Part 1 of this series considered a question of evidence: does the employee understand and adopt the grievance made in their name? This second article asks a different question. When AI is used irresponsibly, what may the employer lawfully do about it?
Part 1: “AI-generated grievances: who is really making the allegation?” — Friday 16 October 2026. Part 2: “Shadow AI and workplace grievances: when can employers take disciplinary action?” — Sunday 18 October 2026.
An employee’s right to raise a grievance does not confer unrestricted authority to upload confidential workplace information to an external AI platform. Nor does it necessarily shield independently established misconduct committed while preparing or pursuing that complaint.
Shadow AI can turn a grievance into a security incident
When an employee uses an unapproved AI platform to prepare a grievance, the first question is what information they have entered into that system.
The document may contain confidential emails, internal investigation reports, commercial information, witness statements, payroll details, medical information or personal information concerning colleagues. An employee may upload that material believing they are simply asking a writing tool to help prepare a complaint.
However, depending on the service and its contractual arrangements, information may be processed, stored or accessed outside the employer’s approved systems. The employer may have no visibility over what has been entered, where the information is held, how long it will be retained or whether it may be used for other purposes.
This is commonly described as shadow AI: the use of AI services outside an organisation’s approved systems and controls. The risks are not speculative in principle, although the consequences of any particular upload depend on the tool, its configuration and the information entered.
Employers may, in principle, prohibit the entry of confidential company material and other people’s personal data into unapproved AI systems when grievances or appeals are prepared. Such a rule must be clear, reasonable and enforced consistently. It must not be drafted or applied to obstruct protected disclosures, permitted reporting, legal advice or trade union representation.
An express rule matters. Employers should identify which tools are approved, which categories of information must never be entered into external systems, how potential incidents are to be reported and the possible disciplinary consequences of breach. Where an employee contravenes a lawful and reasonable information- security instruction, the conduct may merit separate investigation.
The Data Protection Commission’s guidance on AI, large language models and data protection expressly identifies the risks associated with personal information entered into third-party AI tools. The problem should therefore be considered from two perspectives.
- First, has the employee breached a confidentiality, acceptable-use or information-security obligation?
- Secondly, has the organisation experienced a personal data breach requiring assessment and potentially notification?
Under Article 33 of the General Data Protection Regulation, a notifiable personal data breach must generally be reported within 72 hours of the controller becoming aware of it, where feasible. Notification is not required where the breach is unlikely to result in a risk to individuals’ rights and freedoms.
Under Article 33 of the General Data Protection Regulation, a notifiable personal data breach must generally be reported within 72 hours of the controller becoming aware of it, where feasible. Notification is not required where the breach is unlikely to result in a risk to individuals’ rights and freedoms.
Not every unauthorised upload is a notifiable personal data breach. But it must be assessed promptly, independently of the merits of the employee’s grievance.
What if the employee’s declaration is inaccurate?
Part 1 proposed a declaration authenticating the employee’s factual account. If reliable evidence later contradicts it, the employer may seek an explanation and assess whether the discrepancy was material and knowing. That does not prove that the underlying grievance was invented.
A suspicion that text ‘looks like AI’, or an automated detection score, is not proof. The employee should be told what is in issue, given the opportunity to respond, and assessed against actual evidence. The possible effect on credibility is distinct from whether there has been disciplinary misconduct.
This approach also guards against retaliation claims. An employer should continue to investigate any separately identifiable discrimination, safety or protected-disclosure concern even while examining a potentially false declaration. Those parallel inquiries should not be allowed to become a means of penalising the employee for having complained.
When does AI misuse become a disciplinary matter?
The answer is not determined by whether AI was used. A genuine grievance, even one drafted with substantial assistance, remains a grievance. Equally, the decision to make a complaint does not place all conduct surrounding it beyond the employer’s ordinary rules.
An employee who knowingly discloses restricted information to a prohibited system, deliberately falsifies material allegations or knowingly makes a material misstatement in an authentication declaration may face disciplinary proceedings. These are different allegations and require their own factual basis and due process. A mistaken legal citation or an inaccurate AI-generated phrase is not necessarily dishonesty.
The potentially disciplinary matter is the independently established conduct, not AI authorship. Section 6(4) (b) of the Unfair Dismissals Act 1977 recognises conduct as a potentially fair reason for dismissal. Whether the actual sanction is reasonable remains a separate question, requiring a proportionate response and fair procedures.
In The Governor and Company of the Bank of Ireland v Reilly [2015] IEHC 241, the High Court considered an employee’s breach of an email policy. The Court did not accept that the breach justified dismissal in the circumstances. The judgment illustrates the danger of assuming that a stated zero-tolerance policy converts every breach into gross misconduct. A clear rule is important; seriousness, consistent enforcement and proportionality remain essential.
An employee who deliberately uploads a confidential investigation report to an expressly prohibited external system presents a materially different case from someone using an AI writing assistant to improve grammar. Likewise, proof of substantive AI assistance may reveal an inaccurate declaration, but it does not establish that the underlying workplace event was invented. Employers need to identify what was false, what the employee knew and what harm or risk the conduct created.
Those distinctions matter. There is also a more serious complication where the underlying grievance concerns discrimination or protected disclosures. Under section 74(2) of the Employment Equality Act 1998, employees are protected against adverse treatment arising in reaction to certain equality-related complaints and other protected acts. Likewise, section 12 of the Protected Disclosures Act 2014 prohibits penalisation for making a protected disclosure.
Section 12(7C) is particularly significant. In relevant WRC penalisation proceedings, the adverse treatment is presumed to have resulted from the protected disclosure unless the employer establishes that it was based on “duly justified grounds”.
