Your employee uses ChatGPT. Who sets the rules?

The news: a national proposal, a local decision

On 16 September 2026, Vanessa Matz presented a proposed AI Strategy 2.0. The announcement describes a basis for developing a national strategy with Belgium’s federated entities, not a new general obligation on businesses. Its ambition to retain control of AI use nevertheless poses a practical question for SMEs and non-profits: who approves tools, for which documents and with which safeguards? [1]

On 29 May, Belgium’s Data Protection Authority highlighted risks in chatbot conversations. Free-text exchanges can include highly personal data; retention must be justified and uses explained. This was an Inspectorate communication, not a sanction decision concerning the fictional scenario above. [2]

A business account is not legal immunity

Where personal data are processed, the GDPR requires, among other things, a lawful basis, a defined purpose, data minimisation and appropriate protection. The controller must be able to demonstrate compliance. Purchasing a business licence does not, by itself, provide that demonstration. A product label cannot establish what actually happens to a particular document. [3]

Examine the organisation’s and provider’s actual roles. If the provider acts as a processor, Article 28 governs that relationship. A data protection impact assessment is required where the intended processing is likely to result in a high risk, not automatically whenever AI corrects a piece of text. [4]

Not all confidential information is personal data. Negotiated prices and business plans also require attention to contractual confidentiality commitments. Conversely, removing a name does not necessarily prevent identification through the remaining details. The assessment concerns the software, but also the content, context and destination of the information.