The open back door

Essay #008 · 2026 · Reading time 5 min · Field: Law / Co-determination · Market: all

In the companies I know, AI is already in use, usually without anyone ever deciding on it. The typical course of events: at some point in the past two years, an employee opened a browser tab, pasted a piece of text into an input field, and got back an answer that saved her hours. She told no one, not out of secrecy, but because it did not seem worth mentioning. The probability is high that this has happened in your company too.

So the question is no longer whether AI enters your company. It is already there. The question that remains for you: through which door it comes in.

Back door and front door

AI enters a company through one of two doors.

It comes through the back door when employees bring in what is publicly available themselves: a chatbot via a private account, a translation service, an image generator. No one ordered it, no one forbade it. It happens one person at a time, from below, invisibly. You as the managing director hear about it in passing, or not at all.

It comes through the front door when the company takes the use of AI into its own hands: selects a tool, sets up company accounts, defines rules, perhaps connects its own data. That happens visibly and from the top. It is a decision, not an occurrence.

Most of the companies I talk to have only the back door open today. That is not a statistic but my observation; it does match, though, what studies have described for years as “shadow IT”: tools working inside the company without the company knowing it.

What labour law distinguishes

German labour law treats the two doors differently, and exactly the other way round from what you would expect.

The case that shows this did not concern secret use. In early 2024, the Hamburg labour court ruled on an employer who had expressly permitted his employees to use ChatGPT for work: via their private accounts, accompanied by usage rules. The works council demanded co-determination. The court declined: because the accounts were private, the employer had no access to the usage data. Without that access, no means of surveillance — and without a means of surveillance, no co-determination under section 87 of the Works Constitution Act.

The counter-test is in the same ruling: if the employer provides a tool whose usage data he can see (whether bought or built in-house), then it is subject to co-determination. It was a summary proceeding, and a single ruling is not a law. But the line is clear: what matters is not which tool is used, but whether the employer can see and govern its use.

That produces a peculiar imbalance. The back door, meaning ungoverned private accounts, is the legally easier path. The front door, controlled introduction with company accounts and data access, is the more demanding one. Whoever wants to make life easy leaves the back door open.

Why the back door looks more convenient

This yields a calculation that looks clear-cut at first glance.

The front door costs: a selection decision, a budget, a connection to your own systems. Where there is a works council, negotiating a works agreement comes on top. That is work, friction, time.

The back door seemingly costs nothing: no licence, no negotiation, no process. The employees have already got hold of the tools themselves. You merely have to let it keep happening.

Whoever looks at this calculation alone chooses the back door and saves themselves the effort.

What the back door really costs

But the calculation compares the wrong quantities. It weighs effort against effort. The two doors do not differ in effort but in control.

Whoever leaves the back door open decides something else in the same stroke: that they will not know which data flows into which services. On the basis of which machine answers their people are working. Which parts of the value chain meanwhile depend on tools no one has ever vetted. That is the shadow AI from Essay #001 of this archive: there it emerges unnoticed; here it emerges through the quiet decision not to look.

And the supposed burden of the front door turns out, on closer inspection, to be a gain. A works agreement on AI forces commitments that have to be made anyway: What may AI do in the company, what not? Which data may it see? Who bears responsibility when it errs? Those are not labour-law formalities but the ground rules for using AI. Every company that uses AI seriously needs them. The works council merely enforces them where it exists. They are needed everywhere.

Who decides (even without a works council)

Which door stands open is not a question any department answers for you. HR manages contracts, not the question of what the company works with. The legal department says what is subject to co-determination, but not whether you want an AI. And the works council co-determines how the front door is designed. Whether it is opened at all is not its decision.

Many companies, such as the trade business or the small GmbH, have neither a works council nor an HR department. For them everything here applies just the same, only without the legal prompt: no one demands an agreement, no one insists on co-determination. That makes the decision not smaller but larger. There is no external occasion that puts the question on the table. You have to put it to yourself; otherwise the back door stays open, because it always was.

The core is this: whoever does nothing has not abstained. They have chosen the back door. The first step through the front door is small and does not yet cost a budget: find out which AI tools are actually in use in your company today. After that, you decide on tool, rules, and accounts, knowing the situation instead of walking past it.

— Axel Roth