The director of a housing association has the AI policy ready: Copilot is the preferred route, tenant data do not belong in a free tool, and every employee gets a short explanation. She sends it to the works council for information. The chair calls back the same afternoon with one question: do we actually have to consent to this?
The answer depends on what the policy does, not on the word AI. As long as it says which tools are allowed and which data stay out of a prompt, it is an instruction on conduct: that calls for consultation and explanation. As soon as it regulates how employees' data are processed, or introduces a facility that can observe what people do, the works council has a right of consent.
What does Article 27 of the Works Councils Act say?
The Dutch Works Councils Act (Wet op de ondernemingsraden, WOR) gives the works council, in Article 27, a right of consent over a proposed decision to establish, change or withdraw certain kinds of arrangements. Two of them touch AI directly. Item k: an arrangement on processing and protecting the personal data of the people working in the undertaking. Item l: an arrangement on facilities that are aimed at or suitable for observing or checking the attendance, behaviour or performance of those people.
That phrase, "aimed at or suitable for", is the one that decides most cases. A facility does not have to be designed to track people. If it can, it counts.
Two other hooks are less well known. If the AI policy makes a training programme mandatory, that touches the item on staff training (item f). And separately from consent, Article 25 gives the works council a right to advise on the introduction or change of a major technological facility; an organisation-wide rollout of an AI assistant may qualify.
When does an AI policy fall under it, and when not?
| What the policy or arrangement does | Consent? | Why |
|---|---|---|
| Says which tools are allowed and which account to use | Usually not | Instruction on conduct; consult and explain |
| Says which data never go into a prompt | Usually not | Concerns customer or tenant data, not employee data |
| Makes AI training mandatory for everyone | Possibly | Arrangement on staff training (item f) |
| Measures AI use per person, or can be broken down per person | Yes | Employees' personal data (k) and a facility that observes behaviour (l) |
| Counts AI use per tool without a user id | It depends | Not aimed at people; the question is whether the facility is suitable for it |
| Investigates who did what after an incident | Yes, as its own arrangement | That is oversight of a person, with its own purpose and legal basis |
The table sorts categories; whether a concrete decision falls into one depends on its content, and sometimes on what a collective agreement already regulates. Have a lawyer or the DPO check that before it goes to the works council, not after.
When does a measurement of AI use fall under it?
A measurement that records per person which AI tool was opened when requires consent, and usually a data protection impact assessment too. What an employer may and may not do beyond that is in can my employer monitor whether I use AI.
A count that only records that on some device, today, this domain was opened, with no user id, no path and no content, is not aimed at people. The organisation sees that a tool was opened three hundred times, never by whom. Why that one missing column makes all the difference is in AI monitoring versus employee monitoring.
But "not aimed at" is not the same as "not suitable for". The question the works council is entitled to ask, and that you should answer first: can this facility, through a setting, an export or a support request, still show per person what someone did? If the answer is no, the count sits outside Article 27 on good grounds. If it is yes, or you do not know, in practice it sits inside.
So submit the measurement as an arrangement even if you think it is not required. It costs one meeting, it fixes which settings the organisation promises not to change, and it makes the works council an ally on the question that always comes later: can we not see this per team as well?
How do you bring the works council in?
With the design, not with a promise. A works council told that "privacy is respected" has nothing to consent to.
What belongs in the arrangement you submit:
- The purpose. "Knowing which AI tools are in use and whether use runs through allowed tools" is a purpose. "Addressing an individual" is not, and you write that down too.
- What is recorded. Per event: which fields, whether a user id is attached, whether content is kept, for how long.
- Who sees it. Which roles may open the dashboard and which breakdowns exist.
- Which settings are fixed. If department insights are off, that goes in the arrangement. If someone later wants them on, that is a change to the arrangement and goes back to the works council.
- An evaluation point. After six months, look together at what the figures produced.
The housing association submits its measurement this way. The works council asks three questions: will you see what I type, will you see how often I use it, and can that change later? The answers are in the arrangement: no, only per tool and never per person, and a change of settings comes back to the table. The council consents, with an addition the organisation should have thought of itself: department insights stay off until there has been a new conversation.
BeeSensible is designed so that arrangement can be short. On an AI tool the extension reports only the domain, at most once per day per device, with no user id, no path and no page content. The dashboard has no per-employee breakdown anywhere; department insights are off by default and show a department only from five people and seven days. Those are the sentences a works council wants to see; they hold in the AI Tools module as written here.
This is the dashboard a works council gets to see: counts and outcomes, no names.
