Shadow AI: What Happens When Employees Paste Confidential Data Into Public Tools

Your team is almost certainly using AI tools you never approved. Every prompt is a disclosure, and the legal consequences reach trade secrets, customer contracts, privilege, and your next due diligence review.

An engineer is stuck on a bug, so she pastes a block of proprietary code into a free AI tool to debug it. A salesperson uploads a customer list to get help drafting outreach. A founder pastes a term sheet and a few paragraphs of advice from counsel into a chatbot to "make sense of it." An operations lead turns on a free AI notetaker that joins customer calls.

Nobody in those examples is acting in bad faith. They are trying to work faster with tools that are free, fast, and a browser tab away. The problem is that none of those tools were reviewed, none of those uses were covered by a policy, and none of that information was ever meant to leave the company.

This post explains what shadow AI is, the four legal exposures it creates, why banning AI usually fails, and what a practical, defensible approach looks like for a startup that wants its people using AI without giving away what makes the company valuable.

What shadow AI is, and why it's everywhere

Shadow AI is the use of AI tools by employees, contractors, or founders without the company's knowledge, review, or approval. It looks like personal accounts on consumer chatbots, free-tier tools, browser extensions, AI meeting bots, and AI features switched on inside software the company already uses.

It spreads for the same reason shadow IT always has. The tools are useful, the friction is low, and nobody asked the team to wait for a policy. Early-stage companies are especially exposed. Teams are small, speed is the priority, and the person making the decision to paste something into a prompt is often a founder or senior engineer with access to everything.

The legal question is not whether people should use AI. They should. The question is what happens to the company's information when they use tools the company has not evaluated.

The four exposures

1. Trade secret protection

Trade secret law protects information that has value because it is not generally known and that the owner takes reasonable measures to keep secret. Both halves matter, and the second is where shadow AI causes damage.

When an employee enters proprietary code, model architecture, pricing logic, or customer insights into a consumer AI tool, the information goes to a third party operating under its own terms. Depending on those terms, the provider may retain inputs, have staff or contractors review them, or use them to improve its models. Whether a particular disclosure destroys secrecy is fact-specific, and one prompt does not automatically end protection. But a pattern of uncontrolled sharing with unvetted third parties undercuts the argument that the company took reasonable measures, which is the argument you need if you ever have to enforce your rights against a departing employee or a competitor.

The same logic applies in reverse. A company that can show it vetted its AI tools, limited what could be shared, and trained its team is in a much stronger position than one that never asked.

2. Customer and partner confidentiality

Most commercial contracts restrict what you can do with a counterparty's information. Customer agreements, NDAs, and data processing terms typically prohibit disclosure to third parties without permission, and they often require that any vendor touching the data be disclosed or approved in advance.

An employee who pastes customer data, a customer's source material, or a partner's confidential documents into an unapproved tool may be breaching those obligations, even if nobody intended harm. If the data includes personal information, privacy laws and contractual commitments about subprocessors and data transfers can add to the exposure. If it includes regulated data such as health or financial information, the stakes rise further.

This often surfaces in the worst place: a security questionnaire or audit in which the company is asked to confirm its controls over customer data and AI tools, and cannot answer accurately.

3. Attorney-client privilege

Privilege depends on confidentiality. Sharing privileged communications with a third party can waive it, and the same principle applies when the third party is an AI tool.

In United States v. Heppner, a federal judge in the Southern District of New York ruled that documents a defendant created using a consumer AI chatbot were protected by neither attorney-client privilege nor the work product doctrine. A central reason was that the consumer platform's terms did not provide the confidentiality privilege requires. The ruling also raised the concern that feeding advice received from counsel into a consumer tool can waive privilege over the underlying communication.

Heppner is one bench ruling on unusual facts, involving a criminal defendant, a consumer tool, and no attorney direction. Other courts have addressed AI use differently on different facts, and commentators generally read the decision as an application of settled confidentiality doctrine, not a new rule. It also does not say that enterprise tools used under counsel's direction fail the test. But the practical lesson for founders is straightforward: do not paste legal advice, litigation strategy, or privileged communications into consumer AI tools, and route legal questions through counsel.

4. Ownership and quality of what comes out

Shadow AI also affects what the company owns. Employees using unapproved tools to generate code, designs, or content may be using tools whose terms restrict commercial use, limit exclusivity, or leave ownership unclear. Unreviewed AI-generated code can introduce security problems or open-source license obligations nobody noticed.

This is the same ownership question investors raise when a startup says its product was built with AI, and it is much harder to answer when the company does not know which tools were used.

Why banning AI doesn't work

Many companies respond by prohibiting AI tools. It feels safe, and it rarely works.

People route around bans. If a tool saves an hour a day, employees will use it on a personal device or account, where the company has no visibility and no ability to apply controls. A ban can move the activity out of sight without reducing it.

A ban leaves legitimate use unmanaged. The company still needs the productivity gains, and its competitors are capturing them.

Silence looks like permission. If leadership has never addressed AI use, employees reasonably assume it is allowed.

The approach that works is an approved path: give people good tools with appropriate terms, make the rules short and clear, and make it easier to do the right thing than the risky thing.

What to look for in an approved tool

The difference between consumer and enterprise offerings is largely contractual, and it is where most of the risk reduction comes from. When reviewing a tool, compare:

Training on your inputs. Whether your data is used to train or improve the provider's models, and whether you can opt out by default.

