Monitoring Employee AI Use Under the Italian Workers' Statute

Monitoring employees' AI use means collecting data on which generative tools are used, in which departments and how intensively, in order to understand whether investments in licenses and training are producing adoption. It is a legitimate organizational goal, but it touches two areas of law: article 4 of the Italian Workers' Statute (Law no. 300 of 20 May 1970) on remote monitoring, and the GDPR (Regulation (EU) 2016/679) on personal data processing. What follows is informational and is not legal advice: the scope must be validated with legal counsel and with employee representatives.

Why measure AI use without monitoring individuals?

A company that buys licenses for generative assistants needs to know whether they are used, otherwise it cannot decide on renewals, training and priorities. In AI adoption the question is about the process and the department: where AI has entered the work, where it has not, and why.

Monitoring the individual answers a different question and creates new ones: who uses it less, who uses it too much, who writes what. Beyond the legal risks, it produces a practical effect familiar to anyone in change management: people start using the tools to be seen, or avoid them, or work around them with personal accounts, and the data gets worse. Delphis's principle is clear: data on people always stays aggregated by role or department.

What does article 4 of the Workers' Statute provide?

Article 4 governs audiovisual systems and other tools that also make it possible to monitor workers' activity remotely. In summary, and without claiming to be exhaustive:

• such tools may be used for organizational and production needs, for workplace safety and for protecting company assets;
• installation ordinarily requires an agreement with the trade union representatives, or an authorization from the competent administrative authority when no agreement is reached;
• the rule treats separately the tools workers use to perform their work, for which specific rules apply;
• information collected can be used for purposes connected with the employment relationship only if the worker is given adequate information on how the tools are used and how checks are carried out, in compliance with data protection rules.

How a generative assistant, or its admin console, qualifies under these categories is not automatic. It depends on what it actually collects, at what level of detail and for what purposes. This is an assessment to make with an employment adviser and legal counsel, before activation.

Which data can you collect, and at what level of detail?

The guiding criterion is purpose: measuring adoption, not monitoring activity. Vendors' admin consoles expose usage data to varying degrees. Not everything that is available is appropriate to collect.

Data normally consistent with the purpose, if aggregated:

• number of active users by department or role in a period;
• average frequency of use by group, not by person;
• distribution of use across different tools, useful for license rationalization;
• licenses assigned and never activated, treated as inventory data;
• results of anonymous or aggregated questionnaires on perceived usefulness.

Data not to collect, or to exclude from the start:

• the content of individual users' prompts, conversations and files;
• named usage histories with times and durations;
• rankings or comparisons between colleagues;
• any indicator used to assess productivity, merit or discipline.

How does the GDPR apply to this monitoring?

Usage data, too, is personal data if it can be tied to an identifiable user. The principles of article 5 of the GDPR must therefore be respected: lawfulness, fairness and transparency, purpose limitation, minimization, storage limitation.

In practice:

1. Legal basis. It must be identified under article 6 and documented. In employment relationships consent is rarely suitable, because of the imbalance between the parties: the choice should be shared with the DPO.
2. Privacy notice. Articles 13 and 14 require informing workers about purposes, categories of data, recipients and retention periods.
3. Minimization and aggregation. If the goal is statistical, named data is not needed beyond the technical collection phase and should be turned into aggregated data as soon as possible.
4. Impact assessment. If the monitoring covers many workers and may affect them, the DPO assesses whether a DPIA is needed under article 35.
5. Vendor role. The tool vendor normally acts as processor under article 28: the contract must be checked. More in the article on GDPR and generative AI at work.

How do you involve trade union representatives?

Involving the unions is not a formality to close out afterward. An open discussion before activation serves three purposes: deciding which data is collected and which is not, agreeing safeguards on use, and building trust, without which adoption itself slows down.

A reasonable path, to be adapted to the company's situation and validated with counsel:

1. Prepare a written description of the project: purpose, data, level of aggregation, who has access, retention.
2. Present it to the representatives (RSU or RSA, as applicable) before starting collection.
3. Check with legal counsel whether article 4 requires an agreement or an authorization for the tools involved.
4. Formalize the commitments, including a ban on disciplinary use and individual evaluation.
5. Schedule a periodic review with the same representatives, in particular when tools or features change.

What should you tell employees?

Transparency is both an obligation and an adoption lever. People need to know what is measured, why, at what level of aggregation, who sees the data and how long it is kept. The communication should also say what is not done: no access to content, no individual analysis, no use in evaluations.

This communication fits with the company AI policy and with training programs, which are also required by article 4 of the EU AI Act (Regulation (EU) 2024/1689) on AI literacy, applicable since 2 February 2025: see AI literacy and training. For the timetable of the other AI Act obligations, check official updates. If AI is used for decisions about workers, the AI Act's risk-level classification should be examined separately.

What should you avoid when monitoring AI use?

• Named dashboards accessible to line managers or HR.
• Using the data for performance evaluation, incentives or disciplinary measures.
• Collecting the content of prompts and conversations, which beyond the legal risks exposes third parties' personal data.
• Vague purposes ("improving efficiency") that are neither declared nor documented.
• No minimum aggregation thresholds: a department of two people effectively identifies individuals.
• Activating before consulting counsel and representatives.
• Indiscriminate collection of everything the console makes available.

Where Delphis fits

Delphis is a vendor-independent platform that connects spend, adoption, impact and regulatory obligations. For adoption, it collects usage data from different tools and presents it aggregated by role and department, without assessments of individuals. The regulatory mapping helps clarify obligations and gaps, but it is not legal advice: the scope of the monitoring remains to be validated with counsel and representatives. See the Adoption and ROI page.

Sources

• GDPR, Regulation (EU) 2016/679
• AI Act, Regulation (EU) 2024/1689