Workers’ Statute requires informing employee representatives. This is not a novelty of the AI Act: it has been in force since 2021. Few apply it.
But there is something I find even more urgent, because it is happening right now in almost every organisation: “shadow AI”.
Employees using their personal ChatGPT or Claude account to do their work. Without a policy, without oversight, without anyone having decided it. They paste a contract, a client email, internal data into that chat window. No one has authorised it. No one knows it is happening. And yet the company remains responsible for that data.
They do not do it with bad intentions. They do it because they are efficient and because no one has told them how or how far.
That is a governance problem, not a technology problem.
The minimum any company should have today is not a sophisticated AI system. It is a clear usage policy, an understanding of which tools their people are actually using, and a review of supplier contracts.
AI is transforming how we work. But speed cannot be an excuse for skipping what is already mandatory.