Internal company chatbot: GDPR, works council, cost and accuracy

In short: an internal chatbot answers employees from company documents — collective agreement, IT procedures, expense policy. Three things have to be settled before launch: what it is allowed to read, who is informed (employees, and the works council in French companies with 50+ employees), and how its answers are checked. Even grounded in company documents, an assistant of this kind still gets answers wrong on a regular basis.

Three ways to do it, and their public prices

The comparison is simple arithmetic. A per-seat subscription costs headcount × price every month, whether employees ask two questions or two hundred: 40 employees on a $20 seat come to $800 a month. A custom build costs mostly up front, then per use; it makes sense when access rules are specific (who can see which document) or when the chatbot has to act in your own tools.

What French law requires before launch

• →Informing employees: “no information concerning an employee personally may be collected by a device that has not been brought to their attention beforehand” (French Labor Code, art. L1222-4). A chatbot that keeps each employee’s questions is such a device: say so, and say what is kept.
• →Works council: in companies with at least 50 employees, the CSE is informed and consulted on “the introduction of new technologies” (art. L2312-8).
• →GDPR: legal basis, retention period for conversations, entry in the record of processing activities, a processor contract with the vendor and the hosting location (CNIL).
• →AI literacy: since February 2, 2025, article 4 of the EU AI Act requires companies deploying an AI system to ensure a sufficient level of AI literacy among the people who use it.

What the chatbot must never surface

• →Individual files: payroll, performance reviews, disciplinary records, medical information, another employee’s personal data.
• →Anything the person asking would not be entitled to open themselves: the chatbot’s access should follow the rights of the employee asking, not exceed them.
• →Outdated documents: an old version of the expense policy left in the base produces confident, wrong answers. Removing documents is part of maintenance.

How many wrong answers to expect

Grounding a chatbot in your own documents (retrieval-augmented generation, or RAG) reduces errors without removing them. In the first preregistered evaluation of commercial tools of this kind, Magesh, Surani, Dahl, Suzgun, Manning and Ho found that legal research assistants marketed as “hallucination-free” still hallucinated in 17% to 33% of cases, although less often than a general-purpose chatbot (Journal of Empirical Legal Studies, 2025). Legal questions are harder than a leave policy, but the lesson carries over: plan for verification, not for zero errors.

The help is also uneven. In a preregistered experiment with 758 Boston Consulting Group consultants, Dell’Acqua and co-authors found that with GPT-4, participants completed 12.2% more tasks, 25.1% faster and with better quality on tasks within the AI’s reach, but were 19% less likely to reach a correct answer on a task outside it (Organization Science, 2026). For an HR chatbot the consequence is practical: factual, documented questions (expense procedure, public holidays) are within its reach; individual situations (dismissal, dispute, sick leave) are not and should go to a person.

Start small

• →One team and one source of truth (leave policy or IT onboarding, not both at once).
• →A list of real questions gathered from the shared inbox, answered by the chatbot and reviewed by the HR or IT team before launch.
• →A visible “this answer is wrong” button, and a clear handover to a person.
• →One indicator — the share of questions resolved without escalation — measured for a few weeks before extending to a second team.