The moment every employer dreads

A large company calls an outside team to investigate a rumor that the finance chief has been pasting confidential numbers into a generative tool. Forensics confirms repeated use of the tool, including multiple instances where confidential financials were entered. The board is anxious, the CEO wants answers, and IT can only say there is a slim chance someone else used the login. That is the real world scene described in a recent investigator presentation and live role-play used at lawyer programs. 

What makes this scenario unsettling for employers is how ordinary the fact pattern is. No hacker, no ransomware, no external actor. Just an employee with a login and a deadline, doing something thousands of employees do every week without a second thought. 

The materials show board members pressing on fairness, methodology, and reputational risk, and they capture the familiar debate about whether to deliver a full written report in advance or an executive summary under privilege at the meeting.

Translation for leaders who own a budget and a P and L:this is not a tech problem. It is a business risk that touches trade secret protection, incident disclosure, insurance renewals, and internal control design. 

If you sell into regulated industries or are public, regulators and counterparties will want to see the paper trail that shows you had a plan, trained your people, and acted fast. Absence of that paper trail does not weaken your defense after the fact. It can be treated as evidence that the company had no operative policy at all, which converts one employee’s mistake into an organizational governance failure. 

What smart employers do in the first hour

• Preserve evidence without drama. Issue a litigation hold, pause automated deletion, and coordinate with counsel so interviews and work product stay within privilege. The Supreme Court’s Upjohn decision explains why privilege may extend to communications with corporate counsel during internal investigations. Use it, document it, and do not wing it. Privilege is not automatic and it is not retroactive. If counsel is brought in after the interviews have already happened, or after employees have been discussing the incident informally in Slack or email, you may have already created discoverable material that privilege cannot reach back and protect.
• Limit distribution. Brief the board in executive session with counsel present, and record who receives what, when. The investigator deck models this board prep choice, including the question of whether to hand out a full report or deliver a high level readout at the meeting. 
• Map the data. Identify exactly which systems, files, and vendors were touched. Treat prompts and responses as records. 
• Decide quickly how to communicate. For public companies, the SEC’s cybersecurity disclosure rules may require disclosure of certain material incidents, and it expects boards to describe oversight of cyber risk and management’s role. Your disclosure team needs facts, timelines, and a written rationale for any materiality call. 
• Protect trade secrets. If proprietary information was pasted into a consumer tool, you may have civil remedies under the Defend Trade Secrets Act, but act to preserve secrecy and pursue contractual rights with vendors.
  

Your boardroom playbook, without the jargon

The same investigator materials show the board asking four questions you will hear in every real meeting. If your team cannot answer these cleanly and consistently in the room, the board’s confidence in the investigation, and by extension in management, erodes fast. Each has a business answer.

• How did you reach the finding if there was a denial and shared credentials were possible?
  Answer: Preponderance of the evidence. Show logs that align timestamps, user activity, device IDs, and follow up conduct such as attempts to delete usage history. The sample fact pattern walks through exactly that alignment. 
• Did you interview everyone in the department?
  Answer: Not always necessary. Scope to the hypothesis, document why, and explain how you would expand interviews if new facts emerge. The board in the materials pushes for this, which is a predictable pressure point. 
• Should workload and staffing pressure change the discipline?
  Answer: Consider context, but do not excuse policy violations that create legal exposure. The deck surfaces this question verbatim, which is why your discipline framework must be written in advance. 
• How do we contain reputational risk?
  Answer: Involve communications early, coordinate with counsel, and keep privilege in mind. The materials flag this directly. 

Technical notes the investigator program gets right, and where employers need more

The investigator materials referenced above are built to train lawyers running an investigation, which means they are strong on courtroom-adjacent judgement calls but were never designed to cover the governance work a business needs before an incident happens in the first place.

What  the investigator materials nail: 

• Keep board communications concise.
• Keep board communications high  level, saving granular detail for counsel and the written record rather than the boardroom discussion. 
• Keep board communications privilege aware, meaning framed and delivered in a way that preserves the protections discussed earlier in this article.

What a business audience also needs:

• A written rule for large language model use. Your policy should specify which tools are permitted, what data is out of bounds, how prompts are logged, and who can approve exceptions. The NIST AI Risk Management Framework and its generative profile provide a current, credible backbone. A policy that only lives in an employee handbook that hardly anybody reads again after onboarding will not hold up as evidence of a real governance program. It needs a training record, an acknowledgement signature, and a review cycle tied to it. 
• A security control set for generative tools. Use vetted guidance, not vibes. OWASP’s GenAI Security Project and its current resources offer concrete risks and mitigations, and the project published a solutions reference guide update this month. The controls are only as good as enforcement. A policy that says confidential data cannot go into unmanaged tools means little without technical blocks, such as DLP rules or network-level restrictions, that make the violation harder to commit in the first place.  
• A playbook for vendor models. CISA and partners have joint guidance for deploying third party AI systems securely, and a dedicated advisory on securing data used to train and operate AI. Hand this to your IT and procurement teams. This is also where legal and IT need to be in the same room. Procurement often signs vendor agreements without confirming the data handling terms line up with what the security team assumed, and that gap is usually discovered during an incident, not before one. 
• A discipline and enforcement framework that has been decided before it is needed. Boards and regulators will ask what happens to an employee who violates the policy. If the answer is decided at the moment, case by case, it looks arbitrary and invites claims of unequal treatment. A framework set in advance, with room for context, is what actually protects the company when discipline is challenged. 

Action plan you can start today

• Update your acceptable use and confidentiality policies to say exactly which AI tools are approved, what cannot be pasted into them, and how violations are handled. Tie the policy to your trade secret program (expanded in next item).
• Audit your trade secret protections against AI exposure specifically. Confirm your vendor contracts address data retention and training use, review confidentiality and NDA language for gaps an AI tool can create, and make sure your incident response plan has a same-day step for trade secret exposure, not just a general breach response. This is the fastest way to find out before an incident, rather than during one, whether your protected information would actually hold up as a trade secret when challenged.  
• Stand up a simple register of AI use across the company. Owners, tools, data categories, and risk ratings mapped to the NIST framework. 
• Configure logging for prompts and outputs in approved tools, and block posting of protected data in unmanaged tools. Align your controls with OWASP GenAI resources. 
• Pre-write your board packet template for technology incidents. Include a decision tree for the SEC’s materiality and Form 8 K timing if you are public. 
• Run a tabletop. Use the CFO scenario from the investigator materials as your test case, then document lessons learned.
  

Why this matters even if you are not a tech company

Bad prompts become exhibits. That sentence is worth reading twice. Every prompt typed into an unmanaged AI tool is a permanent, discoverable record of what your company knew, when it knew it, and what it did next. 

Regulators, plaintiffs, acquirers, and insurers will ask for your policies, training records, logs, and privilege memos. You do not need a lab. You need governance that fits your scale and industry, and you need a response muscle that works on a Tuesday afternoon when your best people are busy.

How we help

We represent employers. We build practical policies, run investigations, prepare board-ready findings, and help employers manage disclosure work-streams and strengthen governance during technology-related investigations. We work from Austin and maintain offices in North Carolina, Wyoming, and Colorado.

If your leadership team wants a confidential briefing based on the issues discussed above, we’ll deliver it in plain English, with a practical checklist you can use the same day.

If you want us to adapt this into a one-page policy addendum for your approved AI tools and employee training, say the word. We will build it for how your organization actually works.