Works council and an internal AI assistant: EU rules, staff data and a works agreement

What to settle with the works council before the assistant goes live

Before an internal AI assistant goes live, management and the works council usually settle four things: what the assistant is for and what it will not be used for, what the server records about each employee and who may read it, how long those records are kept, and how staff are trained and informed. EU law sets the frame through the Information and Consultation Directive, the AI Act and the GDPR; whether the works council has to agree, and in what form, is decided by national law and practice, which differ between Member States.

An internal AI assistant is a chat tool that runs on a company's own server and answers staff from a language model and, often, from company documents. This guide is for the managing director, the HR lead and the works council members who prepare that conversation, and for the person in IT who has to answer their technical questions. It gives general information on EU law as of October 2026, not legal advice; your legal counsel and your data protection officer confirm how it applies to your company. The rollout of an assistant to a whole company is covered in our rollout plan for 1,000 employees; here the subject is the agreement with the employee representatives.

The EU rules for introducing AI with employee representatives

Three EU texts meet in this project, and each covers a different part of it.

Directive 2002/14/EC, Articles 2 to 4 and 6, and Regulation (EU) 2016/679, recital 155, on eur-lex.europa.eu; Regulation (EU) 2024/1689, Articles 5, 26 and 113 and Annex III as consolidated at 27 July 2026, on the Commission's AI Act Service Desk; GDPR Article 88 from a reproduction of the Official Journal text; all read 25 October 2026.

Information and consultation. Directive 2002/14/EC sets the general EU framework. "Information" means that the employer passes data to the employees' representatives so that they can acquaint themselves with the subject and examine it; "consultation" is the exchange of views and dialogue between the two sides. Each Member State applies the directive either to undertakings with at least 50 employees or to establishments with at least 20. Among its subjects are "decisions likely to lead to substantial changes in work organisation", and consultation takes place "with a view to reaching an agreement" on decisions within the employer's powers. Whether an assistant used by five people in sales is such a decision, and whether one used by every office worker is, is the question your legal counsel answers. The directive also bars representatives from disclosing information expressly given to them in confidence in the legitimate interest of the undertaking, which matters when the project discloses which models and which documents the company uses.

The AI Act. Article 26(7) is the clause most often cited on this topic. Employers who deploy a high-risk AI system inform workers' representatives and the affected workers before putting it into service or using it at the workplace. The duty attaches to high-risk systems only, and an assistant for drafting, summaries and questions on documents is not listed in Annex III. Annex III, point 4 lists AI systems for recruitment and selection, and those intended to make decisions on promotion or termination, to allocate tasks based on personal traits, or "to monitor and evaluate the performance and behaviour of persons" in work relationships. Under the AI Act as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, the high-risk rules for Annex III uses apply from 2 December 2027. Separately, Article 5(1)(f) has prohibited AI systems that infer the emotions of a natural person at the workplace since 2 February 2025, except where they serve medical or safety reasons. Our EU AI Act guide for companies running LLMs covers the other duties, such as AI literacy and the transparency rules of Article 50.

The link to the works council is practical. The server that runs a harmless writing assistant also holds a record of who asked what, and when. If anyone uses that record to rate employees, the use moves towards Annex III, point 4(b), and the works council will want the agreement to exclude it.

The GDPR. Article 88 lets Member States provide, "by law or by collective agreements", more specific rules for the processing of employees' personal data, and those rules include measures with particular regard to the transparency of processing and "monitoring systems at the work place". Recital 155 names works agreements among those collective agreements. The general duties of the GDPR stay in place: a legal basis, a defined purpose, limited retention, and a data protection impact assessment where the processing is likely to result in a high risk. Article 35(9) asks the controller, where appropriate, to seek "the views of data subjects or their representatives" on the intended processing, which is one more reason to involve the works council early. Our guide to a DPIA for an internal LLM walks through that assessment, and our article on local AI and the GDPR explains what a server of your own changes and what it leaves as it is.

Which prompt logs the server keeps about each employee

Works councils ask concrete questions, such as whether the system stores prompts, whether a manager can read them and whether there are statistics per person. The answers depend on the software and on its defaults, because a setting nobody changes is the one that applies. The table uses Open WebUI, a widely used chat front end for own servers, with the defaults its reference documents for version 0.12.1.

Open WebUI environment variable reference, stated as up to date for v0.12.1, read 25 October 2026; saved chats as described in our guide to a private ChatGPT alternative.

Three points follow. An administrator can read chats unless the setting is turned off, so the agreement names who holds administrator rights and whether chat access stays on. The audit log is a separate record and off by default; at its highest level it stores request and response bodies, so switching it on changes what is kept about each person. Usage statistics are collected whether the Analytics tab is shown or not, so the agreement covers the data and not only the screen.

