Building a Generative AI Use Policy That Protects Trade Secrets: A Practical Guide

Summary. This guide walks a company's legal, security, and business leads through building a generative AI use policy, step by step, so that it actually protects trade secrets and holds up as evidence of reasonable measures under the Defend Trade Secrets Act and state law. It begins with the threshold decisions (ban or enable, who owns the program, which data and people are in scope) and then covers twelve steps: assembling the team, discovering current AI use, classifying data, reviewing and approving tools, building a tiering matrix, deploying technical controls such as single sign-on, data loss prevention, logging, and agent restrictions, drafting the policy, updating contracts, training and certifying employees, responding to prompt-leakage incidents, auditing, and preparing for litigation. Each step explains what to do, why it matters, the governing authority, common pitfalls, timing, and cost. Separate sections address employees and contractors, counterparties whose information the company holds, and the labor-law and whistleblower limits on confidentiality rules. A timeline and cost table, an extended worked example involving a specialty coatings manufacturer, common mistakes, an FAQ, and takeaways close the guide.

Teresa Vance, general counsel of Halbrook Coatings, a 600-person maker of corrosion-resistant coatings for ships, bridges, and military vehicles, gets two emails on the same Monday. The first is from the CEO: the sales team is "using AI for everything," a competitor just announced an AI-driven formulation service, and he wants a policy "that lets us move fast without giving away the formulas." The second is from Halbrook's largest defense customer, attaching a supplier questionnaire with a new section: "Describe all generative AI tools that process Customer Confidential Information, the terms under which they do so, and the controls you maintain."

Teresa cannot answer the questionnaire. She does not know which tools Halbrook's employees use. She suspects that some of the chemists paste formulation notes into chatbots to help write lab reports, and she knows that at least one plant manager uses an AI meeting assistant. She also knows that Halbrook's formulas, which are not patented, are worth more than its plants, and that if Halbrook ever has to sue a departing chemist, the first thing the chemist's lawyer will attack is whether Halbrook took reasonable measures to keep those formulas secret.

This guide is the path from those two emails to a working program. It is written for the lawyer who owns the policy, with enough technical detail to work with security and IT, and enough labor and contract law to keep the policy from creating new problems. The doctrine behind each step is explained in Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms.

The short answer

• The policy is evidence. Trade secret status under 18 U.S.C. § 1839(3) depends on reasonable measures. Build the program so that, read aloud at a deposition, it shows a company that knew its secrets, gave employees a safe way to use AI, and enforced the line.
• Enable, then restrict. A ban without an approved alternative drives use underground. Provide at least one approved tool under business terms, then block and monitor the rest.
• Classify before you approve. The core of the policy is a matrix: which data classes may go into which tools for which purposes. Without a classification scheme, every rule is either too strict or too loose.
• Read every vendor term that matters, not only the training clause: retention, human review, subprocessors, connectors, confidentiality, and change rights.
• Controls make the policy real. Single sign-on, blocking of unapproved tools, data loss prevention, logging, permission-aware retrieval, and limits on agents and connectors are what a court will credit.
• Paper it correctly. Update confidentiality agreements and contractor terms, include the immunity notice of 18 U.S.C. § 1833(b), and keep the policy clear of NLRA-protected activity.
• Plan the incident before it happens. Prompt leakage needs its own playbook: contain, request deletion, assess, preserve, notify, and fix.
• Expect eight to sixteen weeks for a mid-size company's first version, and budget mainly for the enterprise licenses and security tooling; legal drafting is the smaller cost.

The controls are itemized in the Generative AI Trade Secret Protection Checklist: A Practical Checklist, and every form referred to in this guide (the policy, the classification matrix, the vendor worksheet, clauses, playbook, certification, and exit script) is in the AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks.

Before you start: five decisions

1. Ban, restrict, or enable?

Most companies end up in the middle row. A temporary ban while the approved tool is deployed is reasonable, but set an end date.

2. Who owns the program?

Ownership usually sits with legal or with a governance committee chaired by legal and security together. The owner needs authority to approve tools and to require IT to block others. If the company already has an AI governance committee, as described in AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After, put the trade secret work inside it rather than creating a second structure.

3. Who is in scope?

Employees, of course, but also contractors, consultants, temporary staff, and anyone with access to company systems. Contractors are often the weakest link because they bring their own tools and accounts. Decide early whether the policy applies to personal devices used for work.

4. Which data is in scope?

Not only the company's trade secrets. Include information the company holds for others under NDAs and supply agreements, personal data, regulated data (health, financial, export-controlled), and privileged material. Each brings its own legal regime and sometimes stricter rules than trade secret law.

