Employees, AI Tools, and Your Confidential Information

How AI use affects confidentiality, trade-secret protection, and privilege depends on your specific tools, data, and obligations. This post is informational. For your situation, consult a licensed attorney.

Your employees are already using AI tools. Some of it is sanctioned, most of it is not, and a fair amount of it involves pasting company or client information into a chatbot to get a faster answer. That instinct is understandable. The tools are genuinely useful. The problem is that every one of those pastes is a disclosure, and disclosures have legal consequences that do not announce themselves until something goes wrong.

This is usually treated as an IT problem. It is really a legal one.

The shadow-AI problem

“Shadow AI” is the use of AI tools that the company has not vetted or approved: a marketer using a consumer chatbot to rewrite a customer proposal, an engineer debugging with proprietary code in a public tool, a sales rep summarizing a confidential term sheet. The work gets done faster. The company’s confidential information now sits in a third party’s system, subject to that vendor’s terms, which may permit the vendor to retain the input or use it to train models.

Most companies have no idea how much of this is happening, because it does not show up in a procurement report. It shows up in browser tabs.

Why this is a legal problem, not just an IT one

Three protections erode quietly when confidential information goes into an unvetted tool.

Trade-secret protection. Information qualifies as a trade secret only if the owner takes reasonable measures to keep it secret. Courts look at what the company actually did to protect the information. If employees are routinely feeding sensitive material into public AI tools with no policy and no controls, an adversary in litigation will argue you did not take reasonable measures, and the protection you assumed you had may not survive.

Contractual confidentiality obligations. You almost certainly owe confidentiality duties to customers, partners, and vendors under NDAs and services agreements. Those obligations usually restrict disclosure to third parties. Routing a customer’s confidential data through an AI vendor that can retain or train on it can be a disclosure you promised not to make, a breach of contract before anyone is ever “hacked.”

Privilege, in regulated and legal contexts. For companies that handle legal, medical, or other privileged material, running that content through a third-party AI tool can waive the very privilege that protected it. (I have written elsewhere, for the Florida Bar Business Law Section, about how this plays out for lawyers specifically in Before You Prompt; the same disclosure logic reaches any business holding privileged or regulated information.)

What actually protects you

The answer is not to ban AI. A ban drives the behavior underground and forfeits a real productivity gain. The answer is to make the safe path the easy path.

A written AI use policy. Employees need to know which tools are approved, what categories of information may never go into a public tool (customer data, source code, anything under NDA, personal information), and where to go when they need AI for sensitive work. A policy also becomes evidence, proof that you took reasonable measures to protect your confidential information.

Vetted tools with the right terms. Enterprise and business tiers of major AI products typically offer contractual commitments that consumer versions do not: no training on your inputs, defined retention, and a data processing agreement. Approving specific tools with those terms gives employees a sanctioned option that does not create exposure.

Training that sticks. The policy only works if people understand why pasting a client contract into a consumer chatbot is different from emailing it to a colleague. Short, concrete guidance beats a long document nobody reads.

Contract terms with your AI vendors. When you do adopt AI tools, the agreement should address whether your inputs can be used for training, how long data is retained, and who is liable if the vendor’s handling of your data causes a problem.

The through-line

Confidentiality is not a switch you flip once. It is a set of practices a court or counterparty will examine after the fact and ask: given what this company said its information was worth, what did it actually do to protect it? AI tools have made that question sharper, because the easiest way to leak sensitive information is now also the most useful-feeling.

If your team is using AI and you do not yet have a policy and vetted tools in place, talk to MB Legal about getting ahead of it before a disclosure becomes a dispute.

This post is informational and does not constitute legal advice. Trade-secret, confidentiality, and privilege questions turn on specific facts and obligations. For guidance specific to your situation, consult a licensed attorney.