Can artificial intelligence be used at work: what is allowed for employees and what the employer is responsible for

Here is a simple, yet currently inconvenient question: is it even possible to use artificial intelligence at work?

The Tech author Chingis Oralbaev, a member of the Chamber of Legal Consultants of the Republic of Kazakhstan, explains what employees are allowed to do when working with AI and what responsibilities the employer bears.

Chingis Oralbaev, LL.M., Managing Partner of SOLIS Partners LLP, Member of the Chamber of Legal Consultants of the Republic of Kazakhstan

Can an employee open ChatGPT

Yes. In Kazakhstan, there is no general ban on using AI in the performance of labor duties. A query to ChatGPT, Copilot, or another system is not, in itself, a disciplinary offense. The important thing is: which service the employee chose, what information they provided to it, for what task they used the answer, and whether they violated a specific obligation.

Therefore, the phrase “AI at work is illegal because data goes abroad” is inaccurate. Not every query contains personal or confidential information. A corporate service with a contract, managed settings, and a closed network differs from a free personal account. However, a well-known product name does not automatically make it safe for work documents.

First, let’s distinguish three situations

The first is when an employee uses AI as a tool: asking it to improve text, translate a letter, check code, summarize a table, or briefly summarize a document.

The second is when the employer applies AI to people: screening resumes, evaluating interviews, assigning tasks, calculating performance metrics, or suggesting candidates for promotion or dismissal.

The third is when the system monitors work: analyzing correspondence, calls, location, camera footage, or human behavior. Here, data protection is joined by issues of discrimination, the legality of personnel decisions, and the employee’s right to privacy. A blanket ban on “using neural networks” is insufficient for all three cases.

What Kazakh law already says

The Labor Code does not name specific AI services. However, Article 22 obliges the employee to comply with the labor contract, the employer’s acts, cybersecurity requirements, and not to disclose commercial, official, or other state-protected secrets. Article 23 allows the employer to adopt internal acts and demand their compliance.

If an employee pasted a client database into a public chat, the problem is not AI itself. The violation may be the transfer of protected information to an external service, bypassing access restrictions, or violating a contract with the client.

The Law “On Artificial Intelligence” requires compliance with access rights and security measures. The owner, operator, and user are responsible for the system and its results within the scope of their role. The law also requires maintaining human control and autonomy in decision-making. Therefore, the words “the neural network answered this” do not exempt the employee or employer from responsibility for the sent email, calculation, or decision.

If the company has no policy

Punishing an employee solely for accessing AI is usually not permissible. The employer must establish a specific violation: disclosure of a secret, illegal transfer of personal data, bypassing access restrictions, violation of cybersecurity rules, or sending unverified information with adverse consequences.

Banning specific services or establishing special procedures for their use is best codified in an internal act and brought to the attention of employees. Disciplinary action cannot be based on an instruction with which the person was not familiarized. And even in the case of an obvious violation, disciplinary procedures must be followed: record the offense, request an explanation, establish guilt, and do not miss deadlines.

Personal data: not every query is illegal

A query may contain a contract, resume, medical or financial information, source code, password, official correspondence, and investigation materials. After uploading, the provider gains the technical ability to process them. Where, how long, and for what purposes—depends on the contract, tariff, and settings.

If the query contains personal data, the employer must check the purpose and scope of processing, legal basis, necessity of consent, transfer to third parties, cross-border transfer, security, and data storage requirements in Kazakhstan. Consent is not always required: the law knows other legal bases. However, a general privacy policy does not replace an analysis of a specific operation.

A foreign cloud is not automatically prohibited. However, the primary database of personal data must be stored in Kazakhstan, and subsequent cross-border processing is permissible only if established conditions are met. An employee’s personal account in a public chat rarely gives the employer sufficient control.

The logic is similar for trade secrets. The company must define closed information, restrict access, and account for persons who have received it. If documents are uploaded uncontrollably to external services, it becomes harder to prove that the secrecy regime was actually maintained.

An algorithm should not fire a person

Improving a job description text with AI is one thing. Entrusting a system to rank candidates, evaluate productivity, or select workers for redundancy is another. An algorithm may rely on indicators that appear neutral but are practically linked to age, gender, disability, place of residence, or marital status.

