Here is the gap this article is about. In Microsoft and LinkedIn's 2024 Work Trend Index (31,000 workers in 31 countries), 75% of knowledge workers said they use AI at work — and 78% of those AI users bring their own tools. IBM and Ponemon's 2025 breach study found one in five breached organizations had been hit through "shadow AI" — AI use the company never approved — and that companies with heavy shadow AI paid on average $670,000 more per breach. KPMG's 2025 global survey (more than 48,000 respondents) found almost half of employees admitting to using AI in ways that break company policy, including uploading sensitive information to free public tools.
So the question is not whether AI is inside your company. It is whether your IT, your policies, and your people's training are ready for the fact that it is. The record so far — leaks, rulings, sanctions, and one very expensive video call — says most companies are not. What follows is that record, and then what to do about it.
The leak: your trade secrets, pasted into a chatbot
In April 2023, Samsung engineers pasted internal source code into ChatGPT — checking code, converting defect code, and transcribing a meeting — within weeks of the tool being allowed. Bloomberg reported the company's response on May 2, 2023: generative AI banned on company devices and internal networks, with discipline up to termination, after an internal survey found 65% of staff saw the tools as a security risk. Apple, JPMorgan, Amazon, and Verizon restricted employee use in the same period.
The deeper problem is legal, not just operational. A trade secret stays a trade secret only while its owner takes reasonable measures to keep it secret. Lawyers who advise on this (Reinhart Boerner Van Deuren's guidance is a clear example) warn that entering confidential material into a public AI tool can be treated as voluntary disclosure — the legal equivalent of leaving the vault open — and can defeat a future trade-secret claim. No court has decided that exact question yet, and this article won't pretend otherwise. But a February 2026 federal ruling in U.S. v. Heppner shows the direction of travel: documents a defendant ran through a consumer AI tool were held not privileged, because the provider's own privacy policy defeated any reasonable expectation of confidentiality. What you type into a consumer AI tool is, legally, something you said out loud in someone else's building.
Your AI speaks for you — and you own what it says
In Moffatt v. Air Canada (February 2024), the airline's website chatbot invented a bereavement fare policy: book now, claim the discount retroactively. Air Canada argued the chatbot was a separate legal entity responsible for its own statements. The British Columbia Civil Resolution Tribunal called that "a remarkable submission," found negligent misrepresentation, and ordered the airline to pay. It is a small-claims tribunal decision (C$650.88), not a precedent binding on other courts — but no company has yet found a court willing to accept "the AI said it, not us" as a defence.
The cheaper versions of the same lesson are reputational. In December 2023, a Chevrolet dealership's chatbot was talked into agreeing to sell a Tahoe for $1 — "legally binding, no takesies backsies." The deal was not honoured and no liability followed; the bot was pulled and the screenshots are forever. In January 2024, DPD disabled its customer chatbot after a frustrated customer got it to swear and to denounce DPD as "the worst delivery firm in the world." In each case the company deployed a system that spoke in its name, with no effective limit on what it could say.
Professionals are personally on the hook
In Mata v. Avianca (June 2023), two New York lawyers submitted a brief citing cases ChatGPT had invented, then stood by the citations after the court questioned them. The judge sanctioned the lawyers and their firm $5,000 (jointly), and ordered letters to their client and to the real judges whose names had been attached to fake opinions. It was not a one-off: a federal appeals court referred a lawyer to a grievance panel in Park v. Kim (2024), and in July 2025 three lawyers at a national firm were publicly reprimanded and disqualified in Johnson v. Dunn after filing five fake AI-generated citations. Notably, their firm was not sanctioned — reporting on the case credits the firm's AI policy and its warnings to staff. Policy, it turns out, is not paperwork. In a sanctions hearing, it is the difference between the individual and the institution taking the fall.
Fraud has a new face
In February 2024, Hong Kong police described a finance worker who was invited to a video call with his company's CFO and colleagues — and, initially suspicious, was reassured because everyone on the call looked and sounded right. Every other person on the call was a deepfake. He made 15 transfers to five accounts totalling about HK$200 million (roughly $25.6 million). The engineering firm Arup later confirmed it was the victim; its CIO noted its systems were not compromised — the person was the vulnerability. A similar deepfake attempt on the CEO of WPP followed in May 2024 and failed. Your payment controls either assume a familiar face on a screen can be fabricated, or they are already obsolete.
