AI and monitoring of staff performance or behaviour: where the line is

When does an AI platform count as a monitoring device?

As soon as it could record data on behaviour or performance. According to the German Federal Labour Court, objective suitability is enough; the employer does not need to intend it (BAG, 13.12.2016, 1 ABR 7/15). That is why the works council, the staff council or, in church institutions, the employee representation body (Mitarbeitervertretung) has a say when the platform is introduced (§ 87 para. 1 no. 6 BetrVG, the Works Constitution Act; § 80 para. 1 no. 21 BPersVG, the Federal Staff Representation Act; church law). The rights are set out in detail in the guide Codetermination on AI.

An AI platform can typically record:

• Sign-ins: who signs in and when.
• Use: which ID uses which app or connection to a system.
• Content: questions, uploaded documents and answers, if they are stored or logged.
• Consumption: the volume of requests, for example for billing.

Such data has to exist for security and proof. The question is what it may be used for.

Where is the line?

Use	Classification	What applies
Log for security, troubleshooting and proof	permitted with an agreement	define the purpose, limit retention, access only for a specific reason
Consumption for the whole organisation, for example for billing	permitted	not critical without reference to individual persons
Statistics per person: who, how often, for how long, with what result	monitoring of performance or behaviour	only with a legal basis and an agreement with the staff representatives, usually ruled out
Analysis of the content of individual persons’ questions	monitoring of behaviour	limit narrowly, inform staff clearly in advance
AI assesses performance or behaviour, for example for appraisals or promotion	high-risk AI under Annex III no. 4 of the EU AI Act	strict obligations from 2 December 2027, a human makes the decision
Emotion recognition at the workplace	prohibited since 2 February 2025	Art. 5(1)(f) EU AI Act, exceptions only for medical or safety reasons

What does employee data protection say?

Even with the staff representatives’ consent, any processing of employee data needs a legal basis and a fixed purpose (Art. 5 and Art. 6 GDPR). A works agreement or service agreement can itself be the legal basis if it meets the requirements of Art. 88(2) GDPR: suitable and specific measures to safeguard the dignity, legitimate interests and fundamental rights of staff, explicitly including monitoring systems at the workplace (§ 26 para. 4 BDSG, the Federal Data Protection Act).

Since the CJEU judgment of 30 March 2023 (C-34/21) on an identically worded provision in the German state of Hesse, the following applies: a general national permission for employee data only holds if it meets the requirements of Art. 88 GDPR. Most commentators say § 26 para. 1 BDSG does not, so employers usually rely on Art. 6 GDPR. That makes a carefully worded agreement with a clear purpose all the more important.

Which questions should you ask the provider?

Whether an AI platform lends itself to monitoring depends on its technology. These questions help staff representatives and data protection:

1. What is in the log: names or only IDs, content or only actions?
2. Can the content of questions and answers be logged, and do staff see when this is switched on?
3. How long are logs kept, and who sets this?
4. Can log entries be changed or deleted?
5. Which analyses do administrators see in the dashboard and reports, and can they be attributed to individual persons?
6. Which roles exist, and where do they come from?
7. Where are chat histories stored, and who can read them?

The answers belong in the annex to the agreement. A template agreement with an annex for the log settings is presented in our guide to a model service agreement for AI.

What applies in Austria and Switzerland?

In Austria, control measures and technical systems that affect human dignity require the works council’s consent in a works agreement (§ 96 para. 1 no. 3 ArbVG, the Labour Constitution Act). In Switzerland, systems intended to monitor behaviour at the workplace must not be used (Art. 26 ArGV 3).

How does this work with basebox?

With basebox, logging serves security, not performance monitoring. Roles come from your directory service; no new profiles are created. In detail:

• Audit log: It records who did what and when, for example sign-ins, changes to permissions, configuration and connector calls, with IDs instead of names or email addresses. Entries cannot be changed and cannot be deleted individually.
• Dashboard: Your administrator sees usage, including per person, but no questions and no content.
• Content: Questions and answers are left out as long as your administrator does not switch on detailed logging. When it is switched on, everyone sees a notice in the chat that cannot be turned off.
• Retention: The audit log is kept for 6 months, adjustable from 3 to 36 months. System logs are deleted after 7 days unless you set something else.
• Roles: Deliberately few: people and administrators.
• Chat history: It stays in the person’s browser until they delete it.
• No assessment of staff: basebox makes suggestions; people make the decisions.

Because the dashboard shows usage per person, basebox is objectively suitable for recording behaviour. That is enough for codetermination under § 87 para. 1 no. 6 BetrVG, regardless of whether anyone intends to analyse the figures. The service agreement or works agreement can settle:

• who may see the dashboard,
• that per-person figures are not used to monitor performance or behaviour,
• whether and when logging of questions is switched on,
• how the staff representatives are informed.

Not legal advice: This guide reflects the situation as of 11 October 2026. Case law on employee data protection is evolving, and staff representation law and church law differ in detail. Have the agreement and the data protection impact assessment reviewed for your organisation.