Public AI platforms: The Confidentiality and Privacy Risk

AI tools are quickly becoming part of everyday work. They can save time and improve productivity, but a recent Employment Relations Authority decision highlights the risks when employees use AI.

The case involved an IT engineer who had high-level access to their employer’s IT systems. Due to a suppression order by the Authority, neither the employee nor the employer can be named.

Following concerns about the employee’s conduct and management of IT systems, the employer began a disciplinary process. The employee was dismissed for serious misconduct in October 2025 and challenged the dismissal in the Employment Relations Authority.

While that personal grievance is still to be determined, the employee applied for interim reinstatement, seeking to return to their position, or alternatively to the employer’s payroll, until their claim can be heard. The Authority declined the interim reinstatement.

However, another issue, which did not form the basis for the personal grievance, has emerged. The employer became concerned that confidential company information had been entered into a public generative AI (GenAI) platform to prepare the personal grievance. It asked the Authority for a compliance order to prevent further disclosure.

The employee denied uploading confidential information but acknowledged using various “digital tools”. After considering the material before it, the Authority found, on the balance of probabilities, that GenAI had been used and confidential information had been uploaded, copied or pasted into it. That information included various employees’ personal information and technical information relating to the employer. The large volume of material provided to the Authority by the employee also contained numerous “hallucinated” and incorrectly cited legal cases which demonstrated the significant use of AI in preparing the material. The Authority reminded the employee that information produced by AI should be checked before being relied upon.

The Authority found that uploading the confidential information breached the employee’s continuing confidentiality obligations and made a compliance order preventing further disclosure through public generative AI platforms. It did not prohibit AI use altogether. GenAI could still be used where the employer’s protected information was kept separate or sanitised. Importantly, the AI issue was not the reason the employee was originally dismissed.

The real lesson is that while AI technology may be relatively new, many of the risks are not. In this case, the employer already had confidentiality protections and an AI policy. Those existing protections became important when concerns arose about how company information was being used.

For employers, there are five practical steps worth taking now:

1. Set clear rules around AI use. Identify which AI tools employees may use and what they can use them for.

1. Protect sensitive information. Make it clear that confidential, commercially sensitive, customer or employee information must not be entered into public or unapproved generative AI platforms. 

1. Check your employment agreements. Confidentiality clauses should clearly protect important business information, including after employment ends.

1. Require employees to check AI output. AI can produce information that looks convincing but is wrong. Human review remains essential.

1. Deal with problems fairly. If inappropriate AI use is suspected, investigate what happened and follow a fair employment process.  

AI can be a useful business tool, but it still needs an experienced eye over the final product. We can review AI-generated employment documents and advice to make sure they are accurate, appropriate for the situation, and do not create unnecessary employment risk. We can also help you strengthen your employment agreements, policies and workplace guidelines around AI use.

AI can help with the first draft. We can help make sure the final version is fit for purpose.