The Hidden Risk of Using ChatGPT at Work—Could Your Employees Leak Trade Secrets?

ChatGPT can help employees draft emails, analyze information, and complete tasks faster. But what happens when an employee copies confidential company information into an AI tool to get the job done? A seemingly harmless shortcut could expose sensitive business information, create contractual problems, or put valuable trade secrets at risk.

For businesses that rely on proprietary information to maintain a competitive advantage, understanding the legal risks of generative AI is becoming an important part of protecting the company.

Can Employees Accidentally Disclose Trade Secrets Through ChatGPT?

Yes, an employee could unintentionally disclose information that qualifies as a trade secret by entering it into an AI tool without proper authorization.

Imagine an employee asks ChatGPT to improve a sales proposal. To provide context, they upload the company’s customer database, pricing strategy, or confidential contract terms. The employee may have no intention of sharing that information with anyone outside the business, but the disclosure itself can create risks.

Trade secrets are not limited to inventions or complex formulas. They can include customer lists, manufacturing processes, pricing models, supplier arrangements, and other commercially valuable information that is not generally known and is reasonably protected as secret.

Under federal law, information generally must derive economic value from being secret and be subject to reasonable measures to maintain its secrecy to qualify as a trade secret. 

The important distinction is that using ChatGPT does not automatically constitute a trade secret violation. The legal implications depend on the information disclosed, the circumstances, applicable agreements, and how the AI service handles the data.

Does ChatGPT Use Confidential Business Information to Train Its Models?

The answer depends on the product, account type, and settings. OpenAI states that content submitted through personal ChatGPT services may be used to improve its models unless the user opts out. By contrast, data submitted through ChatGPT Business, Enterprise, and the API is not used for model training by default.

However, not using information for model training is not the same as guaranteeing that it is never stored, accessed, or processed. Businesses must also consider retention settings, account permissions, integrations, and applicable service terms. Companies should therefore avoid assuming that confidential information is safe to upload simply because an employee has disabled model training.

Can an Employee Violate an NDA by Using ChatGPT?

Potentially. A nondisclosure agreement (NDA), employment agreement, or other contract may restrict how employees use or disclose confidential business information.

If an employee enters protected information into an unauthorized AI service, that conduct could violate contractual obligations or company policies, depending on the agreement’s terms and the circumstances.

The consequences can extend beyond the employee. A business may face disputes with customers, suppliers, or partners if their confidential information is improperly disclosed. Whether a particular incident constitutes a breach requires a review of the relevant contracts, policies, and facts.

How Can Businesses Protect Trade Secrets When Employees Use AI?

Prohibiting all AI use may not be practical for businesses that depend on these tools to remain competitive. A better starting point is establishing clear rules about what employees can and cannot share.

Businesses should consider implementing an AI-use policy that identifies prohibited information, specifies which tools are approved, and explains when management authorization is required.

They should also review existing NDAs, employment agreements, confidentiality provisions, and information-security procedures to determine whether they adequately address AI-related disclosures.

Employee training is equally important. Workers need to understand that confidential information does not become public information simply because an AI tool can process it.

What Should You Do If an Employee Shares a Trade Secret With ChatGPT?

If a potential disclosure has already occurred, businesses should assess what information was submitted, which account and service were used, and whether the information was retained or shared through any additional features.

Preserve relevant records and seek legal advice before making assumptions about the extent of the exposure. Depending on the circumstances, legal counsel can help evaluate contractual obligations, trade secret protections, notification requirements, and appropriate next steps.

So, if your business uses AI tools, please don’t hesitate to contact one of our experienced attorneys at 305-570-2208. 

You can also contact our team directly at: arianna@ayalalawpa.com                               

Schedule a case evaluation online here.

[The opinions in this blog are not intended to be legal advice. You should consult with an attorney about the particulars of your case].