Generative AI Trade Secret Protection Checklist: A Practical Checklist

Summary. This checklist turns the trade secret risks of generative AI into specific, ordered tasks for in-house counsel, security leaders, and outside advisers. It runs through twelve phases: governance and scope, discovery of current AI use, identification and classification of secrets, vendor and tool approval, technical controls, the written policy, contracts, training and certification, protection of AI assets such as prompts and model weights, prompt-leakage incident response, onboarding and departures, and audit and litigation readiness. Each item cites the governing authority, chiefly the Defend Trade Secrets Act and the reasonable-measures case law, and adds a practical note where the task is commonly done wrong. Red-flag boxes mark the facts that most often undermine a later trade secret claim. A deadlines table, a short worked example, and a list of common failure points close the checklist.

A trade secret is only as safe as the least careful place it is stored, and for most companies one of those places is now a chat window. This checklist is built for the moment when someone asks, "Are we protected?" and for the deposition, two years later, when opposing counsel asks the same question under oath. Every item is something a company can do, record, and later prove.

How to use this checklist

• Work the phases in order the first time. Discovery (Phase 2) and classification (Phase 3) drive everything else. After the first pass, the phases become a recurring audit.
• Assign an owner and a date to every item. An unchecked box with no owner is a gap; a checked box with no record is an assertion.
• Keep the evidence. For each completed item, note where the proof lives (policy version, ticket number, contract, log export). Reasonable measures under 18 U.S.C. § 1839(3) are proved with documents.
• Scale to the company. Courts judge reasonableness in context; Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714 (7th Cir. 2003), credited the measures of a small company. A ten-person startup can satisfy many items with one tool, one page, and one signature.
• Read with the companion documents. The doctrine is in Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms; the step-by-step narrative is in Building a Generative AI Use Policy That Protects Trade Secrets: A Practical Guide; the forms are in the AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks.

The running example used in the notes is Brightwater Analytics, Inc., a 90-person company that sells demand-forecasting software to grocery chains. Its trade secrets are its forecasting models, the feature-engineering code behind them, and the cleaned historical sales data its customers license to it.

Phase 1: Governance and scope

• Name an accountable owner for AI confidentiality (usually the general counsel or a legal and security co-chair) with authority to approve tools and direct IT to block others. Note: Without blocking authority, the owner can write rules but not enforce them.
• Write a one-page charter listing objectives: protect identified secrets and third-party confidential information, provide approved tools, meet customer and regulatory demands, and build a defensible record.
• Define who is covered: employees, contractors, consultants, temporary staff, interns, and board members who receive confidential material.
• Decide whether personal devices are in scope when used for work, and state the decision in the policy.
• Fit the work into existing AI governance rather than creating a parallel committee. See AI Governance Toolkit: Inventory, Risk Classification, and Controls.
• Coordinate with litigation counsel if any dispute involving confidential information is pending or anticipated. Note: A policy adopted after the fact helps going forward but does not retroactively create reasonable measures.

Phase 2: Discover current AI use

• Pull network and proxy logs for traffic to AI domains for the last 90 days, by department.
• Pull identity provider logs for sign-ins to AI services with company credentials.
• Review expense reports and card statements for AI subscriptions.
• Inventory browser extensions on managed endpoints and flag AI writing, summarizing, and "copilot" extensions.
• Inventory meeting bots admitted to company calls and recording or transcription integrations.
• Scan code repositories for AI API keys and for calls to AI APIs in internal tools and pipelines, including logging or observability gateways that capture full prompts.
• Run an anonymous survey, with an amnesty for past use, asking which tools people use, for what, and with what data.
• Open a privileged file for any past disclosure of crown-jewel information, directed by counsel under Upjohn Co. v. United States, 449 U.S. 383 (1981). Note: Brightwater's survey revealed a data scientist who had uploaded a customer's sales extract to a consumer chatbot to "clean it up." That became an incident file, not a footnote.
• Confirm monitoring notice is adequate under applicable state law before expanding monitoring. See Employee Monitoring and Workplace Privacy: A Practical Guide.

Red flag: the known-and-ignored disclosure. Discovering that a Tier 1 secret went into a consumer tool and doing nothing is worse than never looking. Once the company knows, every month of inaction is evidence for a defendant arguing that the owner did not treat the information as secret.

