Generative AI has quickly become a routine workplace tool, but its convenience creates a new problem for companies that require trade secret protection. Employees may inadvertently expose sensitive company information through public or unapproved AI tools, while AI developers increasingly rely on trade secret and contract law to protect proprietary models and systems from extraction or reverse-engineering efforts.
Trade secret law gives companies a way to protect valuable, confidential business information. Under the federal Defend Trade Secrets Act and state trade secret laws, information generally qualifies as a trade secret if it derives economic value from not being generally known or readily ascertainable and the owner has taken reasonable measures to maintain its secrecy. Each element of that definition matters, but for companies using generative AI, the “reasonable measures” requirement is especially important.
One risk posed by generative AI is that employees may enter sensitive company information into public or unapproved AI tools. Employees may not recognize that the information is confidential, that the platform may retain and use it or that the interaction could later become relevant in litigation. Those risks are greatest when employees use public or personal AI tools outside approved company systems, known as shadow AI. While companies may not be able to eliminate every AI-related risk, they should be prepared to demonstrate reasonable measures to protect confidential information through policies, training, technical controls and approved platforms with appropriate confidentiality protections.
Another developing issue is whether, and under what circumstances, an AI system can make proprietary information more readily ascertainable. Prompt injection and model-extraction disputes illustrate the problem. If a user can induce a system to reveal proprietary prompts, model logic or information drawn from confidential inputs, courts may need to decide whether the information remained sufficiently secret, whether the user employed improper means and whether the system owner took reasonable measures to prevent disclosure. The answer may depend on whether the user obtained information through ordinary interaction with a public system or by bypassing safeguards, using deception or otherwise manipulating the system.
Where Courts Stand on Trade Secrets and Generative AI
Courts have not yet clearly addressed the full implications of trade secret risks associated with generative AI, nor have they developed a consistent body of law addressing how the reasonable-measures requirement applies to employee use of generative AI tools.
Although direct case law remains limited, courts and commentators are beginning to coalesce around similar themes: AI-related disclosures may create real risk for trade secret protection. Governance and the question of whether a company took “reasonable measures” to protect its trade secrets will likely be the key battleground. An opposing party could cite unmanaged AI use as evidence that the company failed to take reasonable measures to maintain secrecy. The analysis is likely to focus less on the technology itself and more on the policies, controls and contractual protections governing employee AI use.
In January 2026, a judge in the U.S. District Court for the Northern District of California addressed the reasonable-measures element of trade secret protection in the context of generative AI in Trinidad v. OpenAI. In that case, a pro se plaintiff alleged that she developed proprietary “protocols” and “frameworks” through her interactions with ChatGPT, that they were protected by the Defend Trade Secrets Act and that OpenAI later misappropriated those ideas. The court dismissed her claim, reasoning that developing the alleged trade secrets through ChatGPT meant she had voluntarily disclosed them to OpenAI and did not plausibly take reasonable measures to maintain their secrecy.
Although factually unusual, Trinidad is a useful reminder that entering confidential information into a public generative AI tool will likely invite arguments that the information was not reasonably protected.
Practical Steps for Protecting Trade Secrets
While it remains to be seen how generative AI will affect trade secret protection in the long term, companies do not need to ban generative AI altogether to protect their confidential information. However, they should be able to show that employee AI use is governed by clear rules, appropriate contracts and meaningful technical controls. Fortunately, there are several practical steps companies can take to reduce the risk stemming from employees disclosing sensitive information through AI tools, including:
- Adopting a written AI-use policy: Companies should update employee handbooks or adopt a standalone AI-use policy that identifies which AI tools are approved, which uses are prohibited, and what categories of information may never be entered into public or unapproved tools. The policy should specifically address source code, customer lists, pricing information, product designs, business strategies, financial data, personal information, and other confidential or proprietary materials.
- Defining “approved tools” with precision: It is not enough to tell employees to use AI responsibly. Companies should identify the specific enterprise tools and accounts approved for company work and employees should be prohibited from using personal accounts or free public AI tools for company business unless expressly authorized.
- Training employees using concrete examples: Training should give employees practical examples of risky conduct, such as pasting confidential meeting notes into an AI summarization tool, uploading contracts for review, asking a chatbot to debug proprietary code or using AI to analyze nonpublic customer data. This helps employees understand that even well-intentioned use can create legal risk.
- Reviewing AI vendor contracts and terms of use: Before approving an AI platform, companies should review whether the vendor may retain inputs, use prompts or uploaded files for model training, share data with third parties, or restrict deletion. Contracts should include confidentiality obligations, limits on data use, restrictions on training with company data, security commitments, audit rights where appropriate, and clear deletion and retention terms.
- Using technical controls to reduce shadow AI: Policies are strongest when paired with controls. Companies may consider blocking access to public AI tools from company devices, restricting browser extensions, monitoring for uploads of sensitive files, requiring single sign-on for approved tools, and using data-loss prevention tools to prevent confidential information from being copied into unapproved platforms.
- Documenting the company’s reasonable measures: Because trade secret disputes often turn on whether the company took reasonable steps to protect the information, companies should maintain records of their AI policies, training attendance, vendor reviews, access controls and enforcement efforts. That documentation may become important if a later defendant argues that public or unmanaged AI use undermined trade secret protection.
Generative AI can improve efficiency, but unmanaged use can also threaten trade secret protection. Courts have not yet developed clear AI-specific rules, but an opposing party may use public or unapproved AI use to argue that a company did not take reasonable measure to protect its information. Companies can reduce that risk through clear policies, targeting training, approved platforms, careful vendor terms, technical controls and documented enforcement.