The employer must be able to establish that any sanction rests on the separate conduct, not on the employee’s exercise of protected rights. That requires contemporaneous evidence, fair notice of the allegation and, where practicable, decision-makers independent of the grievance investigation.
That separation will be important if the employee later alleges retaliation.
Write the rules before the dispute arises
Many employers have introduced general AI policies addressing productivity, confidentiality and the use of technology in daily work. Far fewer have considered the particular risks associated with AI-generated grievances, disciplinary appeals and internal investigations.
It is our view that grievance and disciplinary procedures should now deal expressly with factual authentication and the handling of sensitive information through AI tools. The object is not to ban writing assistance. It is to require accurate factual accounts, prohibit unauthorised disclosure and distinguish careless drafting from deliberate misconduct.
Suggested wording for an AI-use policy
- Employees may obtain appropriate assistance when preparing grievances, disciplinary responses or appeals. However, employees must not upload or disclose the Company’s confidential information, personal data relating to other individuals, investigation material or other restricted workplace information to an AI system which has not been expressly approved for that purpose.
- Where proportionate, an employee may be asked to adopt the factual allegations submitted in their name and disclose substantive AI drafting assistance. They must be given a reasonable opportunity to clarify or correct their account.
- Employees must not knowingly submit fabricated evidence, knowingly make a materially false factual- authentication declaration or deliberately use repetitive or misleading material to obstruct a fair internal procedure. Disagreement with the merits of a complaint, without more, does not establish misconduct.
- Suspected serious breaches of AI-use, confidentiality or information-security rules may be investigated under the disciplinary procedure. Any sanction will be assessed on the proved conduct, context, and seriousness.
- Nothing in this policy prevents an employee from seeking legal or trade union advice, raising a grievance, making a protected disclosure, exercising statutory rights or participating in legal proceedings.
The final qualification is essential.
In particular, section 23 of the Protected Disclosures Act 2014 renders void contractual provisions which purport to prohibit or restrict protected disclosures or exclude the statutory protections. An AI policy must not become an indirect mechanism for preventing employees from reporting wrongdoing or obtaining independent advice. However, that does not mean employers must tolerate the unrestricted use of their confidential information in unapproved technological systems.
The same standard should bind the employer. HR teams and investigators should not upload witness statements or grievance files to unapproved AI services. Even where approved tools assist with drafting, the investigator remains responsible for findings. Employers cannot demand human accountability from employees while outsourcing their own judgment to a machine.
Record the assistance; assess the evidence
Where substantive AI use is admitted or reasonably established, the nature and extent of that assistance, insofar as ascertainable, should be noted in the grievance file and investigation report. The use of AI does not itself defeat a complaint.
In our view, factual authentication must have meaningful consequences. Where an employee, having been afforded a reasonable opportunity to clarify their position and obtain any necessary assistance, refuses without adequate explanation to stand over material allegations, the employer should be entitled to take that refusal into account when assessing their credibility.
Depending on the circumstances, an investigator may reasonably draw an adverse inference and attach reduced weight to allegations which the employee is unwilling or unable to verify. This is particularly relevant where the allegations are unsupported by other evidence or where concerns have arisen regarding their accuracy or origin.
Such an inference should not be automatic, nor should it prevent the employer from examining genuine discrimination, safety or protected-disclosure concerns. However, an employee cannot reasonably expect every allegation advanced in their name to be treated as credible while declining, without justification, to confirm its factual basis. Authentication should be a substantive safeguard in the grievance process, not an administrative formality.
Furthermore, as discussed in Part 1, generative AI has made it considerably easier for employees to produce extensive submissions, introduce additional allegations and repeatedly reformulate existing complaints. The difficulty for employers is not simply the volume of material received, but the potential for an otherwise manageable grievance to become an open-ended process.
In our view, employers are entitled to exercise reasonable control over that process. Once an employee has been afforded an appropriate opportunity to particularise their complaint, the employer should identify the matters requiring investigation and establish a clearly defined scope. Further submissions should be assessed by reference to whether they introduce genuinely new facts or materially affect the issues under consideration.
There is no general obligation to reopen an investigation whenever an employee submits another version of an existing complaint. Employers may impose reasonable deadlines, require correspondence to be directed through designated channels and decline to revisit matters already addressed, provided that genuine new allegations and protected concerns receive appropriate consideration.
A more difficult question arises where an employee persistently generates repetitive, misleading or irrelevant material which serves no legitimate purpose and obstructs the investigation. In such circumstances, employers should be prepared to consider whether that conduct independently breaches reasonable workplace rules. Any disciplinary response must be supported by evidence of the conduct itself, rather than an assumption that extensive correspondence or AI use necessarily amounts to misconduct.
SPOTLIGHT | The employer’s enforcement checklist
- Review AI and confidentiality policies. Expressly address the use of unapproved AI tools in grievances, disciplinary matters, investigations and protected workplace information.
- Create an AI-related security escalation procedure. Where unauthorised data disclosure is suspected, involve the relevant information-security and data-protection personnel promptly. Assess the potential incident separately from the grievance.
- Investigate any alleged misconduct separately. Put the evidence and the relevant rule to the employee, assess the explanation and ensure any sanction is proportionate.
- Protect statutory rights. Ensure that none of these measures prevents protected disclosures, equality complaints, representation or access to legal remedies. Apply appropriate accommodations and record the independent reasons for any adverse employment decision.
The practical position is not complicated, but it demands discipline. Establish what entered the AI tool. Identify the rule said to have been breached. Preserve the employee’s right to pursue a genuine complaint. And require the same independent judgment from the employer’s investigators as from the employee who brought it.
Alastair Purdy LLP advises employers on grievances, investigations, protected disclosures and the fair enforcement of workplace AI and information-security rules.