5. What is the litigation posture?

If a dispute is already brewing (a departing executive, a competitor that seems to know too much), coordinate the policy rollout with litigation counsel. A new policy adopted after the fact is still useful going forward, but it will not retroactively create reasonable measures, and the investigation of past AI use may be discoverable unless run through counsel.

Step 1: Assemble the team and set the objectives

What to do. Form a working group of five to eight people: legal (owner), information security, IT (identity and endpoint), HR, procurement, and one or two business leaders from the groups that handle the most valuable secrets (for Halbrook, R&D and sales). Write a one-page charter stating the objectives: protect identified trade secrets and third-party confidential information, provide approved AI tools, meet customer and regulatory requirements, and create a defensible record.

Why. Reasonable measures are a program-level judgment. Courts look at the whole system, as in Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714 (7th Cir. 2003), where the Seventh Circuit applied a multi-factor, context-sensitive inquiry. A policy that legal writes alone, without the people who control the technology, will not produce the controls that make it credible.

Pitfalls. Letting IT own the program alone (the result is a tool rollout without data rules) or legal alone (the result is a document without controls). Leaving HR out until the end, which produces a policy that conflicts with the handbook and disciplinary process.

Timing and cost. One to two weeks. Internal time only.

Step 2: Discover how AI is already being used

What to do. Before writing rules, find out what employees actually do. Use several sources:

• Network and proxy logs showing traffic to AI domains, by department.
• Identity provider logs showing which AI services employees have signed into with company credentials.
• Expense reports and corporate cards showing AI subscriptions.
• Browser extension inventories from endpoint management.
• Meeting platform settings showing which third-party bots have joined calls.
• Code repositories for API keys to AI services and for calls to AI APIs in internal applications.
• A short anonymous survey asking which tools people use, for what tasks, and what data they put in.

Consider an amnesty: tell employees that disclosures in the survey will not lead to discipline, so that you learn the truth.

Why. The policy has to address real use cases or it will be ignored. Discovery also tells you whether a past disclosure needs incident handling (Step 10). And it builds the record: a company that investigated its AI exposure and then acted is demonstrating the kind of diligence courts credit.

Authority. The discovery itself is a monitoring activity. Employee monitoring is generally lawful on company systems with notice, but state laws vary; see Employee Monitoring and Workplace Privacy: A Practical Guide. If the review may uncover misconduct relevant to a dispute, run it at the direction of counsel to preserve privilege under Upjohn Co. v. United States, 449 U.S. 383 (1981).

Pitfalls. Discovering a serious past disclosure and doing nothing. Once the company knows, inaction is worse than ignorance. Also: treating the survey results as the whole picture. People underreport.

Timing and cost. Two to three weeks. Mostly internal; a cloud access security broker or secure web gateway that categorizes AI traffic may already be licensed, and if not, it is a significant line item (see the cost table below).

Step 3: Inventory and classify the data

What to do. Build or update a trade secret register that identifies, with specificity, the company's most valuable confidential information: what it is, where it lives, who has access, and who owns it. Then map all company information into a small number of tiers. Four tiers work for most companies:

Overlay regulated categories, which follow their own rules regardless of tier:

• Personal data, including employee and customer personal information subject to state privacy laws.
• Protected health information for companies that are HIPAA covered entities or business associates; disclosure to an AI vendor requires a business associate agreement under 45 C.F.R. Part 164.
• Customer financial information held by financial institutions, subject to 15 U.S.C. § 6801 and the Safeguards Rule's service-provider oversight requirements in 16 C.F.R. Part 314.
• Export-controlled technical data, such as items on the Commerce Control List in 15 C.F.R. Part 774 or defense articles and technical data on the U.S. Munitions List in 22 C.F.R. Part 121. Uploading controlled technical data to a service with servers or personnel abroad can raise export questions; involve export counsel.
• Privileged material, which should be handled only in tools that legal has approved for that purpose.

Why. A secret that is not identified is hard to protect and harder to sue over. Courts require plaintiffs to identify trade secrets with particularity; see InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653 (9th Cir. 2020). A register built now becomes the backbone of a future identification statement, and tiers let the AI policy be strict for Tier 1 without blocking ordinary work.

Pitfalls. Marking everything Tier 1. Over-designation dilutes the claim that anything is special and makes the rules unworkable. Forgetting AI assets: prompts, evaluation sets, fine-tuning data, and model weights belong on the register if the company has them. Building the register as a single file that itself becomes a target; restrict access to it.

