May employees put customer data into an AI tool?

Customer data in AI tools is possible, but not just like that

Putting customer data into an AI tool is not prohibited outright, but it is a processing of personal data subject to the same rules as any other system. Before data goes that direction, it is relevant which legal basis exists for it, whether it involves more data than necessary for the purpose, and — often the sharpest point — what the provider of the AI tool does with that input. Many general AI tools use input data either to train or improve their own model, and that is a different purpose than the one for which the client originally provided his data.

The latter immediately affects purpose limitation and data minimisation from the GDPR: data collected for customer contact are not automatically suitable to plug into any AI tool. If the tool processes the data on behalf of the organisation, the provider is a processor, and this requires a data processing agreement that specifies what can and cannot be done with the data, where they are stored, and whether they are used for training purposes. So it is not a simple yes-or-no question about "AI", but a question that differs per tool, per setting and per type of customer data — some AI tools offer business variants in which training on input is explicitly disabled, others do not.

Where this follows from: Article 5 and 6 GDPR

The requirement that a legal basis is necessary for every processing follows from Article 6 of the GDPR, and the principle that data may not be used further than the purpose for which they were collected, and no more than necessary, follows from the principles of purpose limitation and data minimisation in Article 5 of the GDPR. The European Data Protection Board publishes guidelines that specifically address the handling of personal data in AI systems, and these provide further guidance on questions such as training on input data and the role of the provider as a processor.