Phase 3: Identify and classify secrets

• Build or update the trade secret register: each secret described specifically enough to support a future identification statement, its location, custodians, access list, and business owner. Note: Particularity is required in litigation; see InteliClear, LLC v. ETC Global Holdings, Inc., 978 F.3d 653 (9th Cir. 2020), and Identifying Trade Secrets in Litigation: Reasonable Particularity, Sequencing Discovery, and Protecting the Secret While You Sue.
• Record independent economic value evidence for each Tier 1 item: development cost, time, and competitive advantage. Note: Courts accept development cost as proof of value, as in WeRide Corp. v. Huang, 379 F. Supp. 3d 834 (N.D. Cal. 2019).
• Adopt a four-tier scheme (Restricted, Confidential, Internal, Public) and map information types to tiers.
• Resist over-designation. Keep Tier 1 to the information whose loss would cause serious harm. Note: If everything is restricted, a court may conclude nothing really was.
• Add regulatory overlays: personal data; protected health information under 45 C.F.R. Part 164; customer financial information under 16 C.F.R. Part 314; export-controlled technical data under 15 C.F.R. Part 774; and privileged material.
• Tag third-party confidential information received under NDAs, licenses, and customer contracts, and record any restrictions on disclosure to service providers. Note: Brightwater's customer data licenses permit processing only by Brightwater "and its subcontractors bound by written confidentiality obligations." An AI vendor without such terms is outside that permission.
• Restrict access to the register itself. It is a map to the crown jewels.

Phase 4: Vendor and tool approval

• Identify the exact product, plan, and contracting entity for each candidate tool (consumer, business, enterprise, API, zero data retention).
• Confirm a contractual no-training commitment covering inputs, files, outputs, embeddings, fine-tuning data, and logs, binding affiliates and subprocessors.
• Confirm retention terms: what is kept, where, for how long; whether the customer can configure retention; whether deletion reaches backups and abuse-monitoring stores.
• Confirm human-review limits: when provider personnel may access content, with what logging, from which locations.
• Review the subprocessor list and change-notice terms.
• Identify connectors, plug-ins, browsing, and third-party tool features, and whether data sent through them leaves the main agreement.
• Confirm that customer content is defined as confidential information with a standard of care, security commitments, and breach notification.
• Ask how the vendor responds to subpoenas and preservation orders affecting customer content, and whether it notifies the customer. Note: Retention promises yield to court orders, as conversation logs preserved under order in the 2025 news-publisher litigation against OpenAI showed.
• Check unilateral-change rights and negotiate notice and termination rights. Note: The FTC has warned that quietly changing terms to expand data use may be unfair or deceptive under 15 U.S.C. § 45, but a contract right is better than a regulator's interest.
• Decide the Tier 1 deployment model: no AI, self-hosted model, or zero-retention API with confidentiality terms.
• Record the decision in an approved-tools register listing each tool, plan, permitted tiers, permitted uses, review date, and next review date.
• Run the commercial review in parallel. See the AI Vendor Procurement and Governance Checklist: A Practical Checklist.

Red flag: approval by marketing page. A vendor FAQ that says "we don't train on your data" is not a contract, may describe a different plan, and can change overnight. Approvals should cite the governing agreement and its version date.

The legal reason vendor terms matter: limited disclosure under confidentiality obligations preserves secrecy, as in Metallurgical Industries Inc. v. Fourtek, Inc., 790 F.2d 1195 (5th Cir. 1986), while disclosure to a recipient free to use the material risks the loss of the property interest described in Ruckelshaus v. Monsanto Co., 467 U.S. 986 (1984).

Phase 5: Technical controls

• Enforce single sign-on and automated provisioning for every approved tool; disable local accounts.
• Enable tenant restrictions where supported so personal accounts of approved services cannot be used on company devices and networks.
• Block unapproved AI domains at the gateway or DNS layer, with a documented exception process.
• Deploy data loss prevention rules for Tier 1 identifiers (project code names, model file types, repository paths, customer dataset identifiers) on uploads and pastes to AI services; log every event.
• Configure logging for approved tools at a level that supports investigation; restrict access to logs; set retention deliberately with legal-hold override.
• Make retrieval permission-aware. Internal assistants must enforce the source system's access controls. Test: sign in as a junior employee and ask for a Tier 1 document.
• Maintain a connector and agent allowlist. No agent with Tier 1 or Tier 2 access may take outbound actions (send, post, call external APIs) without human approval.
• Treat external content as untrusted input for agents (web pages, inbound email, uploaded documents) and test for prompt-injection exfiltration paths, such as instructions that cause the agent to embed data in links or image requests.
• Allowlist browser extensions and remove unapproved AI extensions.
• Block unapproved meeting bots and disable auto-join for approved ones in meetings tagged confidential.
• Route developer API traffic through a managed gateway that enforces zero-retention or no-training settings and keeps keys out of code.
• Apply controls to executives and mobile devices without exception.

