Artificial intelligence is quickly becoming part of everyday business.
Employees are using AI tools to draft emails, summarize meetings, create marketing content, analyze information, prepare proposals, brainstorm ideas, and speed up administrative work.
For business owners, those tools can create real efficiencies.
They can also create legal and operational risks if employees begin using them before the business has decided what information may be entered, which tools are approved, how AI-generated work should be reviewed, and who is responsible when something goes wrong. At Obsidian Ridge Law, the concern is not whether businesses should use AI.
The better question is:
Has your business put enough structure around its use of AI to protect what you have built?
For Arizona business owners, now is a good time to answer that question.
Start With the Information Your Employees Are Entering
One of the easiest ways to use generative AI is to paste information into a tool and ask it to analyze, summarize, rewrite, or organize it.
But what exactly is being pasted into that system?
It could be:
- Customer information
- Internal financial data
- Employee information
- Contracts
- Pricing
- Business strategies
- Customer lists
- Proprietary processes
- Product information
- Passwords or credentials
- Confidential communications
An employee may view the AI platform as simply another work tool. Legally, however, the business should consider where that information is going and what the platform's terms allow the provider to do with it.
Before employees use an AI tool for business purposes, someone should understand the tool's privacy terms, data-retention practices, account settings, and whether information submitted to the platform may be retained or used for other purposes.
The Federal Trade Commission has specifically recognized that users of AI services may provide sensitive or confidential business information to AI providers and has emphasized that providers must honor their privacy and confidentiality commitments.¹
That does not eliminate the business owner's responsibility to decide what employees should be permitted to share in the first place.
AI Use Could Affect Your Trade Secrets
Arizona law provides protection for qualifying trade secrets.
But there is an important part of the definition that business owners sometimes overlook.
To qualify as a trade secret under Arizona law, information must not only have economic value from remaining secret; it must also be subject to reasonable efforts to maintain its secrecy.²
That matters when employees use AI.
Imagine your company has developed a valuable pricing formula, proprietary process, customer database, internal strategy, or other confidential information.
Now imagine an employee copies that information into a public AI tool without considering where the data is stored or how it may be used.
Even if the employee was only trying to work more efficiently, the business may have created an unnecessary confidentiality issue.
This does not mean that every use of AI destroys trade-secret protection.
It does mean businesses should be able to show that they have taken reasonable steps to control how sensitive information is handled.
A written AI policy can become part of that larger protection strategy.
Decide What Employees Can and Cannot Put Into AI Tools
One of the first things we would encourage a business owner to establish is a clear rule about information.
Employees should not have to guess.
Depending on the business, a policy might prohibit entering information such as:
- Customer personal information
- Social Security numbers or financial information
- Passwords and login credentials
- Confidential contracts
- Trade secrets
- Internal financial reports
- Proprietary business processes
- Nonpublic customer lists
- Sensitive employee information
- Information the business has contractually agreed to keep confidential
The exact list will depend on the company.
A contractor, medical office, retail business, professional service company, manufacturer, and technology company will have very different information risks.
The important thing is to create the rule before an employee has to decide on their own.
Personal Information Creates Another Layer of Risk
Businesses also need to consider Arizona's data-security requirements.
Arizona law requires businesses that own, maintain, or license certain computerized personal information to investigate qualifying security incidents and, when a security system breach is determined to have occurred, comply with applicable notification requirements.³
Using an AI platform does not automatically create a security breach.
But businesses should think carefully before employees place protected personal information into third-party AI systems.
A practical policy should answer questions such as:
Can employees enter customer information into an AI platform? Can they upload documents containing personal information? Are only certain approved AI services allowed? Who approves a new AI vendor? What happens if an employee accidentally uploads sensitive information?
The worst time to create an incident-response procedure is after someone reports, “I think I uploaded the wrong file.”
Free AI Accounts and Business AI Accounts May Not Be the Same
Another common mistake is allowing employees to choose whatever AI tool they prefer.
One employee may use a free account.
Another may use a personal account.
A third may use a paid business product.
Those accounts may have very different terms, privacy settings, administrative controls, and data-use practices.
Before adopting an AI platform, businesses should consider reviewing:
- Terms of service
- Privacy policies
- Data-retention provisions
- Whether submitted information may be used for model training
- Confidentiality obligations
- Security commitments
- Ownership provisions
- Indemnification clauses
- Limitations of liability
- Administrative and access controls
This is fundamentally a vendor-contract issue.
AI may feel different because the technology is new, but the legal question is familiar:
What have you agreed to by allowing another company to handle your business information?
Who Owns the Work AI Creates?
AI-generated work also creates intellectual-property questions.
Suppose your employee uses AI to create:
- Website copy
- Marketing graphics
- Product descriptions
- Training materials
- Videos
- Advertising content
- Presentations
- Software code
- Can the business assume it owns everything the AI generated? Not necessarily.
The U.S. Copyright Office continues to apply the requirement of human authorship to copyright protection. Its guidance recognizes that AI can assist human creativity, but material generated entirely by AI without sufficient human creative contribution may not itself qualify for copyright protection.⁴
That makes the employee's role important.
