EU AI Act Updates Rules for Using Internal Company Data

The EU AI Act requires providers of general-purpose AI models to publish a sufficiently detailed public summary of training content; the summary may cover categories such as private datasets, user data, scraped content, and other sources. As organizations navigate these new requirements, they face a complex web of privacy, labor, and intellectual property regulations that require careful navigation. This guide offers a practical roadmap for legal, privacy, and engineering teams to prepare communication archives for AI training ethically and legally.

How Do AI Training Regulations Differ Between the EU and U.S.?

Under the EU AI Act, companies must publish a high-level inventory of AI training sources, which can include internal data. This requires transparency and compliance with data protection laws. In contrast, the U.S. lacks a single federal AI statute, relying on existing state-level privacy and employment laws.

The EU AI Act entered into force on 1 August 2024 and became applicable on 2 August 2025. Providers of general-purpose AI models must publish a public summary of the content used for training, including data sources. If internal communications are used, they must be disclosed (European Commission guidance). In the U.S., agencies like the EEOC and FTC have clarified that existing civil-rights and consumer-protection laws apply to workplace AI systems, requiring employers to navigate a patchwork of statutes.

What Constitutes Proper Employee Consent and Notice?

Privacy regulators emphasize clear, layered notice and consent. For example, Australia's OAIC recommends seeking consent with a meaningful opt-out. In the U.S., some state laws mandate notice "before or at the time of collection." Because consent under GDPR must be freely given, its validity can be challenged in an employment context. The safest model combines default exclusion from training, layered transparency, and explicit opt-in where possible.

A defensible employee notice should disclose:
- The categories of data (e.g., Slack, email, video) being ingested.
- The specific purpose (e.g., training, evaluation, safety filtering).
- Who has access, including any third-party vendors.
- Data retention limits and employee deletion rights.
- Clear mechanics for opting in or out and how to withdraw consent.

What Are the Key Risks Beyond Basic Privacy?

Using workplace communications for AI training introduces overlapping risks that extend far beyond conventional data privacy concerns. Communications about working conditions carry higher labor-law sensitivity, and sensitive channels - such as HR, union, legal, or health - should be excluded by default unless explicit approval is documented.

Risk Category	Specific Concern
Copyright	Forwarded third-party content or proprietary materials could trigger infringement claims if used for training.
Labor Law	Scanning communications can detect discussions about working conditions, creating legal risks if the purpose shifts from monitoring to model training.
Confidentiality	Using external AI platforms with broad data retention or human review terms can defeat claims of legal privilege or trade secret protection.
Biometric Privacy	Video and audio data containing faces or voices introduce heightened regulatory risk, requiring specific compliance checks.

What Technical Safeguards Should Engineering Teams Implement?

Technical controls must mirror legal commitments. A defense-in-depth architecture built on principles of least-data and least-privilege is the strongest foundation. While vendors like Slack state that customer data "never leaves Slack-controlled infrastructure and is never used to train LLMs" (Slack Trust Center), exporting that data to an external pipeline changes the risk profile significantly.

Recommended design patterns include:
1. Ingest and Classify: Ingest data into a quarantined, encrypted storage zone. Run automated classification to tag and block high-risk records (PII, PHI, secrets) unless a legal basis is documented.
2. Anonymize and Pseudonymize: Apply pseudonymization when re-linkability is needed for audits, storing mapping tables separately. Use irreversible anonymization or synthetic data where re-identification is unnecessary.
3. Implement Privacy Enhancing Technologies: Use differential privacy for sensitive datasets, tracking the privacy budget for each training run to quantify privacy loss.
4. Maintain Lineage: Keep raw, masked, and training datasets in separate buckets. Log every access and transformation to support transparency reports required by the AI Act.

How Should Organizations Manage Data Retention, Deletion, and Contracts?

Limit the retention of raw data exports to the shortest justifiable business window, after which they should be purged or archived with restricted access. Implement an automated deletion hook so that any records removed due to an employee objection or legal hold are excluded from future retraining cycles.

Finally, continuously review all vendor contracts. Permissive service terms regarding data retention and human review can override internal confidentiality policies and even defeat legal privilege claims. Organizations that build sustainable advantage will be those that implement a governance-first architecture, treating internal data as a regulated asset class.