Pasting a contract, a price list or a block of source code into a chatbot takes seconds. For the employer, the question is whether that information is still protected afterwards. For the worker, it is whether they have broken a duty. Trade secret law answers both, and it is the same law in the EU and the US whether the leak is to a competitor or to an AI tool. This page sets out the rules from the EU Trade Secrets Directive and the US Defend Trade Secrets Act, for employers and workers. For the day to day habits, see is it OK to use AI at work?
The short answer: information is only a trade secret if its holder has taken reasonable steps to keep it secret. An employer that lets staff put confidential material into unapproved AI tools, with no policy or controls, weakens its own case. A worker who discloses a trade secret in breach of a confidentiality duty can be acting unlawfully. Both regimes protect workers who disclose information to report wrongdoing.
What counts as a trade secret
In the EU, a trade secret is information that is secret, in that it is not generally known among or readily accessible to people who normally deal with that kind of information; has commercial value because it is secret; and has been subject to reasonable steps under the circumstances to keep it secret (Directive (EU) 2016/943, Article 2(1)).
The US definition is similar. Financial, business, scientific, technical, economic or engineering information, including programs and codes, is a trade secret if the owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known or readily ascertainable (18 U.S.C. 1839(3)).
The common thread is the reasonable steps test. Whether an AI tool keeps, reuses or trains on what is typed into it depends on its terms and settings, so an employer's choice of approved tools, and its rules on what may go into them, become part of the evidence that it protected its secrets.
When a worker's disclosure is unlawful
Under the Directive, using or disclosing a trade secret without the holder's consent is unlawful when done by someone in breach of a confidentiality agreement or any other duty not to disclose it, or in breach of a duty to limit its use (Article 4(3)). Acquisition is unlawful where it involves unauthorised access to or copying of electronic files containing the secret (Article 4(2)(a)). Under US federal law, the owner of a misappropriated trade secret can sue for an injunction and damages, with exemplary damages of up to twice the award for wilful and malicious misappropriation; the claim must be brought within 3 years of when the misappropriation was or should have been discovered (18 U.S.C. 1836(b) and (d)).
What the law does not take from workers
- Skills and experience: the Directive gives no ground to limit employees' use of information that is not a trade secret, or of experience and skills honestly acquired in the normal course of employment (Article 1(3)). Knowing how to use AI tools well is a skill you keep.
- Information and consultation: acquiring information through workers' or their representatives' rights to information and consultation is lawful (Article 3(1)(c)), and disclosure by workers to their representatives where necessary for their functions is an exception (Article 5(c)).
- Revealing wrongdoing: claims must be dismissed where the disclosure was for revealing misconduct, wrongdoing or illegal activity, for the purpose of protecting the general public interest (Article 5(b)). See raising concerns about workplace AI.
- US whistleblower immunity: an individual is not liable under any federal or state trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a court filing made under seal (18 U.S.C. 1833(b)).
A notice duty US employers often miss
An employer must give notice of that immunity in any contract or agreement with an employee that governs the use of trade secrets or other confidential information, or cross-refer to a policy document that sets out its reporting policy. If it does not, it cannot be awarded exemplary damages or attorney fees against that employee under the federal claim. The rule applies to agreements entered into or updated after it was enacted in May 2016, and contractors and consultants count as employees for this purpose (18 U.S.C. 1833(b)(3) and (4)). An AI use policy that adds confidentiality terms is a good moment to check the notice is there.
Practical steps
- Employers: mark what is confidential, approve specific AI tools for specific kinds of data, check each tool's terms on retention and training, and put the rule in writing. Train staff on it and keep a record that you did. That is the evidence of reasonable steps.
- Employers: in the US, include the section 1833(b) notice in confidentiality agreements and policies.
- Workers: before pasting anything into an AI tool, ask whether it is confidential and whether the tool is approved for it. If unsure, leave it out or ask. See how to use AI at work.
The Directive is implemented by each EU country in its own law, so check the national rules that apply. This page is general information, not legal advice.
Questions and answers
Does putting confidential information into an AI tool destroy trade secret protection?
Not automatically, but protection depends on the holder having taken reasonable steps to keep the information secret. Uncontrolled use of tools that retain or reuse inputs makes that harder to show.
Can an employee be liable for pasting trade secrets into a chatbot?
Under the EU Directive, disclosure or use in breach of a confidentiality agreement or duty is unlawful. In the US the owner can bring a federal civil claim for misappropriation. The outcome depends on the facts and the duties that applied.
Can my employer stop me using AI skills I learned at work in a new job?
Not on trade secret grounds alone. The EU Directive says it gives no ground to limit the use of experience and skills honestly acquired in the normal course of employment.
What is the 1833(b) notice?
A US federal rule that employers must tell employees, in agreements governing confidential information, about immunity for confidential disclosures to government officials or attorneys to report suspected violations of law. Without it, employers lose exemplary damages and attorney fees in a federal claim against that employee.