A gateway between the chat front end and the model server can keep its own log of prompts and answers, as our guide to an LLM gateway with keys, budgets and logging shows, and that log needs the same rules. The useful exercise for the works council is a list of every place where a prompt or an answer can end up: the chat database, the audit log, the gateway log, the backups of all three and any export. Each place gets a purpose, a named reader and a retention period. Our Open WebUI hardening guide covers the security side of the same settings.

Our Private AI/ML service sets up the assistant with a query log and data and permissions management, so these settings are chosen on purpose; send us the questions your works council has raised, and our team replies with the technical answers for your configuration.

Topics for a works agreement on the AI assistant

The list is a checklist of subjects. The wording, and whether a formal agreement is needed at all, are for your legal counsel and the works council.

1. Purpose and scope. Which tasks the assistant supports (drafting, summaries, questions on documents), which departments use it, and which document collections it can reach.
2. Excluded uses. No evaluation of individual performance or behaviour from chats, logs or statistics; no emotion inference; no use for decisions on hiring, promotion or termination unless that use has been assessed separately under the AI Act and agreed.
3. What is recorded. Saved chats, the audit log level, the gateway log and the usage statistics, with the settings named as in the table above.
4. Who may read it. Named administrator roles, a rule for opening individual chats (for example only on a documented security incident and with a second person present), and a log of that access.
5. Retention. A period for saved chats, logs and backups, and whether users may delete their own chats.
6. Statistics. Reports at department level or above, with a minimum number of users per report, agreed with the data protection officer.
7. Training and information. What staff learn before access, which ties in with the AI literacy measures of Article 4 in our guide to AI literacy training, and how the assistant is named as AI in its interface.
8. Changes. Which changes reopen the discussion. An agreement can say that a model update for the same purpose does not, while a new connector to HR data, a higher log level or a new department does.
9. Voluntary use and public tools. Whether staff must use the assistant, and the rule for public chatbots, as in our guide to shadow AI policy and controls.

The agreement rests on an accurate description of the settings. Ask IT, or whoever sets up the server, for a one-page description of each setting before the first meeting, and for an update whenever a setting changes.

Who answers which question in the company

In a company without a large IT team, the works council's questions land on a few people. Management decides the purpose and the excluded uses. The data protection officer, where one is designated, advises on the impact assessment and on retention. IT, or the external partner that runs the server, documents the settings and confirms them after each update. Our article on AI officers and roles in an SME sets out who does what each month, and our guide to an AI server without an IT department covers the case with no IT staff at all.

The server behind the assistant

The works council discusses software settings, but the hardware decides who controls them. On a server in your own building, or in an EU data centre you choose, prompts and logs stay under your rules; with a public chatbot service, the provider's settings and terms decide what is stored. The table shows the two servers most companies start with.

Reference configurations on our AI servers page; staff by the example values of our company-size guide (about 4 requests in flight at the busy hour per 100 employees, gpt-oss-120b); power by our estimate with the cards at 600 W, two AMD EPYC processors and 15 per cent for the rest of the server; a 230 V 16 A feed carries 2.94 kW at 80 per cent.

The entry server has two NVIDIA RTX PRO 6000 Blackwell Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC memory and two NVMe drives. One card runs the assistant's language model, the other runs document search and speech models. The staff figures follow our sizing by company size, which counts the people who send a request at the same moment in the busiest hour; in most firms that is a small share of all staff. Rack servers of this kind are loud and turn their full power into heat, so they belong in a server room, as our guide to GPU server power on 16 A, 32 A and three-phase feeds explains. Our article on AI server electricity per year turns the power into annual kWh.

From proposal to go-live, in order

1. Write down the purpose, the departments and the documents in plain words.
2. Have IT list every place where prompts and answers are stored, with the settings that control it.
3. Check with legal counsel which national rules on information, consultation or agreement apply, and whether any planned use touches Annex III.
4. Start the data protection impact assessment, if one is needed, and ask the works council for its view.
5. Agree the topics above, then configure the server to match and document the settings.
6. Train the first users and run a pilot with one department, as in our guide to what a private AI pilot should measure.
7. Review the settings and the agreement before each new department or connector.

We supply the server and, through our Private AI/ML service, set up the model, the document search and the logging; tell us which departments come first, and we propose the configuration and a pilot.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers with two or four RTX PRO 6000 Server Edition cards to order, assembled and tested before delivery, delivered across the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, deploys the assistant with a query log and data and permissions management, and trains your team to run it.

General information on EU law as of October 2026, not legal advice; national law and practice on employee representatives differ between Member States.

FAQ