AI at Work in France: Can Your Employer Monitor You?

The answer is nuanced. Yes, your employer may have some visibility over your activity. On a work device or network, they can see what you do. That includes, in theory, your exchanges with an AI. But French law frames this control tightly. The CNIL sets out three cumulative conditions. Monitoring must be proportionate. Employees must be informed beforehand. The CSE (comité social et économique, the works council) must be consulted. Permanent, covert monitoring stays the exception. The employee's fix is simple. Never hand a personal secret to an AI from a work device.

A real power of control, but not an absolute one

The employer holds a power of direction. They can monitor employees' activity. They can frame the use of work IT tools. That power is legitimate. But it is neither absolute nor discretionary. The CNIL states this clearly. The control is exercised under three conditions that stack together. None is enough on its own.

• Proportionality: the monitoring must stay suited to the aim pursued.
• Prior notice: each employee must know the tool before it is put in place.
• CSE consultation: the works council must be informed and consulted beforehand.

Proportionality (article L1121-1)

Article L1121-1 of the Labour Code sets a limit. A monitoring measure must be justified by the nature of the task. It must be proportionate to the aim pursued. The CNIL draws concrete conclusions. Permanent monitoring is deemed disproportionate. A keystroke logger (keylogger) is too. So is continuous screen sharing. You must favour the least intrusive means. You must minimise the data collected. You must limit how long it is kept.

Prior notice (article L1222-4)

Article L1222-4 imposes transparency. No information about an employee can be collected without their knowledge. The tool must be disclosed to them beforehand. So covert monitoring stays the exception. A breach carries heavy consequences. Evidence obtained through an undisclosed tool can be set aside. A dismissal based on such evidence may lose its real and serious cause.

The CSE must be consulted first

The CSE (works council) plays a key role. It must be informed and consulted before any means of monitoring activity is put in place. This duty targets companies of at least 50 employees. It appears in article L2312-38 of the Labour Code. Skipping the consultation is no small thing. It exposes the employer to an obstruction offence (délit d'entrave). It also makes the tool irregular. Note: a CSE is mandatory from 11 employees. But the consultation duty on monitoring means targets the 50-employee threshold.

The GDPR: your prompts are personal data

What you type into an AI matters. On a work device, those prompts are personal data. So the GDPR fully applies. Yet at work, an employee's consent is fragile. The relationship of subordination creates a power imbalance. The CNIL notes that this consent is rarely a valid legal basis. The employer must rely on another basis. Legitimate interest or a legal obligation, for example. For a high-risk tool, a DPIA (data protection impact assessment) may be required.

One point deserves clarifying. The CNIL has never banned ChatGPT in France. Do not confuse it with the Italian authority. The Garante temporarily blocked the tool in March 2023. The CNIL, by contrast, frames AI use through existing principles. Proportionality. Information. Minimisation. Not through a ban.

The fix, for employees and employers alike

For employees, the rule is simple. Never hand a personal secret to an AI from a work device. The best reflex is to anonymise before you paste. You keep your data out of the prompt, whatever the employer can see.

1. 1Spot the sensitive data in your text: names, amounts, keys, addresses.
2. 2Replace them with reversible tokens, in the browser.
3. 3Send only the anonymized text to the AI.
4. 4Restore the real values in the reply, locally.

For employers, compliance comes down to three moves. Be transparent: inform employees beforehand. Consult the CSE in advance. Stay strictly proportionate. And remember one thing. Employees keep their right to privacy, even at the office.

That's what ONYRI Sanitize is for. The engine detects sensitive data — names, amounts, keys, addresses — and replaces it with reversible tokens before sending. Detection and the mapping stay in your browser. Only anonymized text reaches the model. The AI finds only tokens, never your real data. Whatever your employer sees on the network, your secrets never leave the device.