Timing and cost. Three to six weeks, overlapping with Step 2. Mostly internal; outside counsel review of the register for a mid-size company is commonly a modest fixed-fee project. The fuller audit method is in the Trade Secret Audit Checklist: A Practical Checklist.

Step 4: Review and approve the tools

What to do. For each candidate tool, complete a vendor term review covering the points below, and record the result in an approved-tools register with the tier of data each tool may receive.

1. Account tier and contracting entity. Which product and plan, under which agreement? Consumer, business, enterprise, API, or zero data retention?
2. Training use. Is there a contractual commitment not to use customer content (inputs, files, outputs, embeddings, fine-tuning data) to train or improve models? Does it bind affiliates and subprocessors?
3. Retention. What is stored, where, and for how long? Can the customer set retention? Does deletion reach backups and abuse-monitoring stores?
4. Human review. Under what circumstances may provider personnel access content, with what logging and from which locations?
5. Subprocessors and connectors. Is there a list with change notice? Do plug-ins, connectors, and third-party tools fall outside the agreement?
6. Confidentiality and security. Is customer content defined as confidential information? What security standards, audit reports, and breach-notification commitments apply?
7. Legal process. How does the provider respond to subpoenas and preservation orders that reach customer content? Will it notify the customer?
8. Change rights. Can the provider change terms unilaterally? Is there notice and an exit right?
9. Output and IP terms. Ownership of outputs and any indemnity, coordinated with procurement.

Why. Disclosure to a vendor under confidentiality obligations is the kind of limited disclosure that preserves secrecy, as in Metallurgical Industries Inc. v. Fourtek, Inc., 790 F.2d 1195 (5th Cir. 1986), and sharing secrets with vendors under protective conditions can be reasonable even if imperfect, as in Rockwell Graphic Systems v. DEV Industries, 925 F.2d 174 (7th Cir. 1991). Disclosure under terms that let the recipient use the material is closer to the loss of the property interest described in Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984). The vendor review is how the company shows which side of that line each tool falls on.

Choosing the deployment model for Tier 1. For crown-jewel data, compare three options: an enterprise tool with contractual no-training and short retention; an API deployment with zero data retention; or a self-hosted model running on company infrastructure or in a dedicated cloud environment. Self-hosting gives the most control and the strongest record but requires engineering capacity and usually means a less capable model. Many companies keep Tier 1 out of AI tools entirely at first and add a self-hosted option later.

Pitfalls. Relying on a vendor's marketing page or FAQ instead of the contract. Missing that a feature (web browsing, a connector, a plug-in marketplace) sends data to a third party under separate terms. Approving a tool once and never rechecking: vendors change terms, and the FTC has warned that quietly changing terms to expand data use may violate Section 5 of the FTC Act, 15 U.S.C. § 45, but that warning is not a substitute for monitoring. Forgetting the preservation risk: a vendor that retains content may be ordered to keep it in unrelated litigation, as happened to consumer and API conversation logs in the news publishers' copyright case against OpenAI in 2025.

Timing and cost. Two to four weeks per major tool, longer if negotiating. The commercial side is covered in the AI Vendor Procurement and Governance Checklist: A Practical Checklist and the Vendor Cybersecurity Diligence Checklist: A Practical Checklist. The negotiating playbook for data terms is in Negotiating an AI Data or Model License: A Practical Guide.

Step 5: Build the tiering matrix

What to do. Combine Steps 3 and 4 into a one-page matrix that tells employees, for each data tier, which tools are permitted and for what. A simple version:

Add a short list of prohibited uses regardless of tier: using AI to process information obtained from a competitor or a former employer; uploading third-party information in breach of an NDA; using AI to scrape or extract information from others' systems contrary to their terms; publishing shared conversation links; and enabling connectors or agents not on the approved list.

Why. Employees follow rules they can remember. A matrix also shows a court that the company calibrated its precautions to the value of the information, which is the cost-benefit balance that Rockwell describes.

Pitfalls. A matrix so detailed that nobody reads it. Leaving out the overlays, which are where regulatory liability lives. Forgetting third-party information: many NDAs and supply agreements restrict disclosure to the recipient's employees and professional advisers, and putting a customer's drawings into a vendor's tool may breach the agreement even if the tool is secure.

Timing and cost. One week, iterated after training feedback.

