Is Your Secret Safe with AI? Trade Secret Protection in the Age of AI

Introduction

As companies race to adopt generative AI as a routine business tool, do they understand how doing so impacts both their strategies for protecting valuable trade secrets and what now constitutes trade secrets worth protecting in the first place? Trade secret law has long been flexible enough to protect valuable business and technical information in the face of technological change, yet AI complicates the analysis by blurring the line between protected internal use and potentially uncontrolled disclosure of trade secrets. Furthermore, effective use of AI can also create new categories of information that, if kept secret, could provide a commercial advantage, while rendering categories of existing trade secret information less valuable. This article examines how existing trade secret principles apply to AI inputs, outputs, and prompts, and offers practical guidance for preserving trade secret protection while taking advantage of AI tools.

Background – What Is a Trade Secret?

The Defend Trade Secrets Act and its state law analog, the Uniform Trade Secrets Act, create causes of action for misappropriation of information that derives commercial value from its secrecy. Under both statutes, information qualifies for protection where (1) the owner has taken reasonable measures to preserve its secrecy; (2) the information is not generally known or readily ascertainable through proper means; and (3) it derives independent economic value, actual or potential, from not being known to others who could obtain economic value from its disclosure or use.¹

Misappropriation of trade secrets turns on both the character of the information and the manner in which it was acquired, disclosed, or used.² Acquisition through theft, deception, breach of a duty of confidentiality, or other improper means may give rise to liability. By contrast, reverse engineering, independent development, and the assembly of information lawfully available in the public domain generally do not.³

Trade secrets are a particularly flexible form of intellectual property protection because they can fill gaps left by other regimes. They may protect confidential business or technical information ranging from formulas and algorithms to customer data, pricing strategies, and manufacturing or business processes. Unlike patents, trade secret protection is not limited to inventions satisfying novelty and non-obviousness; and unlike copyright, trade secrets are not limited to original expression.⁴ Trade secret rights also require no registration and may last indefinitely, provided secrecy and economic value are maintained.⁵ The Coca-Cola formula, for example, has been famously protected as a trade secret for more than a century – far longer than the exclusivity period available through patent protection.⁶

Courts have generally adapted trade secret principles to new and changing technologies.⁷ This adaptability is especially relevant as AI reshapes how information is created, processed, and disclosed. Unlike patent and copyright regimes, trade secret law does not require a human inventor or author, and therefore can protect valuable information even where the inventive or analytic work was generated, refined, or organized with machine assistance.⁸

AI Inputs, Outputs, and the Secrecy Problem

The core legal questions related to AI and trade secrets are (1) whether trade secret status is lost when a user submits confidential information to an AI tool, and (2) whether the AI user’s prompts, intermediate processing, or AI outputs have economic value and can themselves be protected as trade secrets.

When a company submits confidential data, legal analysis, product plans, or other confidential information to a public or consumer AI platform, has it destroyed its protectability as a trade secret by failing to preserve the secrecy of such information? Courts have only recently begun to address this question, but the early decisions say “yes,” though the analysis is fact-specific, and highly dependent on the platform’s terms of use, technical configuration, and confidentiality controls.⁹

So far, courts have taken a strict view on voluntary disclosures to public AI tools. In 2025, the U.S. District Court for the Northern District of California held that voluntary disclosure of alleged trade secrets to a consumer-tier AI platform, where the terms of service imposed no confidentiality obligation, defeated trade secret protection notwithstanding the user’s claimed ownership of the output.¹⁰ In February 2026, the U.S. District Court for the Southern District of New York similarly reasoned that communications memorialized through a public AI platform were not confidential where the platform was not contractually bound to keep them secret.¹¹

This emerging line of cases, however, does not stand for the proposition that AI is inherently incompatible with trade secret law. Rather, their reasoning makes clear that the legal consequence turns on how the platform received the information and what the platform was permitted to do with it. Information scraped, extracted, or reconstructed without authorization may still support a misappropriation claim, while information affirmatively disclosed into a public tool without retention, use, access, or confidentiality constraints may fail the reasonable-efforts requirement. The fact that a user owns the output of generative AI is not a substitute for secrecy, because trade secret law protects controlled information, not merely information a user can claim to own.