Why it matters: written rules without enforcement are the gap that lost the claim in Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. 2018), where information was left on an employee's personal devices. Access controls also define the "gates" relevant to the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, as read in Van Buren v. United States, 593 U.S. 374 (2021).

Red flag: the flattened index. An internal "ask our documents" assistant built from a shared drive without carrying over permissions lets any employee read anything. That erases need-to-know access, one of the measures courts look for, and it is invisible until someone tests it.

Phase 6: The written policy

• Draft a plain-language AI acceptable use policy of four to eight pages covering scope, definitions, approved tools, the tiering matrix, rules of use, outputs, exceptions, monitoring, reporting, protected-activity carve-outs, discipline, and review.
• Attach or link the tiering matrix and the approved-tools register so they can be updated without amending the policy.
• List prohibited uses regardless of tier: processing information from a competitor or former employer; uploading third-party information in breach of an NDA; using AI to scrape or extract others' information contrary to their terms; publishing shared conversation links; enabling unapproved connectors or agents. Note: Automated harvesting of a competitor's semi-public data can be improper means; see Compulife Software Inc. v. Newman, 959 F.3d 1288 (11th Cir. 2020).
• Address outputs: human review for accuracy, treatment of outputs containing confidential inputs as confidential, and no copyright claims in machine-generated material without review. Note: Copyright requires a human author under Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), so trade secrecy is often the main protection for valuable outputs.
• Define confidential information narrowly enough to exclude employees' own wages, hours, and working conditions, and add an express statement that the policy does not restrict activity protected by 29 U.S.C. § 157. Note: Under Stericycle, Inc., 372 NLRB No. 113 (2023), a work rule that could reasonably be read to chill protected activity is presumptively unlawful under 29 U.S.C. § 158(a)(1). Because the Board's membership changed in 2025, check whether this standard has since been revisited. See Union Organizing and the NLRA: What Employers May and May Not Do.
• Check for a duty to bargain before implementing the policy for any unionized unit.
• Include whistleblower carve-outs: the immunity notice under 18 U.S.C. § 1833(b) wherever the policy or acknowledgment governs confidential information, and for public companies, language consistent with 17 C.F.R. § 240.21F-17.
• Coordinate discipline and acknowledgment with the employee handbook. See the Employee Handbook Drafting Checklist: A Practical Checklist.
• Keep every version of the policy with its effective date in a records system, not only on the intranet.

Phase 7: Contracts

• Add an AI clause to employee confidentiality agreements: approved tools only; no personal AI accounts for company information; disclosure, return, and deletion of company information in any AI account at separation.
• Confirm the § 1833(b) notice appears in every agreement governing confidential information entered into or updated after May 11, 2016. Note: Without it, the employer cannot recover exemplary damages or attorney's fees under 18 U.S.C. § 1836(b)(3) against an employee who was not notified.
• Extend invention assignment to prompts, outputs, datasets, evaluation sets, fine-tuning data, and model weights created within the scope of work.
• Update contractor and consultant agreements with the same restrictions, a representation about tools used, and a requirement to use company-provisioned tools for Tier 1 and Tier 2 material.
• Add an AI processing clause to outbound NDAs and supply, development, and partnership agreements, restricting the recipient's use of AI tools that train on or retain the information. Note: An owner that shares information without requiring confidentiality may forfeit protection; see Fail-Safe, LLC v. A.O. Smith Corp., 674 F.3d 889 (7th Cir. 2012).
• Audit inbound NDAs and customer contracts for limits on disclosure to service providers and for express AI provisions; record conclusions for each counterparty class.
• Avoid bundling restrictive covenants into the AI update where state law limits noncompetes. See Non-Compete Agreements Under Siege: FTC Rulemaking and State Law Developments.
• Confirm consideration for new terms imposed on existing employees where state law requires it.

