Nearly all companies are investing in artificial intelligence, but only 1% have mature governance in place, according to a 2025 McKinsey report. As organizations race to adopt AI, attorneys say clear policies, employee training and human oversight are becoming just as critical as the technology itself.
"Perhaps the biggest challenge for companies adopting AI is implementing guardrails at the same pace businesses are scaling their AI tools," said Troy Lieberman, counsel at Nixon Peabody. "AI can accelerate business processes, improve productivity and help employees work more efficiently, but it also raises questions about privacy, accuracy, bias, intellectual property and accountability."
Guardrails must keep up with AI scaling
Lieberman said organizations should view AI as a business tool that requires thoughtful governance rather than simply another software application. That starts with establishing clear policies around which AI platforms employees may use, what information can be entered into those systems and when human review is required.
"Without clear guidelines, employees may inadvertently expose confidential information, rely on inaccurate AI-generated content or use AI in ways that create legal or regulatory issues," he said. "They may also unknowingly enter valuable proprietary information or trade secrets into AI tools."
Confidential information and trade secrets at risk
Katarina (Kate) B. Polozie, CIPP/US, AIGP, partner at Woods Oviatt Gilman, said companies should never assume information entered into an AI platform will remain confidential. Depending on a provider's terms of use, prompts may be retained or used to train future AI models, creating potential risks for trade secrets, proprietary business information and even attorney-client privilege.
"Feeding trade secrets like customer lists, proprietary code, pricing, or strategy into a public tool can undermine trade-secret protection, which depends on a business taking reasonable steps to keep that information secret," she said. "Unfortunately, once the information is put into an AI tool, there is often no practical way to claw it back."
Polozie pointed to the recent federal case United States v. Heppner, in which a court held that a user waived attorney-client privilege by entering privileged information into a public generative AI platform because sharing it with the platform constituted disclosure to a third party. "The provider's privacy policy (which allowed it to collect inputs, train on them and disclose them) meant the user had no reasonable expectation of confidentiality," she said. "Of course, while every instance is fact specific, the same logic threatens any confidential, trade secret or privileged material an employee pastes into a public tool."
Legal responsibility stays with the business
Even with strong safeguards in place, attorneys say AI should support decision-making rather than replace it. Businesses remain responsible for how the technology is used and for the decisions made based on its output. "Businesses should remember that using AI does not often shift legal responsibility to the technology provider," Lieberman said. "The business generally remains responsible for how AI is used and the decisions made based on its output."
If an AI tool improperly screens out a job applicant, denies a loan for discriminatory reasons or mishandles personal information, blaming the technology is not a legal defense. That responsibility becomes even more important as AI is used in areas with significant legal and ethical implications. Lieberman said organizations should exercise particular caution when AI is involved in employment decisions, lending or patient care, where concerns about fairness, bias and transparency continue to draw increased regulatory attention.
Tim Plunkett, AIGP, senior counsel at Harris Beach Murtha and a member of the firm's Artificial Intelligence Industry Team, said AI's speed makes strong governance essential. "AI can do so much so fast, but it can also do a lot of really bad things really fast, too," he said. "It's a force multiplier for your workforce."
Governance requires continuous effort and training
While AI can help organizations scale and improve efficiency, Plunkett said businesses should understand that using new tools is only part of the equation. "No matter how fast the market's making tools, you've got to have really good people to use them," he said, emphasizing that employee training and building AI literacy across an organization are just as important as the technology itself.
Attorneys say companies don't need to wait for new laws before strengthening their AI governance practices. "Governance should not be a one-time project," Lieberman said, noting that organizations should regularly revisit their policies, approved AI platforms and employee training as both the technology and legal landscape continue to evolve.
Polozie also recommends conducting careful due diligence prior to adopting AI products or services. "Before allowing any employee to use a tool, read the terms and do your due diligence," she said, recommending that companies negotiate contractual protections whenever possible and ensure vendors maintain appropriate confidentiality, security and data-retention practices.
Plunkett said organizations should first inventory the AI tools already being used across the company before developing governance policies around them. He also recommends regularly revisiting those policies as AI technology and regulations continue to evolve.
For Plunkett, effective governance ultimately separates organizations that simply adopt AI from those that use it successfully over the long term. "The companies that I think that'll succeed with AI won't be the ones that adopt it the fastest," Plunkett said. "It'll be the ones that govern it the best."
Why this matters for IT, development, and management professionals
IT and development teams are often the ones deploying and integrating AI tools across the organization. Without a clear governance framework, they risk exposing sensitive data, trade secrets, or privileged information through everyday use of public platforms. Management professionals bear the responsibility of setting and enforcing those policies. They must lead the inventory of AI tools already in use, define what data can be entered into each system, and mandate human review of AI outputs in high-stakes decisions. The organizations that treat governance as a continuous, cross-functional discipline-rather than a one-time checklist-will be the ones that capture AI's benefits while avoiding legal and reputational damage.
Your membership also unlocks:
