Yes. As soon as anyone besides the founders uses AI tools for company work, and ideally before, your startup should have a short written AI use policy. One or two pages is enough if it says which tools are approved and on what kind of account, what may never go into a prompt, who reviews AI output before it’s used, and how you track AI-written code and content. That protects your trade secrets and customer data, keeps your IP as ownable as the law allows, and gives you clean answers when investors or acquirers ask how you use AI.
Key takeaways
- Approve specific tools on business or enterprise accounts whose terms say your data isn’t used to train models, and ban company data in personal accounts.
- Pasting confidential information into the wrong tool can cost you trade secret protection and breach customer contracts.
- Purely AI-generated material can’t be copyrighted, and AI can’t be an inventor. Keep a human meaningfully in charge of anything you need to own. This is a new area of law and likely to shift.
- AI-written code needs the same open-source and security review as any other code.
- Using AI in hiring decisions brings notice and anti-discrimination rules in some states and cities.
Why does a startup need an AI use policy?
Because your team is already using AI, and without rules each person decides alone what to paste into which tool. Three things are at stake.
Trade secrets. A trade secret is protected only if you take reasonable measures to keep it secret. When an employee pastes source code or a product roadmap into a consumer chatbot whose terms allow the provider to store it or use it for training, a court could see that as a failure to protect it. A written policy is now one of the measures courts and acquirers expect to see. See What Are Trade Secrets?.
Other people’s data. Your customer contracts, NDAs and privacy policy limit what you can do with customer and personal data. Sending it to an AI vendor that isn’t approved as a service provider can breach all three.
Diligence. Investors and acquirers now routinely ask what AI tools you use, what you put into them, how much of your code was written with AI, and what rights you have to any data used to train your models. A policy and a simple record of use make those answers short.
What should the policy cover?
| Section | What it says |
| Approved tools | Which tools and account types are allowed, and for what kind of information |
| Prohibited inputs | What may never go into any prompt, and what may go only into top-tier tools |
| Ownership and disclosure | That work product belongs to the company, and when AI use must be noted |
| Human review | Who checks output before it’s shipped, published, sent to a customer or relied on |
| Code | Rules for AI coding assistants, scanning and review |
| People decisions | Limits on using AI in hiring, performance and pay decisions |
| Records | What to log so you can answer diligence questions |
| Who it covers | Employees, contractors and advisors, with a named owner and a review date |
Keep it short enough that people read it. A policy no one follows is worse than none, because it shows you knew the risk.
Which AI tools should we approve?
Approve tools by tier rather than by name alone, because the same product can have very different terms on a free personal account and on a business plan. A common structure is a top tier of enterprise or API accounts under a signed agreement, approved for confidential company information; a middle tier of paid business accounts, approved for internal but non-sensitive work; and personal or free accounts, approved only for public information or not at all.
Before you approve a tool, read its terms for these points: whether your inputs and outputs are used to train the provider’s models, how long they’re kept, whether the provider treats them as your confidential information, who owns the output, whether the provider offers an indemnity against copyright claims over output (several major providers now do for business customers, with conditions), its security certifications, and whether it will sign a data processing agreement if you send it personal data. If the free terms are bad and the business terms are good, the upgrade is usually the cheapest risk reduction you can buy.
What can’t go into a prompt?
Start with a short, concrete list. In any tool outside your top tier, prohibit source code, unreleased product plans, financials, fundraising and deal terms, customer data, personal data about employees or users, anything covered by an NDA, unfiled invention disclosures, and legal advice from your lawyers. Pasting unfiled invention details into a tool that may store or reuse them can also create a disclosure problem for a later patent. Even in approved tools, keep personal data and customer data to what the task actually needs.
Who owns what AI produces?
Your policy should say that anything employees and contractors create with AI for the company belongs to the company, and your confidential information and invention assignment agreements should already assign it. See Who Owns Startup IP? and CIIAA.
The harder question is whether anyone owns it. US copyright protects only human authorship. In its January 2025 report, the Copyright Office said prompts alone generally don’t make you the author of what a model generates, though human selection, arrangement and modification of AI output can be protected. Courts agree: in March 2026 the Supreme Court declined to review the decision holding that a work created entirely by AI can’t be registered. For patents, the USPTO’s November 2025 guidance says only people can be inventors, and AI is treated as a tool the human inventor uses. So keep people making the creative and technical decisions in the work you most need to own, and keep enough records to show it. This is a new area of law and likely to shift, so revisit the policy as it does.
What about AI-written code?
AI coding assistants are trained largely on public code, much of it under open-source licenses. Output can occasionally reproduce licensed code without its license notice, and copyleft code in your product can create obligations to release your own source. Turn on any setting the tool offers to block suggestions that match public code, run the same license and security scanning you’d run on any third-party code, and require human review of AI-written code before it’s merged, since generated code can also carry security flaws. See Open Source and Common Open Source Licenses.
Do we need human review of AI output?
Yes, for anything that leaves the company or that someone relies on. Models produce confident errors. Name who reviews customer communications, published content, financial figures and legal or compliance statements before they go out.
Be most careful with people decisions. New York City requires an independent bias audit and notice to candidates before employers use automated tools to screen candidates for hiring or promotion, and Illinois has made it a civil rights violation, since January 1, 2026, to use AI in employment decisions in a way that discriminates or without notifying employees. Other states are following, and the rules are changing quickly. If you use AI to screen résumés or evaluate employees, check the rules where your candidates and employees are. Also make sure what you say publicly about your own AI is accurate. The FTC has brought cases against companies that overstated what their AI does.
Can I use AI to draft our legal documents?
AI is genuinely useful for organizing your thoughts before you talk to a lawyer. Ask it to summarize a counterparty’s contract, list the questions you want answered, or turn your notes into a short brief describing the deal, what matters to you and where you’re flexible. That brief makes your lawyer faster and your bill smaller.
Asking AI to draft the legal document itself usually has the opposite effect. Your lawyer has to read every line of an unfamiliar draft, check it against the law and your deal, and often rebuild it from a tested form, which slows review and can raise the cost. And don’t paste your lawyer’s advice into a tool outside your top tier, since that may undermine confidentiality.
How do we roll it out?
Have every employee and contractor acknowledge the policy, include it in onboarding, and name one person who owns it and approves new tools. Keep a simple register of approved tools, the account each team uses, and which code repositories and content were produced with significant AI help. Review the policy every six months or so. Once you reach around 20 employees, fold it into your employee handbook. See Startup Employee Handbook.
For related reading, see What Are the Startup Best Practices for Data Privacy?, Startup Intellectual Property and Startup Due Diligence.
If you’d like help writing an AI use policy or reviewing an AI vendor’s terms, contact us.