Step 6: Deploy the technical controls

What to do. Work with security and IT to implement controls that make the matrix enforceable. The core set:

• Single sign-on and provisioning for approved tools, so that only company-managed accounts can access them and departing employees lose access automatically.
• Tenant restrictions where the vendor supports them, which stop employees from signing into personal accounts of the same service on company devices.
• Blocking unapproved AI services at the secure web gateway or DNS layer, with a request process for exceptions.
• Data loss prevention rules that detect Tier 1 identifiers (formulation codes, project names, source code from restricted repositories) in uploads or pastes to AI services, warn or block, and log the event.
• Logging and retention of approved-tool use, at a level that supports investigations without collecting more than needed. Set retention deliberately: long enough to investigate, short enough to limit exposure, with the ability to suspend deletion for legal holds.
• Permission-aware retrieval. Any internal assistant that searches company documents must respect each document's existing access controls. Test it by asking the assistant, as a junior employee, for a Tier 1 document.
• Agent and connector governance. Maintain an allowlist of connectors. Do not let an agent with access to Tier 1 or Tier 2 stores take outbound actions (send email, post, call external APIs) without human approval. Treat any content the agent reads from outside as potentially hostile instructions; prompt injection, which the OWASP Top 10 for Large Language Model Applications ranks as the leading risk, cannot currently be eliminated, only contained.
• Browser extension and meeting bot control. Allowlist extensions; block unapproved transcription bots from joining company meetings.
• API key management for developers, with keys issued through a gateway that logs use and enforces the vendor's zero-retention or no-training settings.

Why. Written policies without technical enforcement are the gap between paper and practice that loses reasonable-measures fights. In Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018), a company that let an employee keep its information on unsecured personal devices could not show reasonable measures. Blocking personal AI accounts on company devices is the modern equivalent of not letting that information walk out on a personal laptop. Controls also generate the logs that prove misappropriation later.

Authority. The Computer Fraud and Abuse Act, 18 U.S.C. § 1030, reaches only access beyond authorized "gates" after Van Buren v. United States, 593 U.S. 374 (2021). Technical access limits therefore matter twice: they are reasonable measures, and they define the gates whose breach can support a CFAA claim.

Pitfalls. Data loss prevention rules so noisy that security ignores them. Logging prompts in full in a system with broad access, which creates a new store of secrets. Exempting executives. Forgetting mobile devices.

Timing and cost. Four to eight weeks. This is the largest cost driver: enterprise AI licenses are priced per user per month, and gateway, data loss prevention, and browser-control tools are often separate subscriptions. Companies that already have a mature security stack can often configure existing tools.

Step 7: Draft the policy

What to do. Write a policy of four to eight pages in plain language. A workable structure:

1. Purpose and scope. Who and what the policy covers, including contractors and personal devices used for work.
2. Definitions. Generative AI tool, approved tool, data tiers, AI asset, connector, agent.
3. Approved tools and the matrix. Reference the register and matrix, which can be updated without amending the policy.
4. Rules of use. What employees must and must not do, with examples.
5. AI outputs. Review for accuracy; treat outputs containing confidential inputs as confidential; label AI-generated material where required; do not claim copyright in machine-generated material without review.
6. Requests for new tools and exceptions. The process and who decides.
7. Monitoring. Notice that company systems and approved tools are monitored and logged.
8. Reporting and incidents. How to report a mistaken disclosure, and a non-retaliation commitment.
9. Protected activity and whistleblower carve-outs. See below.
10. Discipline. Consequences, coordinated with the handbook.
11. Ownership and review. Who maintains the policy, and the review cycle.

The labor-law carve-out. For non-supervisory employees, a work rule that an employee could reasonably read as restricting discussion of wages, hours, or working conditions risks violating 29 U.S.C. § 158(a)(1) by interfering with rights under 29 U.S.C. § 157. Under Stericycle, Inc., 372 NLRB No. 113 (2023), such a rule is presumptively unlawful unless the employer shows a legitimate and substantial interest that a narrower rule could not serve. Supervisors and managers, defined in 29 U.S.C. § 152(11), are outside the Act's protection. Define confidential information by reference to trade secrets and specified business information, exclude employees' own terms and conditions of employment, and say expressly that nothing in the policy restricts Section 7 activity. The Board's composition changed in 2025, and its standards for work rules and severance terms (including McLaren Macomb, 372 NLRB No. 58 (2023)) may be revisited; check the current law before finalizing. If a union represents any employees, as at one of Halbrook's plants, new rules affecting terms and conditions of employment may also trigger a duty to bargain.

The whistleblower carve-outs. Include the immunity notice required by 18 U.S.C. § 1833(b) if the policy, or the acknowledgment employees sign, governs confidential information. For public companies, the SEC's rule against impeding communications with the Commission, 17 C.F.R. § 240.21F-17, means confidentiality rules must not prohibit or condition reports to the SEC; the agency has brought enforcement actions over confidentiality language that did. Whistleblower protections more broadly are covered in Whistleblower and Retaliation Claims: SOX, Dodd-Frank, the False Claims Act, and State Law.