The Labor Code prohibits discrimination. The AI Law requires fairness, equality, transparency, and human control. A person subject to a decision made with the application of AI must receive information about automated processing, its consequences, and the possibility of objection.

A decision on hiring, bonus, promotion, disciplinary action, or dismissal cannot be blindly transferred to an algorithm. A manager’s signature changes little if they automatically approve a recommendation without understanding how it was derived. True control means that a person has the data, competence, time, and right to disagree with the system.

Europe: HR AI is considered high risk

The AI Act of the European Union classifies many systems for hiring, employee management, performance evaluation, and termination of employment relationships as high-risk. For them, risk management, documentation, data control, logging, and human oversight are required. Requirements are introduced in stages, so the application date must be verified for each specific system.

Before deploying a high-risk system in the workplace, an European employer must inform affected employees and their representatives. Emotion recognition at work is prohibited in the EU, except for narrow medical and safety-related cases. A camera at the entrance and a program that assesses loyalty or stress via facial recognition are legally distinct tools.

USA: audit instead of faith in an “objective algorithm”

In the USA, federal regulations and local laws apply. The Equal Employment Opportunity Commission emphasizes: anti-discrimination rules apply even when an algorithm is operated by an external contractor.

In New York, an automated tool falling under Local Law 144 cannot be used for hiring or promotion if an independent bias audit has not been conducted within the last year. Summary results are published, and candidates and employees are notified at least ten working days in advance. Requirements in the USA vary by state and city, but liability cannot be shifted to the software provider.

UK and Asia: fewer bans, more management

In the UK, there is currently no separate comprehensive law on AI at work. Data, equality, and labor relations regulations apply. Government recommendations suggest defining the system’s purpose before purchase, verifying the provider’s claims, assessing discrimination risk and data impact, conducting a pilot, training users, and retaining human review.

Singapore recommends that companies appoint responsible persons, define human involvement, manage data quality, and explain AI usage to those affected. Japan is developing general guidelines for developers, providers, and users; version 1.2 of the AI Guidelines for Business was released in April 2026. This is soft regulation, but it does not negate requirements of labor law, data protection, trade secrets, and non-discrimination.

What employers should do now

First, find out which services people are already using, from which devices, and for what tasks. Then approve a list of tools and for each determine permissible tasks, data categories, storage settings, the internal owner, and access rights.

Data is conveniently divided into three levels. Public materials and anonymized examples can be used in permitted services. Internal documents, code, and contracts—only in a verified corporate solution. Passwords, keys, banking and medical secrets, investigation materials, and highly sensitive information—only in a specially secured network or not uploaded at all.

Verification rules are also needed. It is sufficient to proofread a draft internal letter. A legal opinion, financial calculation, software code, medical recommendation, or personnel decision must be checked by a competent specialist. A specific person is always responsible for the final document.

For personnel decisions, it is necessary to separately describe where the system collects information, where it only recommends, who makes the decision, and how a candidate or employee can report an error and demand human review. Employee monitoring must also have boundaries: a clear purpose, limited data composition, access circle, storage period, and prior notification.

What to include in the internal policy

The document can be short. It is important that the employee finds direct answers in it:

• which AI services are permitted and for what tasks
• which data cannot be uploaded and when approval is needed
• who checks the result and is responsible for the final document
• when it is necessary to inform a client, candidate, or employee about the use of AI
• what to do in case of erroneous data upload or incorrect system response
• what consequences follow for violating the rules.

The policy must be linked to labor contracts, cybersecurity, trade secrets, and personal data documents, and then discussed with employees using real examples. A signature under a ban does not teach one to distinguish between a safe query and the transfer of client information.

A ban is not the only solution

For certain industries and categories of information, a complete ban on external AI services is justified. In other companies, it often simply drives AI usage into personal accounts, where the employer sees nothing and controls nothing.

It is more reasonable to establish clear boundaries. AI can prepare a draft, but should not receive a client database. It can help compare resumes, but should not decide whom to fire. The employer has the right to protect their systems, but not to turn this protection into covert total surveillance.

Before implementing any tool, it is sufficient to start with three questions: what data does the system receive, what decision does it influence, and who is responsible if it makes a mistake.

The material reflects legislation and official regulatory materials as of September 4, 2026, and does not constitute legal advice.