Employees use ChatGPT and other generative AI at work. What rules should the CHRO set?
Start with the use, and let the depth of governance follow it:
- General-purpose generative AI for everyday documents with no confidential or personal data: an internal usage rule plus training is usually enough.
- AI that affects decisions about customers or employees, processes personal data, or goes into products for the EU market: formal governance and risk assessment are needed.
The usage rule should cover at least five things:
| Item | What to spell out |
|---|---|
| Allowed list | Approved tools and accounts; whether personal accounts and browser extensions are allowed |
| Data input rules | Which tools must never receive confidential information, trade secrets or personal data |
| Output review | Who reviews external documents, code and contracts |
| Exceptions and re-assessment | How new uses are requested, who approves, how often they are re-assessed |
| Training | Who attends, how often, what records are kept |
An outright ban is not recommended: it usually drives use underground and you lose the records.
Should the AI usage rule go into the work rules? Can employees be disciplined for breaking it?
Under Article 70 of Taiwan's Labor Standards Act, an employer with 30 or more workers must set work rules covering matters including "discipline to be observed" and "attendance, leave, rewards and penalties, and promotion", file them with the competent authority for approval and publicly display them; a business with fewer than 30 workers may decide whether to adopt them. The discipline and penalty parts of an AI usage rule can be considered for inclusion in the work rules.
A framework for discipline:
- Work rules that violate mandatory or prohibitive provisions of law are void (Article 71)
- Terminating without notice for "a serious violation of the labor contract or work rules" (Article 12(1)(4)) must be done within 30 days of learning of the facts (Article 12(2))
- Whether a violation is "serious" usually turns on whether the rule was announced in advance, whether the employee was trained, the nature of the data entered and the actual impact
Whether a specific disciplinary action is lawful is for legal counsel to judge case by case.
What does AI literacy under the EU AI Act require after Regulation (EU) 2026/1744? Does a Taiwanese company need to act?
Article 4 as amended:
- Paragraph 1: providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and of other persons operating or using AI systems on their behalf; the obligation does not require them to guarantee any specific level of AI literacy of any individual
- Paragraph 2: the Commission and Member States shall support these efforts, particularly for SMEs; the Commission shall publish practical examples of how to comply
- Paragraph 3: the AI Board shall adopt recommendations, taking into account European competence frameworks
Whether a Taiwanese company must act depends first on whether it falls within the AI Act's scope: if an AI system is not placed on the EU market and its output is not used in the EU, the AI Act usually does not apply; if the company uses AI at an EU establishment, or AI output is used in the EU, it needs to be reviewed. Applicability is for legal counsel to determine case by case.
The recitals also state that AI literacy should be a strategic priority, regardless of regulatory obligations.
How should AI literacy training be designed? Is a certificate needed, and what records should be kept?
The European Commission's AI literacy Q&A explains that no certificate is needed; organisations can keep an internal record of trainings and other guiding initiatives; and the design should take into account staff's technical knowledge, experience, education and training, as well as the context of use and the persons affected.
In practice, tier it by role:
| Audience | Training focus |
|---|---|
| All employees | The company AI rule, which data must not be entered, verifying outputs |
| Units that use AI often | The unit's allowed uses, how outputs are reviewed, how to report problems |
| Managers responsible for human oversight | AI limitations, when to stop using it, how to record judgments |
| Procurement, IT and legal | Where data is stored, whether the vendor may use company data, whether you can exit later |
Training records can be merged into existing training records. When implementing an ISO/IEC 42001 AI management system, the allowed list, exception requests and training for employees' own AI use are also items to keep records of.
HR wants to use AI to screen CVs or evaluate performance. What should the CHRO watch for?
Errors in these uses fall on candidates and employees, so the bar is higher than for everyday documents:
- Do not rely on average accuracy: errors in recruitment AI may concentrate on certain ages or language backgrounds; ISO/IEC 42001 requires an AI system impact assessment by context of use, with separate oversight methods, failure handling and acceptance criteria
- EU AI Act high-risk assessment: Annex III lists uses related to employment and workers' management; whether a use is high-risk and which date applies must be judged on the actual use and the amended rules. Under Regulation (EU) 2026/1744, Annex III obligations apply from 2 December 2027
- Human review: who can override the AI's recommendation, and how it is recorded, must be written down before go-live
Further reading: EU AI Act compliance, Recruitment, medical and factory AI: why one accuracy figure cannot be the acceptance test.
Which roles will AI change? How should the CHRO plan reskilling?
Reskilling should follow the AI use cases, not start with a round of general courses:
- From the AI transformation roadmap, identify the first use cases (for example quality inspection, predictive maintenance, customer service automation, sales forecasting) and list the affected roles
- For each role, map which tasks AI will assist or change and which new judgment and oversight skills are needed
- Decide where capability comes from: buying mature solutions, co-developing with technology vendors, or building in-house capability; building in-house requires talent development, a data foundation and governance processes
- Set KPI baselines before implementation and track workforce and skills metrics alongside them
On the government side, Article 15 of Taiwan's AI Basic Act requires the government to actively close skill gaps caused by AI development and to provide employment counselling to those who lose jobs due to AI use, according to their abilities. That is a government duty; role changes inside a company are still handled under labor law and the facts of each case.
How does Winners Consulting help the CHRO with AI transformation?
Winners Consulting's VP- and director-level consultants lead the work end to end, never outsourced, with a "governance first" approach: while AI is being introduced, we build an ISO 42001 AI management system and EU AI Act compliance mechanisms.
- Use cases and risk assessment: map core business processes, identify use cases such as predictive maintenance, quality inspection, customer service automation and sales forecasting, and assess the risk level of each AI application
- Governance first: before implementation, set AI ethics principles, AI system inventory management, security requirements for AI development and procurement, and an algorithm review process
- Post-deployment monitoring and regulation: build model drift detection and continuous improvement, and assess EU AI Act applicability
- Results and capability building: set KPI baselines before implementation; help decide whether buying, co-developing or building in-house fits best
The service page lists a typical engagement of 7 to 12 months or more. Further reading: AI transformation consulting, How to choose an AI transformation consultant, Evidence responsibility for employees' own AI use.
How other roles see this service
- CEOAI transformation for the CEO: first use case, ROI and accountability
- CROCRO and AI transformation: putting AI risk into the risk map, KRIs and board reports
- CFOAI transformation for CFOs: ROI, penalty exposure, capitalisation
- CTOAI transformation for CTOs: choosing the first use case and governance to build first
Other services for this role
- GDPR and ISO 27701 for the CHRO: employee data, transfers and monitoring
- Trade secrets for the CHRO: what evidence to keep at hiring, non-compete and exit
- ISO 37001 for the CHRO: designing integrity training, whistleblowing and discipline
- The EU AI Act for the CHRO: AI in recruitment, performance and workforce management
- CHRO guide to ISO 27001: screening, NDAs, training, discipline and offboarding
- CHRO guide to ISO 22301: key people, deputies and staffing in a disaster
- CHRO guide to HR systems: employee data, e-attendance and organizational change