Why. The policy is the first exhibit in any reasonable-measures fight. It must be specific enough to show the company knew what it was protecting and lawful enough that it cannot be turned against the company.

Pitfalls. Copying a template that bans all AI use, then rolling out an approved tool that contradicts it. Writing for lawyers instead of chemists and salespeople. Overbroad definitions of confidential information. Forgetting to fit the policy into the handbook's discipline and acknowledgment structure; see How to Write an Employee Handbook.

Timing and cost. Two to three weeks of drafting and review, overlapping with Step 6. Outside counsel review of a draft policy is usually a limited engagement.

Step 8: Update the contracts

What to do. Review and update four sets of agreements.

• Employee confidentiality and invention assignment agreements. Add an AI clause: employees may process company confidential information only in approved tools and only as the policy permits; they may not use personal AI accounts for company information; they must disclose and return or delete company information held in any AI account at separation. Add or confirm the § 1833(b) notice. Assignment language should cover prompts, outputs, fine-tuning data, and other AI work product created within the scope of employment. See Employee Invention Assignment Agreements: Drafting for Enforceability Across Jurisdictions.
• Contractor and consultant agreements. The same restrictions, plus a representation about which AI tools the contractor uses for the company's work and a requirement to use company-provisioned tools for Tier 1 and Tier 2 material.
• Outbound NDAs and supply agreements. When the company shares its own secrets with suppliers, customers, or partners, add a clause restricting the recipient's processing of the information through AI tools that may train on or retain it. Without it, a recipient's use of a consumer tool is arguably not a breach.
• Inbound NDAs and customer agreements. Check what the company has promised others. Many agreements limit disclosure to the recipient's employees and advisers; some now expressly address AI. If the approved tool is a "service provider" within the agreement's permitted disclosures, document that conclusion; if not, either keep that information out of AI tools or negotiate consent.

Why. Contract terms supply the duty of secrecy whose breach is "improper means" under 18 U.S.C. § 1839(6) and the basis for misappropriation under § 1839(5). An owner that shares information without asking for confidentiality may forfeit protection, as in Fail-Safe, LLC v. A.O. Smith Corp., 674 F.3d 889 (7th Cir. 2012). Drafting principles for enforceable confidentiality terms are in Drafting Enforceable Non-Disclosure Agreements for Technology Transactions.

Pitfalls. Rolling out an AI acknowledgment that governs confidential information without the § 1833(b) notice, which forfeits exemplary damages and attorney's fees against employees who did not receive it. Using noncompete language in the same update in a state that restricts noncompetes, which can taint the whole agreement; see Non-Compete Agreements Under Siege: FTC Rulemaking and State Law Developments. Requiring existing employees to sign new restrictive terms without consideration where state law requires it.

Timing and cost. Four to eight weeks for template updates; rollout to existing employees can take longer. Customer agreements are reviewed on renewal or by priority.

Step 9: Train and certify

What to do. Deliver short, role-based training: what the tiers are, which tools are approved, five or six concrete examples per role of what is and is not allowed, how to report a mistake, and why it matters. Chemists need examples about formulation notes and lab reports; salespeople need examples about customer pricing and proposals; engineers need examples about code and repositories. Require a signed or electronic certification that the employee has read the policy, will use only approved tools for company information, and has disclosed any company information held in personal AI accounts. Repeat annually and when the policy changes.

Why. Training and acknowledgments are among the measures courts consistently credit, and they defeat the argument that employees did not know the information was confidential. The certification also creates a clear duty that a departing employee's later AI use can be measured against.

Pitfalls. Generic training that never mentions the company's actual secrets or tools. Failing to train contractors. Not keeping the certification records where they can be found three years later.

Timing and cost. One to two weeks to build; ongoing. Many companies use their existing learning-management system.

Step 10: Prepare the prompt-leakage incident playbook

What to do. Write a short playbook for the most likely incident: an employee (or contractor) put restricted information into an unapproved tool, or into an approved tool beyond its tier. The steps:

1. Report and triage. The employee or the data loss prevention system reports; security and legal triage within one business day. What was disclosed, to which tool, under which account and terms, and when?
2. Contain. Delete the conversation and any uploaded files from the account; disable shared links; revoke connector permissions; if the account is personal, ask the employee to delete and certify. Capture a record before deletion (screenshots, export) for the investigation file, held by counsel.
3. Vendor contact. For business accounts, ask the vendor to confirm deletion and whether the content was used for training or reviewed. For consumer accounts, use the vendor's privacy and deletion request channels; responses vary.
4. Assess. Was the information a Tier 1 secret? Was it third-party information? Personal data? Export-controlled? Is there any indication of onward exposure?
5. Preserve. If the incident relates to a potential dispute (a departing employee, a competitor), issue a legal hold before anything else is deleted and preserve relevant logs. Spoliation by a company's own employees can be catastrophic, as the adverse-inference proceedings in E.I. du Pont de Nemours & Co. v. Kolon Industries, Inc., 277 F.R.D. 286 (E.D. Va. 2011), illustrate, and Fed. R. Civ. P. 37(e) governs sanctions for lost electronically stored information.
6. Notify. Check contractual notice duties to customers and partners whose information was involved, and statutory duties if personal data was exposed. A disclosure to an AI vendor under business terms is often not a "breach" under state notification laws, but a consumer tool with training rights may be; analyze it.
7. Remediate and record. Retrain the individual, adjust controls, and write a short incident report stating what was found and done. The report is evidence of reasonable measures.

Why. One incident handled well is consistent with reasonable measures; an incident ignored is evidence the company did not care. Rapid action also matters if information reaches the public internet, where courts have found that wide circulation can end secrecy, as in Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995).

Pitfalls. Treating the employee as a suspect by default, which kills self-reporting. Deleting evidence in the rush to contain. Running the investigation outside privilege when litigation is plausible. Integrate this playbook with the general plan in the Trade Secret Cybersecurity Incident Response Checklist: A Practical Checklist and Data Breach and Incident Response Toolkit: From Detection to Notification.

Timing and cost. One to two weeks to write and tabletop.

Step 11: Audit, measure, and update

What to do. Review the program quarterly in the first year and at least annually after that. Measure: number of approved-tool users; blocked attempts to reach unapproved tools; data loss prevention events by tier; incidents and their outcomes; training completion; vendor term changes; exception requests. Re-run a short version of the Step 2 discovery each year. Re-review each approved vendor's terms on renewal and whenever the vendor announces changes. Update the matrix as tools and use cases change.

Why. Reasonable measures are judged as of the time of misappropriation. A program that was strong two years ago and has since decayed is a weaker record. Audits also catch shadow tools and connectors that appear after rollout.

Pitfalls. Collecting metrics nobody reviews. Not documenting the review itself. Letting the approved-tool register drift out of date.

Timing and cost. A few days per quarter; ongoing.

Step 12: Get ready for litigation, on either side

What to do. Assume the program will be examined in discovery. Keep the policy history (every version, with dates), the approved-tools register, vendor term reviews, training and certification records, incident reports, and audit results in one place, so a Rule 30(b)(6) witness can testify about them under Fed. R. Civ. P. 30(b)(6). Build legal-hold procedures that reach AI tools: approved-tool logs, conversation histories, connector logs, and any self-hosted model logs. Draft protective-order language for future cases that addresses whether the parties may process the other side's confidential material with AI tools, relying on Fed. R. Civ. P. 26(c) and 18 U.S.C. § 1835; see Protective Orders, Confidentiality Designations, and Sealing: Secrecy and Its Limits in Federal Court.

If the company is the plaintiff. The program records support the reasonable-measures element; the logs support the misappropriation narrative; development records support independent economic value. The civil action is under 18 U.S.C. § 1836, with a three-year limitations period running from discovery. The litigation path is in Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide.

If the company is the defendant (for example, it hired someone accused of bringing a former employer's secrets), the same program helps: logs show that the new hire's AI use did not touch the former employer's information, the policy prohibits processing others' confidential information, and onboarding certifications show the company told the hire not to bring anything. AI-assisted development should be documented well enough to show independent derivation, which is proper under § 1839(6)(B).

Why. Trade secret cases are won and lost on records created long before the complaint.

Pitfalls. Keeping policy versions only as the current web page. Allowing default retention to delete AI logs after a hold should have issued. Treating employees' own use of consumer AI tools to prepare for litigation as privileged: in United States v. Heppner, No. 25 Cr. 503 (JSR) (S.D.N.Y. Feb. 17, 2026), Judge Jed Rakoff held that a criminal defendant's exchanges with the consumer version of an AI chatbot, created on his own initiative and only later shared with his lawyers, were neither privileged nor work product. It is a single district court ruling, and the court suggested the result might differ if counsel had directed the use, but the risk it illustrates is real, and Fed. R. Evid. 502 does not cure a disclosure that destroyed privilege before litigation.

Timing and cost. Part of the program's ongoing maintenance.

Addressing each side of the relationship

Employees and contractors

From the employee's perspective, a good policy answers three questions: what can I use, what can I put in it, and what happens if I make a mistake. Employees who are about to leave should know that personal AI accounts may hold company information and that the exit process will ask about them. Employees who discuss pay or working conditions, including through AI tools, should see from the policy itself that it does not reach that activity. Contractors should receive company-provisioned tools for company work, not be expected to buy their own.

Counterparties whose information the company holds

Customers and partners increasingly ask, as Halbrook's defense customer did, how their information is processed. Prepare a short standard response describing the approved tools, the tiering, and the controls, and keep it current. When a counterparty's NDA prohibits disclosure to third parties, either keep its information out of AI tools or obtain written consent naming the approved tools.

The departing employee

Add AI questions to the exit interview and the departure checklist: which AI accounts did you use for work, does any of them hold company information, and will you delete it and certify? Disable company AI accounts at departure and preserve their logs for a set period. The full departure process is in the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Timeline and cost overview

With overlap, a mid-size company can usually have a first version operating in eight to sixteen weeks. Small companies can compress the work: one approved tool, a two-page policy, a three-tier scheme, blocked consumer tools, and a signed acknowledgment can be done in a few weeks, and under Learning Curve reasonableness is judged in context.

Worked example: Halbrook Coatings, step by step

Steps 1 and 2. Teresa forms a six-person group with the CISO, Marcus Bell, the HR director, the head of procurement, the R&D director, and the vice president of sales. Proxy logs show traffic to eleven AI services; identity logs show that 140 employees have signed into one consumer chatbot with company email addresses; endpoint data show 37 AI writing extensions. The anonymous survey reveals that several chemists have pasted formulation notes into chatbots to draft lab reports, and that a plant manager's meeting bot has been recording safety meetings, including one where a customer's engineers discussed a classified-adjacent specification. Teresa opens two privileged incident files.

Step 3. The register identifies 23 Tier 1 items, led by the formulations for three marine coatings and the cure-process parameters. The defense customer's drawings are Tier 2 with an export-control overlay; export counsel confirms that some drawings are controlled technical data.

Step 4. Halbrook evaluates two enterprise assistants and one coding assistant. It chooses an enterprise assistant whose contract defines customer content (including outputs and embeddings) as confidential information, prohibits training, allows 30-day retention configurable down to zero for certain features, limits human review to abuse investigations with logged access, publishes a subprocessor list with 30 days' notice, and provides a security audit report. Halbrook declines to enable the vendor's third-party connector marketplace. For Tier 1, Halbrook decides to allow no AI processing in the first phase and to evaluate a self-hosted model in six months.

Step 5. The matrix permits Tier 2 and Tier 3 in the enterprise assistant, prohibits export-controlled drawings in any AI tool, and prohibits customer information unless the customer contract allows service providers.

Step 6. IT enforces single sign-on and tenant restrictions, blocks consumer AI domains on company devices and networks, adds data loss prevention rules keyed to formulation codes and project names, removes unapproved extensions, and blocks third-party meeting bots. The internal document assistant is rebuilt to respect SharePoint permissions after a test shows a junior sales rep could retrieve a cure-process document.

Steps 7 and 8. The six-page policy defines confidential information by reference to the register and expressly excludes employees' own wages and working conditions, with a Section 7 statement. Because one plant is unionized, labor counsel gives the union notice and an opportunity to bargain over the policy's effects on that unit. The new confidentiality agreement includes an AI clause and the § 1833(b) notice. Supplier NDAs gain an AI processing clause; the defense customer receives a written description of the controls and the export-control exclusion.

Steps 9 and 10. Chemists receive training built around the lab report example. The two historic incidents are closed: the chemists' consumer accounts are reviewed with them, conversations deleted and certified, the vendor's deletion channel used, and the formulation exposure assessed as limited (fragments, not complete formulas) and documented. The meeting-bot recordings are deleted from the bot vendor's service after a written request, and the customer is told what happened under the notice clause in its contract.

Steps 11 and 12. The first quarterly review shows 410 active enterprise-assistant users, a steady decline in blocked attempts, and four DLP events, all resolved by retraining. Six months later, a senior chemist resigns to join a competitor. The exit interview asks about AI accounts; he certifies that he has none with company information. Forensic review of his laptop, done as a matter of course under the departure checklist, shows an attempted upload of a Tier 1 formulation file to a personal AI account that the DLP rule blocked and logged two days before he resigned. Halbrook's counsel sends a preservation and demand letter the same week. The record, built over the preceding nine months, is the strongest exhibit Halbrook has.