The regulators are not waiting
- Securities. In March 2024 the SEC charged two investment advisers — Delphia ($225,000) and Global Predictions ($175,000) — for "AI washing": claiming AI capabilities they did not have. Marketing your AI is a regulated act.
- Consumer protection. The FTC's "Operation AI Comply" (September 2024) swept up, among others, DoNotPay ($193,000) for claiming its "robot lawyer" could substitute for a human attorney.
- Employment. The EEOC's first AI settlement (2023) cost iTutorGroup $365,000 after its hiring software automatically rejected older applicants — a hard-coded age cut-off, crude as discrimination gets — with five years of monitoring. New York City's Local Law 144 now requires a bias audit within a year before using automated tools in hiring, a public summary of results, and notice to candidates, enforced since July 2023. And Mobley v. Workday — a claim that a vendor's AI screening tools discriminated — survived dismissal and was certified as a conditional collective action in May 2025. It is ongoing; no court has found discrimination. Treat it as exposure, not verdict.
- Copyright. In Thomson Reuters v. ROSS (February 2025, affirmed by the Third Circuit in September 2026), a court rejected a fair-use defence for training a competing legal-research AI on Westlaw headnotes — the first appellate ruling on AI training. Both courts stressed the limits: a non-generative system, built by a direct competitor, after a licence was refused. The New York Times case against Microsoft and OpenAI is still pre-trial. The honest summary for your planning: the law of training data is being written now, case by case, and "everyone does it" is not a legal position.
Defense companies: the same mistakes, with federal consequences
Everything above applies to any company. Defense contractors carry a second layer, and it is not optional.
The data is different — and it comes in classes that carry different rules. Federal Contract Information (FCI) is information provided by or generated for the government under a contract and not meant for public release; it is protected at the basic level (FAR 52.204-21; CMMC Level 1). Controlled Unclassified Information (CUI) — including controlled technical information — carries the heavier regime described next. Export-controlled technical data is a third class again, governed by ITAR or the EAR rather than the CUI rules, and it is the subject of the paragraph after this one. Under DFARS 252.204-7012, a clause in most defense contracts, you must safeguard covered information to the NIST SP 800-171 standard (110 requirements; Revision 2 remains the enforceable version), report cyber incidents to the DoD within 72 hours, and preserve evidence. If a cloud service stores or processes that data, it must meet FedRAMP Moderate equivalency. A consumer chatbot meets none of this.
One paste can be two violations. Pasting export-controlled technical data into a commercial AI service risks treatment as an unauthorised export under ITAR or the EAR — the service's servers and personnel may be foreign, and the input may enter a training pipeline. No regulator has yet brought an enforcement case on exactly that fact pattern; practitioners across the export bar describe the exposure in those terms, and waiting for the first case to find out is a strategy only if it's someone else's company. The same paste can also become a reportable cyber incident on the 72-hour clock if covered information left your boundary.
The certification clock is running — read the current version. CMMC 2.0's programme rule took effect in December 2024 and the contract rule in November 2025, so Phase 1 (self-assessments for Level 1 and Level 2 in new contracts) is live now. Phase 2 — third-party certification — was suspended in July 2026 by a DoW CIO memo pending review, with no replacement date published as of this writing. Anyone selling you a Phase 2 deadline today is working from a stale calendar; anyone telling you CMMC went away is wrong about Phase 1 and DFARS 7012, which never paused.
DoD has already answered "which AI may we use?" The Department's own workforce runs on GenAI.mil, launched December 9, 2025 — tools certified for CUI at Impact Level 5, with free training attached; the Navy mandated its use in January 2026, and by August 2026 the platform reported 1.7 million unique users. Ask Sage provides another approved route (FedRAMP High, IL5/IL6). DoD's Task Force Lima warned in its final summary of exactly the failure mode in this article — "inadvertent spills through employee queries to commercial and unsecured GenAI services" — and urged scaling the secured platforms. There is no DoD-wide memo that says "never open a public chatbot"; there doesn't need to be. The architecture is the rule: controlled data goes only into environments certified for it.