Phase 8: Training and certification

• Build role-based training with real examples for each function (engineers, data scientists, sales, finance, executives, legal).
• Explain the why: that trade secret protection depends on reasonable measures and that one careless paste can become an exhibit.
• Teach the reporting channel and the non-retaliation commitment for self-reports.
• Obtain signed or electronic certifications that the employee has read the policy, will use approved tools only, and has disclosed any company information in personal AI accounts.
• Train contractors before granting access.
• Refresh annually and on material policy change; keep completion records retrievable for at least the limitations period plus the likely length of litigation. Note: The DTSA limitations period is three years from discovery under 18 U.S.C. § 1836(d).

Phase 9: Protecting AI assets as trade secrets

• Add AI assets to the register: model weights, fine-tuning datasets, curated training data, evaluation sets, system prompts, prompt libraries, and agent configurations.
• Restrict and log access to weights and checkpoints; encrypt at rest; record every copy and transfer; bind every host by contract.
• Protect datasets as compilations. Note: A compilation of public elements can be a trade secret; see Integrated Cash Management Services, Inc. v. Digital Transactions, Inc., 920 F.2d 171 (2d Cir. 1990).
• Keep valuable logic out of public-facing system prompts where possible; move it server-side.
• Monitor public-facing assistants for extraction attempts (requests to reveal instructions, role-play jailbreaks, repeated probing) and retain the evidence.
• Bind users by terms prohibiting attempts to extract prompts, weights, or training data, reverse engineering of the service, and automated harvesting. Note: Breach of those terms supplies "breach of a duty to maintain secrecy" under 18 U.S.C. § 1839(6); without terms, a user who coaxes out a prompt may argue it was readily ascertainable.
• Keep development-cost records (compute, labeling, engineering hours) to support value and avoided-cost damages.
• Decide what must be disclosed under transparency laws (for example, EU AI Act training-content summaries) and what stays confidential, and document the reasoning.
• Decide patent or secret for novel methods before any publication or open release. See Provisional Patent Applications: What They Protect, What They Do Not, and How to Keep the Priority Date.

Red flag: the open-weights surprise. Publishing a model's weights, even an "older" version, ends trade secret protection for what those weights embody. Releases should pass through the same review as any other publication of confidential technology.

Phase 10: Prompt-leakage incident response

• Triage within one business day: what was disclosed, to which tool, under which account and terms, when, by whom.
• Capture a record before deletion (export or screenshots) for the privileged investigation file.
• Contain: delete conversations and uploaded files; disable shared links; revoke connector permissions; for personal accounts, obtain deletion and a signed certification.
• Contact the vendor for business accounts to confirm deletion, training status, and any human review; for consumer accounts, use the vendor's deletion request channel and record the response.
• Assess the information: Tier 1 secret, third-party information, personal data, export-controlled data, privileged material?
• Issue a legal hold if the incident relates to a potential dispute, before further deletion. Note: Lost electronically stored information can support sanctions under Fed. R. Civ. P. 37(e).
• Check contractual notice duties to customers and partners and statutory breach-notification duties for personal data.
• Search for public exposure if a share link or public assistant was involved, and act fast. Note: Wide internet circulation can end secrecy; see Religious Technology Center v. Netcom On-Line Communication Services, Inc., 923 F. Supp. 1231 (N.D. Cal. 1995).
• Remediate and write a short incident report with findings and actions; file it with the program records.
• Integrate with the general plan. See the Trade Secret Cybersecurity Incident Response Checklist: A Practical Checklist.

Phase 11: Onboarding and departures

• At onboarding, obtain a certification that the new hire has brought no former employer's confidential information, including in personal AI accounts, chat histories, or saved prompts.
• Tell new hires not to use AI tools to recreate a former employer's materials from memory. Note: A new employer that receives misappropriated information faces its own liability under 18 U.S.C. § 1839(5).
• At departure, ask about AI accounts in the exit interview and obtain a written certification of deletion.
• Disable company AI accounts at departure and preserve their logs for a set period before deletion.
• Review DLP and AI tool logs for the departing employee's last 30 to 90 days, scaled to role and risk.
• Escalate red flags (bulk uploads, summarization of large document sets, personal-account activity) to counsel the same day. See the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.