Common mistakes

1. Writing the policy before discovering actual use. The rules will miss real use cases and be ignored.
2. Banning AI indefinitely. Shadow use grows; the ban becomes evidence of an unenforced rule.
3. Approving tools on marketing claims. Read the governing contract and the specific plan's terms.
4. Ignoring connectors, extensions, and meeting bots. They move data outside the contract.
5. Over-designating. If everything is Tier 1, nothing is.
6. Forgetting third-party information and export controls. These create liability even when the company's own secrets are safe.
7. Omitting the § 1833(b) notice and the NLRA carve-out.
8. Logging everything forever. Full prompt logs with broad access become a new target and a discovery burden.
9. Handling incidents without counsel or without preservation.
10. Treating the program as finished. Vendor terms and tools change monthly; the record must stay current.

Frequently asked questions

Do we need a separate AI policy, or can we amend our confidentiality policy? Either works if the result is clear. Most companies adopt a separate AI acceptable use policy that cross-references the confidentiality policy and handbook, because AI rules change faster and need their own approved-tools register.

Can we simply rely on the vendor's no-training promise? No. Training is one risk among several. Retention, human review, subprocessors, connectors, legal process, and employees' use of personal accounts all remain.

Should Tier 1 secrets ever go into an AI tool? Only under the strongest arrangements: a self-hosted model, or an API deployment with zero data retention and contractual confidentiality, with logging and limited access. Many companies keep Tier 1 out of AI entirely until they have such an option.

Do these rules apply to managers and executives? Yes, and enforcement against executives matters most. A defendant who shows that leadership ignored the policy will argue the company never took it seriously. Note that NLRA protections generally do not extend to supervisors and managers.

How do we handle employees who used consumer tools before the policy? Treat it as discovery, not discipline. Use the survey and an amnesty, assess any Tier 1 exposure, request deletion, document the results, and move forward under the new rules.

What if a customer's contract prohibits any AI processing of its information? Then keep that information out of AI tools, flag it in the matrix, and train the teams who handle it. Consider negotiating consent for specific approved tools at renewal.

Does a small company need all twelve steps? It needs the substance of them, scaled down. One approved tool, a short policy, a simple classification, blocked consumer tools, signed acknowledgments, and a basic incident procedure can be enough for a small company with a few secrets.

Takeaways

• Start with what employees actually do, then classify data and approve tools.
• Give employees an approved tool under terms that protect confidentiality, and block the rest.
• Put the rules in a one-page matrix that matches data tiers to tools and uses.
• Make the policy enforceable with single sign-on, tenant restrictions, DLP, logging, permission-aware retrieval, and connector limits.
• Update employee, contractor, and counterparty agreements, with the § 1833(b) notice and an NLRA carve-out.
• Train with real examples, certify annually, and handle incidents promptly and under privilege.
• Audit and update regularly, and keep the records a court will want to see.

This document is general information, not legal advice for any particular situation; the law, vendor terms, and technology change, and the facts matter.

Related Documents

Related Articles

• Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms: the doctrine behind each step of this guide.
• Trade Secrets in the Age of Remote Work and Cloud Computing: reasonable measures for distributed work and cloud services.
• AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After: the regulatory program this policy sits within.
• Copyright in Software Interfaces After Google v. Oracle: APIs, Compatibility, and Reverse Engineering: limits on reverse engineering and interoperability work, including AI-assisted analysis.

Related Guides

• Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide: where the program's records are used.
• Negotiating an AI Data or Model License: A Practical Guide: negotiating data terms with AI vendors.
• Employee Monitoring and Workplace Privacy: A Practical Guide: the legal limits on discovery and monitoring.
• Running a Clean Room Software Development Project: A Practical Guide: documenting independent development.

Related Checklists

• Generative AI Trade Secret Protection Checklist: A Practical Checklist: every control in this guide as a task list.
• AI Vendor Procurement and Governance Checklist: A Practical Checklist: commercial vendor review.
• Trade Secret Audit Checklist: A Practical Checklist: building the register in Step 3.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: exit controls, including AI accounts.

Related Toolkits

• AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks: the forms for every step.
• Trade Secret Protection Toolkit: Building and Defending a Confidentiality Program: the broader confidentiality program.
• AI Governance Toolkit: Inventory, Risk Classification, and Controls: inventory and risk tools for AI systems generally.
• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: vendor and retention terms where AI tools touch biometric data.