The use of AI in the workplace can increase compliance and legal risk for employers, says Gillian McKean Bidgood of Polsinelli. As she writes, prepare now or find out in court later.
Since 2023, polls have reflected a steady increase in the number of people reporting that they use AI at work. Polls also consistently indicate that some of the highest use of AI is among company leaders.
These trends present employers with a variety of legal risks and litigation difficulties.
The intellectual property and employment law risks should be considered in deciding what uses to allow and in creating AI governance policies. AI evidence impacts investigation and discovery, but companies can implement steps to prepare.
Intellectual property risks
It is well-recognized that some of the most significant legal risks connected with employee AI use relate to intellectual property rights. Employees can disclose trade secrets and interfere with patent, copyright or trademark efforts by uploading materials into AI tools.
Disclosure by uploading information into AI that is not sufficiently limited can risk breaches of compliance obligations, violate privacy rights, and violate confidentiality agreements. Moreover, incorporation of AI-generated material into work products can compromise the ability to protect the materials under intellectual property law.
In recognition of those risks, companies are investing significantly in closed enterprise AI tools. Further, surveys reflect that the vast majority of companies have adopted policies governing which AI will be used and establishing parameters for employee AI use. However, these efforts are potentially countered by the significant number of employees admitting to use of shadow AI, or use cases and tools not sanctioned by the employer.
Compliance & Risk Lessons From AI’s Unruly Summer
The past several months have seen Anthropic go dark & OpenAI’s models slip into Hugging Face’s systems, signaling that AI risk is increasingly fluid
Read moreDetailsEmployment-law risks
An employee could use AI in a variety of ways that could violate employment laws. For example, a hiring manager could use an AI tool to make hiring decisions in violation of laws prohibiting use of AI in employment decisions or in violation of notice, validation and recordkeeping obligations established by laws against algorithmic discrimination.
Notably, leaders are using AI to role play critical conversations with employees and get advice on how to manage a particular employee. Such uses can happen quickly and without intentional implementation by an employer, increasing the risk of noncompliance with algorithmic discrimination and other employment laws when the chat leads to adverse employment actions or other actions potentially creating liability. Further, even if employment laws are complied with, such uses could create records that could be relevant to internal investigations or employment disputes. Specifically, the prompts and conversations could be sought after as potential evidence of the leader’s intentions or motivations.
Courts have already addressed discovery disputes concerning AI interactions. Those courts have treated AI interactions as subject to discovery just like any other business record. Some employers may not wish for leaders to use AI for such purposes because the materials might be misinterpreted. For example, a supervisor could prompt an AI tool to draft disciplinary talking points and specify that the points must not sound retaliatory. The supervisor may have generated the prompt based on HR training about the risk of retaliation claims from employees. However, opposing counsel might interpret the prompt as evidence that the supervisor was retaliating and was seeking help escaping liability. Resolving those differing interpretations could be difficult and make it difficult to resolve a dispute.
In some cases, leaders may ask AI for legal analysis. Unlike communications with legal counsel, those interactions are unlikely to be protected by attorney-client privilege if sought in discovery. However, the chat and the actions that the leader takes after the chat could reveal underlying motivations and the leader’s understanding.
Additional risks arise from the use of AI notetakers or transcribers in meetings and investigations. Errors in the product generated by these tools could lead to legal claims based on either the contents of the AI work product or decisions made in reliance on the AI-generated materials. Although they are often implemented in order to increase efficiency or in hopes of creating more neutral records of the discussions, the AI-generated materials may create new risks or generate undesirable records.
However, if a company deletes AI generated material because the material is harmful to the employer’s position, the destruction could subject the employer to a request for sanctions for spoliation of evidence. Also important, the recording of the conversation that the AI tool uses to create the material could be stored by the vendor outside of the control of the employer and therefore would survive the deletion of the AI generated material. While many vendors assure users that such recordings are destroyed, an employer’s ability to confirm destruction is limited. This means that even if an AI generated summary does not include content from the conversation that could be problematic for the employer, there is a risk that the recording itself could be obtained and would include the problematic content. Accordingly, a company that wishes to avoid recordings of all or certain conversations must prevent the use of notetakers and summarizers in those conversations.
The use of agentic or autonomous AI in company operations also poses employment risks. For example, AI trained under a particular state’s law to request documentation when a sick leave request is submitted could violate another state’s prohibition on requesting such documentation. Additionally, employers could face employment law risks if agentic AI is used to assign work to employees without human oversight and sufficient information about important matters like employee accommodations for disabilities or workflow changes necessitated by an employee harassment complaint.
Access & discovery
Companies have a variety of strategies available to prepare for AI in investigation and discovery. Many AI tools have features permitting either administrators or users to retrieve prompts and histories. Some tools, however, require that such functions be activated prior to the interactions to be retrieved. In the event that an employer does not activate the function prior to the interactions at issue, the information may not be accessible, at least without assistance from the vendor, either voluntarily or under subpoena.
Similarly, incomplete adherence to AI governance policies and shadow AI can create significant obstacles to companies in ensuring that they are able to access AI interactions for investigation or discovery. That is, an employee could use an unsanctioned AI tool that does not have a retention period that matches company and legal requirements. Further, shadow AI use often involves use of personal accounts. In those cases, the employer would be required to obtain the information from the employee voluntarily or via subpoena. Employers should also be aware that even sanctioned AI tools may permit users to delete histories, exposing companies to the risk of missing records or spoliation accusations.
To address these issues, vendors have created AI monitoring tools that can capture prompts and uploads in AI tools. While these tools increase the likelihood of capturing AI interactions, shadow AI usage that does not occur on a company device still would not be captured.
In addition to technical tools, employers are evaluating revising litigation holds to specifically refer to preservation of AI interactions. Additionally, employers are considering revising employee agreements to prohibit use of non-enterprise AI without permission and confidentiality agreements to prohibit uploading confidential and other sensitive information into non-enterprise AI. Further, employers are evaluating whether AI governance policies adequately establish retention settings and data accessibility requirements that must be retained for authorized tools.
What companies can do
AI use among employees and especially leaders poses intellectual property and employment law risks for companies. Companies can address these risks by clearly delineating which uses are permitted and monitoring for Shadow AI usage, and companies can prepare for the increased importance of accessing AI interactions by ensuring that the tools in use have sufficient retention periods, allow efficient access and only retain the intended materials.
Gillian McKean Bidgood chairs the labor & employment department at Polsinelli in Denver. She advises clients on matters relating to employment and independent contractor agreements, noncompete and non-solicit covenants, employment policies and handbooks, workplace investigations, employee discipline, wage and hour issues, severance agreements and other employment-related issues. 