Phase 12: Audit and litigation readiness

• Review the program quarterly in the first year, then at least annually: approved-tool users, blocked attempts, DLP events, incidents, training completion, exceptions.
• Re-check each vendor's terms on renewal and whenever the vendor announces changes; record the review.
• Repeat a short discovery sweep each year for shadow tools, extensions, and connectors.
• Assemble a reasonable-measures binder: policy versions, register (access-restricted), approved-tools register, vendor reviews, training records, certifications, incident reports, audit results. Note: A corporate witness under Fed. R. Civ. P. 30(b)(6) will be asked about all of it.
• Extend legal-hold procedures to AI tool logs, conversation histories, connector logs, and self-hosted model logs.
• Prepare protective-order language addressing whether parties may process the other side's confidential material with AI tools, under Fed. R. Civ. P. 26(c) and 18 U.S.C. § 1835.
• Review lawyers' own AI use against ABA Formal Opinion 512 (July 2024), including informed consent before client information goes into self-learning tools. See Legal Ethics in Practice: Conflicts, Confidentiality, Fees, and the Duty of Technological Competence.

Deadlines and recurring dates

Worked example: Brightwater's first pass

Brightwater's general counsel ran the twelve phases over ten weeks. Discovery found 31 employees using a consumer chatbot with company email addresses and one incident file (the customer sales extract). Classification put the forecasting models, feature-engineering code, and customer datasets in Tier 1. The company licensed an enterprise assistant with a contractual no-training commitment and 30-day retention for Tier 2 and Tier 3 work, chose a zero-retention API arrangement for an internal code-review tool restricted to non-Tier-1 repositories, and kept Tier 1 out of AI tools pending a self-hosted pilot. IT turned on tenant restrictions and blocked consumer AI domains; the first week's DLP logs showed 14 blocked pastes of feature-engineering code, each followed by a short conversation with the employee. The incident with the customer extract was closed with deletion, a certification, a vendor deletion request, and a notice to the customer under its contract, which the customer acknowledged without further action.

Six months later a competitor's sales deck described a "seasonality decomposition" uncannily close to Brightwater's. Counsel's first call was not to a litigator but to the records owner, who produced the binder: policy versions, the register entry for the decomposition method, access logs, and training certifications for every engineer who had touched it. Whatever happens next, Brightwater can prove the element that owners most often lose.

Common failure points

1. A policy with no approved tool, which guarantees shadow use.
2. Approving a tool by its marketing page instead of its contract and plan.
3. Tenant restrictions never enabled, so personal accounts of approved services remain open on company devices.
4. Permission-blind retrieval in internal assistants.
5. Agents with broad connectors and outbound actions, exposed to prompt injection.
6. Over-designation that dilutes Tier 1 and invites NLRA challenges.
7. Missing § 1833(b) notice in the new acknowledgment form.
8. No preservation step in the incident playbook.
9. AI assets left off the register, especially evaluation sets and prompts.
10. No records, so completed work cannot be proved.

This document is general information, not legal advice for any particular situation; the law, vendor terms, and technology change, and the facts matter.

Related Documents

Related Articles

• Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms: the doctrine behind each item.
• Trade Secrets in the Age of Remote Work and Cloud Computing: reasonable measures in distributed and cloud settings.
• Cybersecurity Incident Response and IP Protection: Preventing Trade Secret Loss During Data Breaches: when a security event becomes a trade secret loss.

Related Guides

• Building a Generative AI Use Policy That Protects Trade Secrets: A Practical Guide: the step-by-step narrative for these phases.
• Trade Secret Misappropriation Litigation Under the Defend Trade Secrets Act: A Practical Guide: where the binder gets used.
• Running a Clean Room Software Development Project: A Practical Guide: proving independent development.

Related Checklists

• Building a Trade Secret Protection Program Checklist: A Practical Checklist: the general program checklist this one supplements.
• Trade Secret Audit Checklist: A Practical Checklist: building and auditing the register.
• AI Vendor Procurement and Governance Checklist: A Practical Checklist: commercial review of AI vendors.
• Software Interoperability and Reverse Engineering Clearance Checklist: A Practical Checklist: clearing AI-assisted analysis of others' products.

Related Toolkits

• AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks: the templates for these tasks.
• Trade Secret Protection Toolkit: Building and Defending a Confidentiality Program: broader confidentiality forms.
• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: vendor and retention terms for biometric data processed by AI tools.