Introducing an AI tool in your SME: the pre-deployment checklist (staff, policy, GDPR, AI Act)
In France, judges have already put AI on hold
In July 2025, the Créteil court of first instance suspended the use of AI tools (drafting, summarising, transcription) at a press group that had rolled them out without consulting its works council. In May 2026, the Paris Court of Appeal did the same for ChatGPT and a writing assistant at another publisher. The reasoning is simple: these tools are a new technology that changes working conditions, so staff had to be consulted before deployment, not after.
Belgium has its own rules, but the logic is the same. Before any AI Act fines, it is often employment law that applies first.
1. Staff: information and consultation
Companies with at least 50 workers: CBA no. 39
Collective bargaining agreement no. 39 of 1983 requires employers to inform and consult staff representatives when they invest in a new technology with significant collective consequences for employment, work organisation or working conditions. This is the case when it affects at least half of the workers in a job category, and at least 10 of them.
- When? At the latest three months before implementation.
- Who? The works council or, failing that, the trade union delegation.
- What? In writing: the nature of the technology, the economic and technical reasons, the social consequences, the timetable. The consultation then covers employment, work organisation, health and safety, and training.
- And if you don't? The employer may not dismiss for reasons linked to that technology. If it does, it owes compensation of three months' gross pay, on top of the notice.
An AI assistant used by the whole administrative team, or a tool that changes how customer requests are handled, can well meet these conditions.
The committee for prevention and protection at work
Consequences for health and safety (workload, stress, pace set by the tool) fall under the prevention committee, mandatory from 50 workers. Depending on the case, the works council, the prevention committee and the union delegation are not all involved at the same time.
Small businesses
Below 50 workers, CBA no. 39 does not apply. But where there is neither a prevention committee nor a union delegation, the Belgian Well-being at Work Act requires the employer to consult its workers directly on well-being at work. And in practice, a tool imposed without explanation is a tool badly used: an information meeting and time for questions cost little.
2. A usage policy, before go-live
Set the rules before everyone invents their own: authorised tools, forbidden data, human review, a contact person. We detail the seven points of an effective policy in our article on shadow AI (in French). Present it when you inform staff: it is the ideal moment.
3. GDPR: three checks
- The contract with the provider: a data processing agreement (Article 28 GDPR), where the data are hosted and whether your data may be used to train models. Business plans usually cover this; free accounts rarely do.
- Informing workers: if the tool processes data about them (usage logs, evaluations), they must know.
- The data protection impact assessment (DPIA): mandatory when processing is high-risk. The Belgian Data Protection Authority's list includes systematic observation of people's behaviour and the use of new technological solutions. A tool that tracks or evaluates employees' work is often concerned; a writing assistant, generally not. When in doubt, do the assessment: it also documents your choices.
For everyday use of an assistant, see also AI and GDPR: what you can put into it (in French).
4. The AI Act: what already applies, and what is coming
| Obligation | For whom | Since |
|---|---|---|
| AI literacy of staff (Article 4): proportionate training and support | Any company that uses AI | February 2025 |
| Ban on emotion recognition in the workplace (except for medical or safety reasons) | Everyone | February 2025 |
| Transparency: chatbots and realistic generated content must be disclosed | If you use a chatbot or publish such content | August 2026 |
| Inform staff before using a high-risk AI system at work (Article 26(7)) | Employers using such a system | December 2027 |
High-risk uses at work include, in particular, tools that screen applications, help decide on promotion or dismissal, allocate tasks based on behaviour, or monitor and evaluate performance. An assistant that only drafts letters is in principle not one of them, unless it is used to prepare such decisions. For the full timetable, see our article on the AI Act for SMEs (in French).
The checklist
- Describe the tool: what it does, who will use it, what data it processes.
- Check the thresholds: 50 workers or more? Significant collective consequences? If so, inform and consult at least three months ahead.
- Choose a business plan with a data processing agreement.
- Carry out the DPIA if the tool tracks or evaluates staff.
- Write the policy and present it to the team.
- Train: a short session is often enough to meet Article 4 of the AI Act.
- Start with a limited pilot, then adjust before rolling out.
Test yourself
At ExsIT
We help you choose the right tool, configure it securely, write the policy and prepare the staff information file. For the social procedure itself, we work with your social secretariat or adviser.
Rules as of October 2026; always check the version in force.
Sources
Autorité de protection des données. (2019). Décision n° 01/2019 du 16 janvier 2019 relative à la liste des traitements soumis à une analyse d'impact (in French). https://www.autoriteprotectiondonnees.be/publications/decision-n-01-2019-du-16-janvier-2019.pdf
CSC. (n.d.). L'intelligence artificielle sur votre lieu de travail (in French). https://www.lacsc.be/csc-militant/themes/nouvelles-technologies
FPS Employment, Labour and Social Dialogue. (n.d.-a). Participation directe des travailleurs en matière de bien-être (in French). https://emploi.belgique.be/fr/themes/concertation-sociale/organes-et-procedures-de-concertation-dans-lentreprise-ce-cppt-ds-etc-5
FPS Employment, Labour and Social Dialogue. (n.d.-b). Vie privée, signalement et nouvelles technologies (in French). https://emploi.belgique.be/fr/themes/concertation-sociale/organes-et-procedures-de-concertation-dans-lentreprise-ce-cppt-ds-17
Froger-Michon, C. (2025, September 29). L'IA suspendue : le juge exige la consultation du CSE avant tout déploiement (in French). CMS Francis Lefebvre. https://cms.law/fr/fra/legal-updates/l-ia-suspendue-le-juge-exige-la-consultation-du-cse-avant-tout-deploiement
Kohen Avocats. (2026). IA générative et consultation du CSE : cour d'appel de Paris, 21 mai 2026 (in French). https://kohenavocats.com/ia-generative-consultation-cse-cour-appel-paris-21-mai-2026/
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). (2016). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence. (2024). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng