Dismissal for unauthorized use of ChatGPT: loyalty and business secrets

1. The facts

   According to reports from publications such as Quotidiano Giuridico and Lavoro e Previdenza Oggi, the case originates from a series of disciplinary disputes brought against employees who, to optimize their performance, entered fragments of source code or sensitive financial data into ChatGPT. The current procedural stage sees an initial significant confirmation of the legitimacy of such measures with a ruling of the Court of Rome, Labor Section, which paved the way for classifying the improper use of AI as a serious breach of contract. Companies accuse workers of breaching the cybersecurity perimeter, as entering confidential data into a third-party language model is equivalent to a potentially irreversible external disclosure. In particular, the case of a professional in Rome highlighted how the use of AI for creative tasks, if unregulated, can lead to the termination of the relationship for Objective Justified Reason or, in more serious cases of data leaks, to disciplinary expulsion sanctions.

2. 

   The laws at play

   The legal core of the case lies in the Civil Code and recent provisions on artificial intelligence.

   1. Art. 2104 c.c. (Diligence): requires the worker to observe the diligence required by the nature of the performance; the use of technological tools outside company procedures that expose the company to cyber risks is classified as a violation of this duty.
   2. Art. 2105 c.c. (Duty of loyalty): prohibits the disclosure of news concerning organization and production methods; entering secrets into AI prompts constitutes communication to third parties, namely the software providers.
   3. Art. 2106 c.c. (Disciplinary sanctions): regulates the proportionality between the infraction and the penalty, establishing that dismissal is legitimate when the conduct irreparably damages the fiduciary bond.
   4. Art. 623 c.p.: punishes the revelation of scientific or industrial secrets, providing criminal coverage in case of intent or gross negligence in managing confidential information.
   5. D.Lgs. 179/2026 (AI Decree): introduces data governance obligations that charge the company and its collaborators with specific responsibilities in preventing so-called AI-related cyber incidents.

3. What the case law says

   The case law of the Supreme Court is still in the process of formation, but it has already clarified that the mere harmful potential of the conduct is sufficient to justify disciplinary dismissal, even in the absence of immediate economic damage. According to this emerging orientation, the theft or making available to third parties of confidential corporate data through unprotected IT tools constitutes a breach of the duty of loyalty so serious as to not allow the continuation of the relationship, even temporarily. Trial judges have recently extended this principle to the use of generative AI, emphasizing that the employee is obliged to know how the tools they use function; ignoring that data entered into prompts can be used for model training does not constitute an excusable error, but professional negligence. The case law has also highlighted that the presence of a specific company policy banning unauthorized AI use is relevant solely in relation to the usability of evidence pursuant to Art. 4 of the Workers' Statute, as it defines the scope of use of technological tools.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Policy updates: it is essential to draft specific company regulations explicitly prohibiting the use of prompts containing confidential data on generative AI platforms not licensed by the company.
   2. Continuous training: proof of employee training on AI risks is the best defense for the employer and the best protection for the worker against involuntary errors.
   3. Proportionality assessment: before proceeding with dismissal, the lawyer must analyze whether the violation concerns effectively secret data or information already in the public domain, as only in the former case will the expulsion sanction withstand judicial scrutiny.

References: Art. 2104 c.c.Art. 2105 c.c.Art. 2106 c.c.Art. 623 c.p.D.Lgs. 179/2026Art. 4 L. 300/1970

Editorial oversight: Avv. Federico Papa·ICAMUpdated 29 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction