Starting point
The company, around 300 employees, had no rule on AI and no tool for it. The HR team, three people, had helped itself. The recruiting officer had job ads pre-drafted, the colleague in employee relations shortened his replies to staff with it, the head of HR built reference letters from bullet points. Each with a personal account, free or paid out of pocket. IT did not know, the data protection officer did not know, the works council did not know. The chat histories contained names, salaries, sick leave and the reasons for separations.
The moment it tipped was a job ad. It was live, and the third paragraph mentioned a staff canteen and a site the company did not have. The paragraph clearly came from another company's ad, and nobody had read it before the ad went out. A candidate asked about the canteen in the interview. The head of HR called me the same week. Not because she wanted to ban ChatGPT. She wanted the work to be allowed and to run under rules the team knew.
At the first meeting the head of HR, the works council chair and the data protection officer were all at the table. The works council said what I hear in almost every one of these projects: we did not even know it was running, and now we are supposed to sign it off. The data protection officer had two questions before he would discuss anything else: does OpenAI train on our inputs, and where does the data sit. That set the frame of the project before a single routine was built.
Approach
The first week belonged to the stopwatch, this time with a second column. Each of the three people noted for a week which task came how often, how long it took, and whether it already ran through ChatGPT today. The list was clear in the end: job ads, recurring employee questions and reference letters took the largest share of writing time, and all three already ran through personal accounts, with real names. Those became the three routines, and they were also the cases that had to leave the personal accounts first.
In parallel, IT set up the workspace. ChatGPT Enterprise as the company workspace, domain verified, sign-in through the existing SSO, retention period for conversations set, sharing of custom GPTs limited to the workspace. The works council was there from the first build session, not as an inspector but as a co-author. We walked through every routine together: what goes in, what comes out, who checks, where the result lands. The fact that admins can view conversations was the point that took longest, and it ended up verbatim in the agreement as an exclusion of performance monitoring.
The job-ad routine was the first to stand, because it had provided the reason for the project. The manager fills in the requirements profile in a fixed template, HR starts the company's prompt in the workspace and gets a shell that follows the company's own ad template. The review step is non-negotiable: every requirement comes from the profile, no wording open to challenge under the AGG (the German anti-discrimination act), no benefit the company does not offer. Only then does the ad go live.
The skeleton of the prompt from the project. This is the frame of the job-ad prompt the team has worked with since. It already works like this. What turned it into the company's own prompt during the project is listed below, and that is the part that prevents the foreign canteen.
The finished prompt, ready to copy
All six building blocks in one prompt. Replace the bracketed placeholders with your own details.
You are writing, as an HR officer at [company, one sentence of context], a job ad for the position [title], department [department], reporting to [role]. Use only the details from the requirements profile below. Do not invent duties, benefits, locations or numbers. If information is missing, ask me instead of assuming. Tone: factual, direct, formal address, short sentences. Forbidden: [the company's banned-word list] Structure: [structure from the company's job-ad template] Mark every passage where you are unsure or make an assumption with [check]. Manager's requirements profile: [details from the template]
- The company's banned-word listwhich words and phrases may no longer appear in any ad, collected from the company's last twenty ads.
- The tone from three good adswhich three of the company's ads serve as models and what exactly they get right.
- The AGG checklistwhich wording on age, origin, gender and health has caused trouble in the company before.
- The review stephow HR can tell in fifteen minutes whether the draft can go live.
The snag came in week four, with the custom GPT for employee questions. The policies on leave, home office and parental leave were uploaded as files, and the first answers were good. Then someone in the test asked about the severance rule for termination agreements, which was in no policy, and the GPT answered anyway, politely and with general knowledge from the internet. We built two sentences into the instructions: the boundary sentence, that it answers only from the uploaded files, and the referral rule, that every question outside the files goes to employee relations, with a name and contact details. The works council repeated the test itself before adding the routine to the agreement.
In parallel ran the sessions on the works agreement and the review with the data protection officer. That was the slow part, and it should be. The data processing agreement with OpenAI was available early. The transfer to the United States under Art. 44 ff. GDPR was the point the data protection officer wanted to check himself, with the EU-US Data Privacy Framework as the checkpoint and standard contractual clauses as the second line. The routines ran in the workspace with anonymised data during that time. At the end of month three the agreement was signed, personal accounts were retired on the set date, and the team ran the three routines alone for a week while I stayed in the background.
Outcome
A job ad now runs like this: the manager fills in the requirements profile, HR builds the draft in the workspace and checks it against the profile, then it goes live, with no foreign canteen. Employee questions about leave, home office and parental leave are answered from the custom GPT, with the passage from the policy cited, and every question outside the policy lands with a human. A reference letter starts from eight bullet points from the manager instead of the last similar document, and the name goes into the template only in the last step.
The works council signed the works agreement, with the three use cases, the review step, the exclusion of performance monitoring, the retirement date for personal accounts and a review date after six months. The team has since built a fourth routine on its own, onboarding plans from the job description, and presented it to the works council at the review, as the agreement provides. It did not need me for that, and that was the point of the project.