And the honest gap: we searched for a documented case of a defense contractor actually caught leaking controlled data through an AI tool — an enforcement action, a consent agreement, an inspector-general report. We did not find one. The nearest case is adjacent, not defense: in summer 2025, the acting head of CISA reportedly uploaded "For Official Use Only" contracting documents to public ChatGPT, where internal sensors flagged them; CISA disputes the characterisation. Read the absence correctly: it means the first defense case hasn't been published yet — not that the conduct isn't happening. KPMG's finding that almost half of employees admit to policy-breaking AI use was not limited to the commercial sector.
What ready looks like
Readiness is not a ban — Samsung's ban bought time, but blanket bans mostly drive use underground, which is how shadow AI happens. The frameworks converge on the same shape (NIST's AI Risk Management Framework and its 2024 Generative AI Profile; CISA and partners' 2026 guidance on adopting agentic AI):
Policy
- An approved-tools list, with a sanctioned alternative inside the right boundary — for defense work, a platform authorized for the data it will hold (Impact Level 5 where the work involves CUI handled at that level); for everyone else, an enterprise agreement with no-training, retention, and audit terms. A list of prohibitions with no legal way to do the task is how you get 78% bring-your-own.
- Data-classification rules written for the moment of use: what may never be pasted (source code, customer data, CUI, anything export-controlled), what may, and a lookup a busy employee can actually check.
- A human-verification rule with teeth: nothing an AI drafted gets filed, sent, signed, or paid without a named human checking it against sources. Mata and Johnson are what happens without one.
- Payment controls rebuilt for deepfakes: out-of-band confirmation and dual authorisation for transfers, because the person on the video call may not be a person.
- Contracts that push the same discipline to your vendors and flow the requirements down — in defense work, DFARS already expects this of you.
Training
- Role-specific, not generic: engineers on IP and code, lawyers and anyone who files on citation verification, HR on hiring-tool law, finance on synthetic-media fraud, everyone on what never goes into a public tool.
- A note on frequency: no authoritative source mandates a specific cadence, and any vendor who tells you "annual training" is a legal requirement is inventing it. Train at hiring, at tool rollout, and after incidents — yours or the ones in this article.
Technology
- An enterprise AI gateway or approved platform so use is visible; data-loss-prevention and browser controls on consumer AI domains; per-user logging (IBM/Ponemon: 97% of organizations breached through AI lacked AI access controls).
- Limits that live outside the model: a customer-facing AI with hard output boundaries and human escalation, so a clever user can't negotiate your price list down to $1.
- Red-teaming before deployment and after major updates — including the quiet attacks: a source that tells your AI to stop checking other sources is an attack, as our own research run learned this month.
The short answer
Is your IT ready for AI? Check four things tonight: whether your people have an approved way to use AI inside the right boundary; whether your policy names what must never be pasted, in words an employee can apply in ten seconds; whether a payment in your company can still be released on the strength of a face on a screen; and whether anything your AI says to a customer could become your company's word in a hearing. If any answer is "we haven't decided," then AI is already in your building — the decision is just being made for you, one paste at a time.
Primary sources
The cases, rules, and studies this article relies on, at their origins:
- Moffatt v. Air Canada, 2024 BCCRT 149 (British Columbia Civil Resolution Tribunal).
- Mata v. Avianca, Inc., sanctions opinion, No. 22-cv-1461 (S.D.N.Y., June 22, 2023).
- Thomson Reuters Enterprise Centre GmbH v. ROSS Intelligence Inc., opinion of the U.S. Court of Appeals for the Third Circuit (2026): ca3.uscourts.gov.
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (acquisition.gov).
- U.S. Department of Defense, CMMC Phase 2 suspension announcement (July 2026), business.defense.gov.
- U.S. Securities and Exchange Commission, AI-washing enforcement actions: In re Delphia (USA) Inc. and In re Global Predictions, Inc. (March 18, 2024).
- U.S. Equal Employment Opportunity Commission, iTutorGroup settlement (August 2023).
- IBM and Ponemon Institute, Cost of a Data Breach Report 2025.
- Microsoft and LinkedIn, Work Trend Index 2024.
- KPMG, global AI survey 2025 (more than 48,000 respondents).
Tristen Pierson is Co-Founder & President of Axiovex Systems, a Michigan company building constraint-based planning for education, employment, and industry. Axiovex's own AI-security field guide — the prompt-injection whitepaper "Endorsed by Experts" — is free on our documents page.