How General Counsel Should Modernize AI Policies to Protect Trade Secrets

Generative AI has introduced a fast, friction-free pathway for proprietary information to leave corporate control. When employees paste code, financial formulas, or customer data into an AI prompt, they rarely view it as a disclosure—yet that single act can compromise trade secret protections.

For general counsel, mitigating this risk requires far more than dropping a generic AI clause into an employee handbook.

Preserving trade secrets in the AI era is an operational challenge that legal cannot manage in a vacuum. While the GC must establish the legal framework, assessing where data travels, how vendor models are trained, and what technical safeguards exist demands tight coordination with the chief information security officer (CISO), chief information officer (CIO), and business leaders. As these exposure risks escalate, the GC’s primary role is to bridge these teams—ensuring the company’s “reasonable measures” hold up in court and providing the board with appropriate risk oversight.

Where does the information go?

Consumer AI services and enterprise platforms may appear similar to users, but the protections governing company information can differ substantially. Depending on the service, the account settings and the terms of contract, relevant questions are: Are prompts and uploaded files stored?

• May the provider use the information to improve or train its models?
• Who can access the information?
• What confidentiality and security obligations does the provider assume?
• Can the company delete the information or control its retention?

Enterprise arrangements may provide stronger protections, including restrictions on using customer data for model training, retention controls, administrative safeguards, access restrictions, and negotiated confidentiality provisions. Those protections should be confirmed in the provider’s contract and product documentation rather than assumed from the word “enterprise.”

Trade secret protection depends on the circumstances surrounding disclosure. Disclosure to a third party does not automatically destroy trade secret status in every case. The relevant questions include why the information was disclosed, to whom, under what obligations, and with what safeguards.

Generative AI creates a new setting in which the GC must address those questions.

“Reasonable measures” in the age of AI

The federal Defend Trade Secrets Act and state trade secret laws generally require an owner to take reasonable measures to maintain the secrecy of information claimed as a trade secret. The information also must derive independent economic value from not being generally known or readily ascertainable by others who could obtain economic value from its disclosure or use. See 18 U.S.C. § 1839(3).

Traditional protective measures include confidentiality agreements, restricted access, password protection, employee policies, training, and controls over the distribution of sensitive information. AI creates another channel through which proprietary information can leave the company.

A company may have a well-developed trade secret program and still find that its policies and training were written before employees routinely used external AI systems. A general instruction to “protect confidential information” may not answer whether an employee may enter customer data into an approved AI platform, submit source code to a coding assistant, or use an internal financial model to generate an analysis.

Training should therefore address AI specifically. Employees should know:

• Which AI platforms are approved
• What categories of information may be entered
• What information may not be entered
• Whether personal accounts or consumer tools may be used for business
• When to seek legal, security, or management guidance
• How to report a suspected disclosure

Training should also reflect the employee’s role. Software developers, marketing personnel, finance employees, and human resources staff may face different risks and need different examples.

Using AI does not necessarily eliminate trade secret protection. But a company that permits employees to submit confidential information without meaningful rules, training, or controls may have difficulty showing that it took reasonable measures to preserve secrecy.

Why legal cannot do this alone

A written policy is an important starting point, but it cannot determine which tools employees actually use, where information travels, how long a provider retains it, or whether restricted information is being transmitted.

Protecting trade secrets therefore requires cooperation among legal, technology, business leaders, and employees. Legal establishes the framework. Technology personnel understand systems, data flows, and available controls. Business leaders understand how AI is used and where restrictions could interfere with legitimate needs. Employees apply the rules in practice.

The GC’s role is to connect those functions

Depending on the company’s business and risk profile, safeguards may include:

• Data loss prevention tools that identify or restrict transmission of sensitive information
• Controls limiting business use to approved AI platforms
• Rules governing which information may be processed through each platform
• Contractual restrictions on retention, access, model training, confidentiality, and security
• Logging and audit capabilities for significant activity
• Procedures for investigating and responding to suspected incidents

The goal is not to make AI unusable. It is to permit productive use while extending the company’s information-protection program to a technology that creates new ways for information to leave traditional systems.

From management responsibility to board oversight

Management remains responsible for the company’s technology, cybersecurity, intellectual property, privacy, and information-protection risks. Board oversight does not transfer those responsibilities to directors.

But AI increasingly affects matters boards already oversee. As AI becomes more important to the business, management’s systems for identifying and addressing material AI-related risks may warrant board or committee attention.

Directors do not need reports on every use of an AI system. Depending on the company’s circumstances, however, they may need enough information to understand material risks, management’s response, and significant incidents. The GC can help determine what should be reported.

For companies whose proprietary information represents significant enterprise value, reporting may address:

• The extent to which important intellectual property interacts with AI systems
• Whether approved platforms have adequate contractual and technical safeguards
• Whether employees in sensitive functions receive appropriate training
• Whether material exceptions or incidents have occurred
• How management is responding to significant changes in AI use

Not every AI issue belongs in the boardroom. Management should, however, maintain a reporting process that identifies which risks are significant enough to require senior-management or board attention.

The general counsel’s expanding role

General counsel do not need to become technologists. They do need enough familiarity with AI to ask informed questions of those responsible for technology, security, procurement, compliance, and business operations.

Key questions include:

• Which AI tools are employees using for company business?
• What information may not be entered into unapproved systems?
• What happens to information submitted to approved providers?
• Do vendor agreements address retention, access, model training, confidentiality, and security?
• Do technical controls reinforce the written policy?
• Have employees been trained on confidentiality risks associated with AI?
• Who identifies and investigates a significant incident?
• What information should be escalated to senior management or the board?

AI governance is not solely a legal, technology, or cybersecurity function. Each discipline sees a different part of the risk, and the GC is often best positioned to bring those perspectives together.

For trade secret protection, that coordination may be critical. A company asked to demonstrate that it took reasonable measures to protect proprietary information will want to show more than a written policy. It should be prepared to demonstrate that it understood how its information was being used, selected appropriate tools, negotiated suitable contractual protections, trained employees, implemented proportionate technical controls, and responded appropriately to significant incidents.

AI is changing how companies work. It is also changing how they protect confidential information—and expanding the general counsel’s role in keeping that protection effective.