Proton pledges to open-source internal AI tools after backlash

Proton, the company behind Proton Mail, says it will open-source internal AI tools and publish where staff may and may not use AI. The pledge came on October 30, after a week of bad press about how it planned to push AI on its own employees. The lesson for a small business is simple: if you don't write your AI policy down, someone else will describe it for you.

What actually happened

On October 26, 404 Media reported that Proton told staff it would "re-interview" them about how they use AI at work. According to the internal email 404 Media obtained, the interviews could affect continued employment.

Proton then posted a statement on X on October 30. As CyberInsider reports, Proton said it will:

• Release and open-source internal AI tools, including more capable versions of its Lumo assistant.
• Publish where AI is allowed and banned inside the company, and why.
• Publish how it does code and security review.

Proton also denied that it re-interviews staff about AI use, denied that AI interviews will cost anyone their job, and said reports of laptop tracking came from a misunderstanding of device management software. Per CyberInsider, Proton gave no release date, no license, and no names for the tools beyond Lumo. We could not read Proton's original post directly, so we rely on CyberInsider's account of it. Treat the pledge as a promise until code ships.

Why an AI use policy matters for your business

Customers now ask how your work was made. Proton's pitch is that you can check how its code was produced, not only the code. Your customers won't audit your repo, but they will ask if AI wrote their quote, their ad copy or their support reply. Have one honest page that answers.

Staff need the rules before the mandate. Proton's trouble started with an internal email about AI and job security. If you want your team to use AI, publish what is allowed first: which tools, which data never goes in, who reviews the output. Then measure. In that order.

A one-page policy beats a pledge. You don't need open-source tools. You need a page with three lists: allowed, banned, needs review. Put customer data, credentials and contracts in the second list. Update it every quarter.

Sources: 404 Media, CyberInsider.