1. Artificial Intelligence in the Workplace: Opportunity or Silent Liability?
Artificial intelligence has not crept quietly into companies — it has already made itself at home. Employees across departments use AI tools daily: to draft texts, summarise documents, analyse data, or communicate with clients. Much of this happens without management's knowledge, without internal policies, and without any legal framework in place. Experts refer to this phenomenon as Shadow AI — and its potential consequences are more serious than they may initially appear.
What Are the Actual Risks When Employees Use AI Without Rules?
The most common risk is information leakage. An employee pastes an internal contract, a business proposal, or client personal data into a publicly available AI tool — and at that moment, those data may leave the organisation in a way the employer has no control over. This creates a threefold legal exposure: a breach of data protection obligations under GDPR, a potential disclosure of trade secrets, and a possible violation of contractual confidentiality obligations towards third parties.
A second, equally significant issue is liability for AI-generated outputs. AI systems make mistakes — they generate inaccurate, biased, or factually incorrect information. If an employee uses such output without verification in a client proposal, a legal document, or an internal report, it is the company — not the AI provider — that bears responsibility for any resulting harm.
Finally, there is a reputational dimension: if it becomes publicly known that a company handles sensitive data in an uncontrolled and careless manner, the damage to client trust, partner relationships, and investor confidence can be lasting and difficult to repair.
How to Set Rules Without Stifling Innovation
A well-designed AI policy is not a straitjacket. It is a map that tells employees where they can operate safely — and gives the company the tools to protect what it has built.
The first step is classifying tools and data. Not all AI tools carry the same risk, and not all company data is equally sensitive. There is a meaningful difference between using a general-purpose AI tool to draft marketing copy and using a tool into which contracts, financial statements, or health records might be fed. An internal AI policy should clearly define these categories and the corresponding rules for each.
It is equally important that the rules read as a practical guide rather than a bureaucratic burden. Employees should be informed which tools are approved, how to use them appropriately, and how their use may be monitored. Transparency is not just good practice — it is a statutory requirement. Czech labour law expressly mandates that an employer inform employees directly and in advance about the scope and manner of any monitoring.
Monitoring AI Use: Where Does the Employer's Right End?
Once internal rules exist on paper, the next critical question arises: how can compliance be verified? This is a legally sensitive area, because monitoring employees always engages their right to privacy — even in the workplace.
The Legal Framework: Labour Code and GDPR
Section 316 of the Czech Labour Code expressly limits an employer's ability to monitor employees. An employer may not, without a serious and specific reason, interfere with an employee's privacy through covert or overt surveillance, interception, or monitoring of electronic communications. Where monitoring does take place, the employer must inform employees of its scope and manner directly and in a demonstrable way — and this obligation is mandatory: it cannot be waived even with the employee's consent.
An employee's interaction with an AI tool — the prompts entered, the documents uploaded, the responses received — constitutes, by its very nature, a form of communication with the outside world. Monitoring these interactions therefore falls within the same legal framework as the monitoring of email or other electronic communications.
Alongside the Labour Code, GDPR applies wherever monitoring involves the processing of personal data. The legal basis in this context is the employer's legitimate interest, subject to the core GDPR principles: purpose limitation, data minimisation, and appropriate security of the information obtained.
Three Criteria for Proportionate Monitoring
The case law of the European Court of Human Rights — in particular the landmark judgments in Bărbulescu v. Romania and López Ribalda and Others v. Spain — establishes three key questions by which the proportionality of employee monitoring is assessed:
- Why is the employer conducting the monitoring? Every form of surveillance must have a specific and legitimate purpose. A general statement that the employer wishes to have oversight is not sufficient. The more intensive the interference with privacy, the more compelling the justification must be.
- What is the scope of the monitoring? In routine operations, it is proportionate to monitor which AI services and tools are accessed from company devices or networks, or whether there is an unusual volume of data leaving the organisation — typically through DLP tools or similar security mechanisms. Only where there is a specific suspicion of a rule violation, a security incident, or unauthorised handling of confidential data may it be appropriate to conduct a more detailed review of a particular employee's communications. The principle of minimum necessary interference applies: blanket monitoring of all employees' communications, on the speculative basis that someone might one day breach the rules, is not permissible.