Retention and deletion. How long inputs and outputs are stored, and whether you can delete them.

Human review and access. Who at the provider can see your data, and under what conditions.

Confidentiality commitments. Whether the terms contain enforceable confidentiality obligations, as opposed to a privacy policy that makes no such promise.

Data processing terms and subprocessors. Whether a data processing agreement is available and who else handles the data.

Administrative controls. Single sign-on, access management, audit logs, and the ability to restrict features.

Ownership of outputs. What the terms say about who owns outputs and whether commercial use is restricted.

Enterprise terms are typically stronger on these points, but not automatically. They still need to be read, negotiated where the use case warrants it, and configured correctly.

What to do

Find out what is actually in use. Survey the team, review single sign-on and OAuth connections, check expense reports and browser extensions, and ask directly. Frame it as a clean-up, not an investigation. People will tell you what they use if they are not afraid of being punished for it.

Sort your data into tiers. Define what may never be entered into an external AI tool, such as privileged communications, credentials and keys, trade secret crown jewels, regulated personal data, and third-party confidential information the contract does not allow you to share. Define what may be entered only into approved tools, and what is fine to use freely.

Approve and provision tools. Select a short list of vetted tools, set up business accounts, turn off training where available, set retention and access controls, and document your review of the terms.

Write a short policy people will read. One or two pages covering approved tools, prohibited data, review requirements for AI-generated code and content, and who to ask. Have employees and contractors acknowledge it, include it in onboarding, and make sure it fits with your confidentiality and IP assignment agreements.

Address AI meeting bots and notetakers specifically. They record and transcribe conversations, often with third parties. Recording and consent laws vary by state and country, and customer contracts may restrict recording or transcription.

Extend the rules to contractors and vendors. The people handling your data are not all employees. Contractor agreements and vendor terms should restrict the use of AI tools with your confidential information.

Add technical guardrails. Where practical, use data loss prevention tools, secrets scanning in code repositories, and access controls that limit what can be copied out.

Keep privileged matters out of consumer tools. Route legal questions to counsel. If the company wants to use AI in legal work, set it up deliberately, with enterprise terms and counsel's involvement.

Have an incident process. If sensitive information was entered into an unapproved tool, preserve records of what was shared and when, request deletion where the provider allows it, review whether contracts or laws require notice to customers or regulators, and document the response.

Keep records. The policy, the training, the approved tool list, and the incident log are the evidence that your measures were reasonable. They are what you will want if you ever enforce a trade secret claim or answer a diligence question.

How investors and customers will see it

Shadow AI has become a standard question in diligence and enterprise sales. Investors ask whether the company has an AI use policy, which tools are approved, and what controls protect proprietary and customer data. Enterprise customers ask the same questions in security reviews and sometimes require contractual commitments about AI use.

A company that can answer clearly and show documentation looks like it has operational control. A company that discovers the answer during the questionnaire looks like it has exposure it has not measured. Founders should also remember that they are part of the population. Board materials, investor updates, legal documents, and strategy memos are among the most sensitive things a company produces, and they are frequently the things senior people paste into a chatbot.

Frequently asked questions

Does pasting something into an AI tool automatically destroy trade secret protection?

No. The analysis depends on the tool's terms, what was shared, who could access it, and what other protective measures the company has in place. But uncontrolled sharing with unvetted third parties weakens the argument that you took reasonable steps to keep information secret, so it should be treated as a real risk.

Are enterprise AI tools safe to use with confidential information?

They generally offer stronger contractual protections than consumer tools, but they are not automatically safe. Review the terms on training, retention, access, and confidentiality, configure the settings properly, and confirm that the use is consistent with your customer contracts.

Can we just ban AI tools?

You can, but bans are hard to enforce and often push usage into personal accounts where you have no visibility. A better approach is to approve specific tools, set clear data rules, and train the team.

Do we have to tell customers if an employee put their data into an unapproved tool?

It depends on your contracts and the type of data involved. Some agreements and privacy laws require notice of unauthorized disclosures or changes in subprocessors. Review the relevant terms and get legal advice promptly, because notice deadlines can be short.

Does Heppner mean AI conversations are never privileged?

No. It was a narrow ruling on specific facts, involving a consumer tool whose terms did not promise confidentiality and no direction from counsel. Courts may reach different results with enterprise tools or where counsel directs the use. The safe practice is to keep privileged communications out of consumer tools and to involve counsel before using AI for legal work.

What about employees using personal accounts on personal devices?

That is the hardest case to control. A clear policy, training, approved alternatives, and agreements that cover confidential information are the main tools. Monitoring personal accounts raises its own legal and privacy issues, so the approach should be reviewed before it is put in place.

Do the rules apply to founders and executives?

Yes, and they matter most there. Executives tend to have access to the most sensitive information and are the most likely to move quickly without checking the tool's terms.

AI tools are not going away, and a company that stops its team from using them gives up speed it cannot afford to lose. The companies that handle this well don't rely on good intentions. They decide in advance what can be shared, with which tools, and what the record will show if someone asks later. If you want to put an AI use policy, approved tool review, and confidentiality controls in place before your next raise or enterprise deal, contact Ana Law to schedule a strategy session.