Generative artificial intelligence has quickly become part of everyday workplace life. Employees may use AI chatbots to draft emails, summarize documents, prepare presentations, analyze data, or generate ideas.

However, an employee who copies workplace information into an external AI platform may be providing that information to a third-party system without appreciating how the platform stores, processes, retains, or uses the data.

For Ontario employers, generative AI therefore raises important questions about confidentiality, privacy, workplace policies, employee training, monitoring, and the appropriate response when sensitive information is entered into an unauthorized chatbot.

What Information Could Create a Confidentiality Risk?

The risks associated with workplace chatbot use extend beyond obvious trade secrets. Employees routinely handle information that organizations would not ordinarily want disclosed outside the workplace.

Depending on the business and the employee’s role, confidential information may include:

• Customer or client information
• Employee records and personal information
• Pricing strategies and financial information
• Business plans and forecasts
• Unreleased products or services
• Source code and proprietary processes
• Supplier and vendor information
• Internal investigations
• Draft contracts and settlement discussions
• Legal correspondence
• Passwords, credentials, or security information

Even routine information can become sensitive when combined with other details. Asking a chatbot to rewrite an employee performance review, for example, may disclose the employee’s identity, performance history, and workplace concerns.

Why Entering Information Into a Chatbot Is Different

Employees may think of a chatbot as another workplace software tool. However, externally hosted generative AI platforms can operate differently from internal word processors, email systems, or company databases.

Information entered into a generative AI system may be transmitted to an outside provider. How prompts are retained, processed, reviewed, or used can depend on the platform, account type, contract, privacy settings, and service terms.

Canadian privacy regulators have emphasized that organizations using generative AI should understand their authority for collecting, using, and disclosing personal information through these systems. They have also recommended using anonymized or de-identified information where possible and entering sensitive information into AI prompts only when authorized. The issue may therefore extend beyond whether information is publicly disclosed. Employers may also need to consider access, retention, security, and secondary use.

Employee Confidentiality Obligations Still Apply

Artificial intelligence does not replace confidentiality obligations that already exist in the employment relationship. Employees may have obligations arising from employment agreements, workplace policies, common law duties, fiduciary obligations, or other contractual arrangements. Certain industries may also be subject to additional statutory, regulatory, or professional requirements.

An employee who could not send a confidential customer list, financial report, or investigation file to an outside person may similarly need to consider whether entering that information into an external AI service is permitted. This becomes particularly significant where an employer has expressly prohibited certain platforms or identified information that cannot be uploaded to third-party systems.

Personal Information Adds Another Layer of Risk

Workplace chatbot use may also engage privacy considerations when prompts contain information about identifiable employees, customers, clients, applicants, or other individuals. Examples could include asking AI to summarize accommodation documentation, draft a response to an employee complaint, evaluate résumés, rewrite disciplinary correspondence, or analyze customer files.

Canada’s privacy commissioners have recommended limiting personal information used with generative AI to what is necessary for the identified purpose, while emphasizing safeguards, transparency, appropriate purposes, and anonymization where possible.

Privacy obligations vary depending on the organization, industry, jurisdiction, and type of information involved.

Employers May Need More Than a General Confidentiality Policy

Many organizations already have confidentiality, acceptable-use, cybersecurity, and privacy policies. However, those policies may not clearly tell employees what they can and cannot do with generative AI.

An AI-specific or updated technology policy can address which platforms are approved, whether personal accounts may be used for work, what information cannot be entered into chatbots, and whether identifying details must be removed.

Policies may also distinguish between employer-approved enterprise AI operating under negotiated data-protection terms and publicly available chatbots accessed through personal accounts.

Consider Creating Clear Rules for AI Prompts

Organizations developing workplace AI rules may identify categories of information employees should not enter into unauthorized systems. These could include personal information, customer data, privileged communications, confidential business information, passwords, proprietary code, commercially sensitive information, or documents received under confidentiality agreements.

Employers may also establish processes for permitted AI use, such as using approved platforms, removing identifying information, limiting prompts to necessary information, verifying AI-generated output, and obtaining authorization for particularly sensitive tasks.

The appropriate controls will vary between workplaces depending on their operations and data-security concerns.

Training Employees Can Be as Important as the Policy

A written AI policy may have limited value if employees do not understand the reasons behind it. Generative AI is easy to access through personal smartphones, browsers, and free accounts, often without software installation or IT approval. Training can help employees recognize sensitive information and understand why apparently harmless prompts may create risk.

Practical examples can demonstrate why employees should not upload customer complaints, payroll spreadsheets, unreleased financial results, confidential contracts, or similar documents to an unapproved chatbot.

Training can also address the misconception that removing a person’s name necessarily makes information anonymous. Other details may still identify the individual.

What Happens When an Employee Breaches an AI Policy?

Employers may encounter situations where an employee uses an unauthorized AI tool or inputs information contrary to workplace rules. The employment consequences will depend on the circumstances, including the sensitivity of the information, the employee’s position, applicable contractual obligations, whether a clear policy existed, the employee’s knowledge of it, the extent of the disclosure, any resulting harm, and whether similar conduct occurred previously.

Those circumstances may determine whether corrective action, further training, discipline, or other measures are considered.

AI-related incidents may be approached using established principles that apply when investigating alleged breaches of confidentiality, privacy, cybersecurity, or workplace policy.

AI Monitoring Can Raise Separate Employment Issues

Some employers may use cybersecurity tools, browser controls, network logs, or other technologies to identify employee use of unauthorized AI services. Monitoring AI usage can itself raise workplace considerations.

Under Ontario’s Employment Standards Act, 2000, employers with 25 or more employees in Ontario on January 1 of a given year must have a written electronic monitoring policy before March 1. If employees are electronically monitored, the policy must describe how and in what circumstances monitoring occurs and the purposes for which information obtained through monitoring may be used.

The legislation does not create a general right to avoid electronic monitoring. Instead, the requirements focus on transparency. Employers introducing tools to track AI use may therefore want to consider whether their existing electronic monitoring policies accurately describe current practices.

Building AI Governance Into the Workplace

Generative AI platforms and their workplace uses continue to evolve. As a result, AI governance may require periodic review rather than a one-time policy rollout.

Employers can consider how AI rules interact with confidentiality agreements, privacy and information-security requirements, acceptable-use policies, employment agreements, and electronic monitoring policies. Organizations may also determine who is responsible for approving AI tools and responding to suspected incidents.

The central issue is increasingly not whether employees will encounter generative AI, but how organizations will manage its use when workplace information is involved.

Haynes Law Firm: Top-Tier Toronto Employment Lawyer Advising Ontario Employers on Workplace AI Policies

Founded by Paulette Haynes, Haynes Law Firm advises employers throughout Toronto, the Greater Toronto Area, and Ontario on employment agreements, confidentiality obligations, workplace investigations, employee policies, electronic monitoring requirements, disciplinary matters, and emerging workplace issues involving artificial intelligence.

If your organization is developing a workplace AI policy, reviewing employee chatbot use, responding to a suspected disclosure of confidential information, or updating existing technology and confidentiality policies, contact us online or call (416) 593-2731 for trusted guidance.