Using AI as a tool to assist a meaningful human creative process may produce a different copyright analysis than simply entering a prompt and publishing the resulting content without modification.
Businesses that rely heavily on creative content should therefore think about AI as part of their broader intellectual-property strategy.
If a logo, website, marketing campaign, written guide, or other asset is valuable to the business, it is worth understanding how it was created and who actually owns the rights.
AI Output Still Needs Human Review
AI can generate remarkably polished answers.
Polished does not necessarily mean correct.
Generative AI can produce inaccurate information, fabricate sources, misunderstand facts, or provide an answer that sounds confident while being wrong.
NIST's Generative Artificial Intelligence Profile identifies a range of risks organizations should consider when implementing generative AI and encourages organizations to establish governance and risk-management processes around their use of these technologies.⁵
For a business, that means AI should generally not become the final decision-maker simply because it produces an answer quickly.
Someone should remain responsible for reviewing important work.
That is especially true when the AI-generated material affects:
- Contracts
- Customer representations
- Financial decisions
- Regulatory obligations
- Professional advice
- Pricing
- Employment decisions
- Public statements
- Safety
- Intellectual property
Your policy should establish who reviews the work and who remains accountable for the final decision.
Do Your Contracts Restrict How Information Can Be Used?
AI policies should not be created in isolation.
Existing contracts may already limit what a business can do with information.
For example, your company may have signed:
A confidentiality agreement
- A customer services agreement
- A vendor agreement
- A nondisclosure agreement
- A licensing agreement
- A data-processing agreement
- Those contracts may restrict disclosure of information to third parties.
Before employees upload customer documents, proprietary information, or another company's confidential data into an AI platform, the business should consider whether doing so is consistent with its contractual obligations.
Your business may have permission to possess information without having unlimited permission to disclose that information to every third-party technology provider.
That distinction can matter.
A Basic AI Policy Does Not Have to Be Complicated
Many small businesses do not need a fifty-page AI governance manual.
But they should have some rules.
A practical policy could address:
Approved Tools
Identify which AI platforms employees may use for company business.
Prohibited Information
Explain what information employees may never enter into an AI platform without authorization.
Human Review
Require appropriate review before AI-generated material is sent to clients, incorporated into contracts, published, or used for significant business decisions.
Account Ownership
Whenever possible, business use should occur through company-controlled accounts rather than personal employee accounts.
Intellectual Property
Establish expectations regarding AI-generated content, ownership, and review before valuable creative work is published or commercialized.
Incident Reporting
Employees should know who to contact if sensitive information is accidentally uploaded or another AI-related problem occurs.
Vendor Approval
Someone should be responsible for reviewing the terms and risks before a new AI tool becomes part of the company's workflow.
The goal is not to prevent employees from using helpful technology.
The goal is to make sure everyone understands the boundaries.
Do Not Wait Until AI Creates the Problem
AI adoption often happens quietly.
An employee discovers a useful tool.
Then another employee starts using it.
Before long, AI has become part of the company's normal workflow even though no one ever made a formal decision about how it should be used.
That is when business owners can discover that customer information has been uploaded, proprietary processes have been shared, employees are using personal accounts, or important business content was created without anyone considering the ownership issues.
At Obsidian Ridge Law, we would rather help a business owner answer those questions before there is a problem.
The legal framework does not have to begin with a complicated technology policy.
It begins with understanding:
What information does your business need to protect?
What are your employees actually using AI for?
Which tools are they using?
What do your contracts require?
Who reviews AI-generated work?
And what rules should everyone understand going forward?
Technology will continue to change.
Good business governance means creating a framework that can change with it.
If your Arizona business is using AI but has not yet established policies around confidential information, employee use, vendor terms, or AI-generated work, schedule a free 15-minute consultation with Obsidian Ridge Law. We can help you identify the legal risks and build practical guidelines around the way your business actually operates
Double-click to edit...
¹ Federal Trade Commission, AI Companies: Uphold Your Privacy and Confidentiality Commitments (Jan. 9, 2024). The FTC notes that users of AI services may provide sensitive or confidential information and emphasizes that AI providers must comply with representations regarding how customer information is collected, retained, and used.
² A.R.S. § 44-401(4), Arizona Uniform Trade Secrets Act. Arizona defines a trade secret as qualifying information that derives economic value from not being generally known and is subject to efforts that are reasonable under the circumstances to maintain its secrecy.
³ A.R.S. §§ 18-551 and 18-552, Arizona Data Security Breach Law. Arizona law requires a person conducting business in the state that owns, maintains, or licenses qualifying computerized personal information to investigate certain security incidents and establishes notification requirements when a security system breach is determined to have occurred.
⁴ U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (Jan. 2025). The Copyright Office concluded that generative-AI outputs may receive copyright protection when there is sufficient human authorship, while material produced entirely through AI without adequate human creative contribution does not qualify merely because a person supplied prompts.
⁵ National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 (July 2024, updated Apr. 2026). NIST's voluntary framework identifies risks associated with generative AI and provides organizations with approaches for governing, mapping, measuring, and managing those risks.
Double-click to edit...