- Has the employer informed the employee in advance? This requirement is mandatory under the Labour Code and cannot be contracted around. Employees must know not only what the rules are, but also in what circumstances and in what manner the employer may verify compliance.
What to Do When an Employee Violates the Rules
When a breach is identified, the first step is always documentation and damage limitation: recording what occurred, blocking access to the relevant tool, and assessing whether a security incident has arisen or whether obligations under GDPR or cybersecurity law may have been triggered.
Only then does the question of employment law consequences arise — ranging from a written warning to notice of termination or, in the most serious cases, summary dismissal, always calibrated to the gravity of the breach. Crucially, the intensity of the violation is assessed by a court in any subsequent dispute — and the court will consider all the circumstances: the employee's role, their prior conduct, the degree of fault, and the actual consequences of their actions. There is a meaningful legal difference between an employee who, out of convenience, used an unapproved AI tool to draft an internal memo, and one who uploaded a client database to a publicly accessible chatbot in clear breach of established rules.
A New Architecture for Growing Companies: EU Inc. and the 28th Regime
While companies work through their AI governance, a new corporate framework is taking shape at the European level. On 18 March 2026, the European Commission published its proposed regulation establishing EU Inc. — a new, optional pan-European corporate form.
2. Why Is a New Corporate Form Being Introduced?
The rationale is straightforward. Today, there are 27 different legal systems and more than 60 corporate forms operating within the EU. Every cross-border step — onboarding a foreign investor, expanding into a new market, restructuring a holding company — means notaries, translations, divergent registry requirements, and weeks of waiting. This fragmentation is one of the key reasons why Czech and other European startups, when preparing for an investment round, tend to establish their holding structure abroad — most commonly as a Delaware C-Corp. EU Inc. aims to end this practice by offering comparable flexibility directly within the EU legal order.
What Does the Proposal Actually Provide?
The proposal envisages that the entire registration process will take place online in under 48 hours, for a fee of less than €100, without a minimum share capital requirement and without any need to visit a notary. Information about the company will need to be submitted only once, through a central interface connected to national registries — a tax identification number and VAT number will be issued automatically.
The flexibility of share structures is particularly significant: EU Inc. will allow the issuance of different classes of shares carrying distinct voting or economic rights, enabling founders to bring in investors while retaining control of the company. Another major feature is a pan-European ESOP regime — employee stock options will be taxed only upon the sale of shares, not upon exercise. For companies seeking to attract talent through equity, this represents a fundamental shift.
What the Proposal Does Not Address
The proposal explicitly does not touch national employment law, social security rules, or tax systems. EU Inc. companies will be subject to the same national employment law as any Czech limited liability company or joint-stock company. Taxation remains a matter for individual member states. The Commission is working in parallel on the BEFIT initiative — a common framework for corporate income taxation across the EU — but this is entirely separate from EU Inc. and its outcome remains uncertain.
Where Are We in the Legislative Process?
The proposed regulation has been referred to the European Parliament and Council. The Commission is pushing for a political agreement by the end of 2026. If the timeline holds, the registration interface should be available from the date of entry into force. That said, the final shape of the regulation may change significantly during the legislative process — it remains premature to structure a company in anticipation of EU Inc. before the regulation is adopted and the implementation details are clear.
What Does This Mean for Your Business Today?
AI governance and the new corporate framework are distinct topics, but they share the same underlying logic: companies that engage with legal questions proactively and systematically are in a substantially stronger position than those who address them only once a problem has arisen.
On the AI side, the practical implication is this: take stock of which tools employees are actually using, establish an internal AI policy, inform employees transparently, and put proportionate monitoring mechanisms in place. A well-designed AI policy does not impede innovation — it gives employees a clear framework within which they can make full use of AI without inadvertently exposing the company to risk.
On the corporate law side, it is worth tracking the development of EU Inc. and assessing, as the regulation takes shape, whether the new form would be advantageous for your company — particularly if you are considering international expansion, bringing in foreign investors, or introducing a structured equity incentive programme for employees.