If a prompt contains trade secrets, legal analysis, or other confidential information, the act of submission may create evidence that the owner failed to maintain secrecy. This risk is mitigated where the tool is deployed locally or under enterprise terms that prohibit training on customer data, restrict human review, impose confidentiality obligations, and provide deletion and audit rights.¹²

Restrictive terms and conditions cannot eliminate the risk, however. There is operational risk of unintentional disclosure of trade secrets for AI users as well, as many AI tools process prompts through third-party systems, may retain inputs for model improvement, and may allow access by provider personnel, third parties, or downstream systems.¹³

Separately, a company could find that information that it previously regarded as a trade secret is no longer economically valuable because it can be more easily reverse engineered or replicated by competitors through the use of AI. Conversely, a company could also find that historical data it maintains has new value because it can be used to train proprietary AI models.

Accordingly, the relevant inquiry is not whether AI inherently preserves or destroys trade secret status in the abstract, but rather whether the trade secret owner’s AI governance practices satisfy the statutory obligation to maintain secrecy. The same information may remain protected in a closed, contractually controlled environment and lose protection if entered into an unrestricted public tool. That makes AI governance a trade secret issue, rather than merely an information-security or procedural issue.¹⁴

Protecting Prompts and AI Workflows as Trade Secrets

AI-related materials are not categorically excluded from trade secret protection. Prompts, prompt libraries, and other internal AI workflows may embody valuable know-how.¹⁵ The strongest candidates for trade secret protection are likely materials not visible to third parties, developed through investment and experimentation, and maintained under internal secrecy controls.

As AI becomes increasingly important to business operations, the meticulously crafted prompts and instructions that users provide to AI systems may qualify for trade secret protection under certain circumstances. Prompt engineering, the skill of crafting detailed, high-quality inputs to elicit precise and useful AI outputs, has emerged as a critical competency, and the structured prompt libraries that businesses develop encapsulate institutional knowledge, operational expertise, business processes, and competitive know-how.¹⁶

Prompts, however, are not protected merely because they are clever or useful. To function as trade secrets, they must derive independent economic value from their secrecy and be protected through reasonable measures designed to preserve that secrecy. In a business setting, this may be easier to show for structured prompt libraries, system prompts, or proprietary workflows that encode institutional knowledge and produce consistent, reliable results than for isolated, ad hoc user prompts.¹⁷ Businesses can maintain this protection perpetually, so long as the prompts remain valuable and they take reasonable steps to preserve secrecy, such as restricting access, using nondisclosure agreements, and labeling prompt repositories as confidential. Recent litigation has begun testing whether system prompts constitute protectable trade secrets when extracted through adversarial techniques like prompt injection.¹⁸ Whether courts will view such prompts as protectable works of human expertise, vulnerable operational code, or something else remains an open question.

Conclusion and Business Takeaways

AI is not fundamentally incompatible with trade secret law, but it can make secrecy more fragile. The core requirements remain familiar: the information must have independent economic value from maintaining secrecy, and the owner must take reasonable measures to keep it secret. In the AI context, however, confidentiality can be compromised in new and less visible ways, including through prompting on public tools or AI platforms that permit retention, human review, or training on inputs. At the same time, AI technology may allow users to create new forms of protectable know-how, including prompt libraries, system prompts, and workflows. The key takeaway for businesses is that AI governance should be treated as a core component of any trade secret program, with protection turning on a company’s ability to demonstrate clear policies, controlled tools, contractual safeguards, and careful monitoring of how confidential information moves through AI systems.

In creating such governance, companies should keep the following in mind:

• Use Controlled AI Environments. Companies should prioritize local or enterprise AI deployments where confidentiality, retention, training, and access rights can be contractually and technically controlled (rather than public AI platforms). Vendor agreements should address whether inputs may be retained, reviewed, used for model training, or disclosed to subcontractors.
• Limit Confidential AI Inputs. Businesses should monitor what employees submit to AI tools and prohibit entry of trade secrets or other confidential information unless the tool has been approved for that use. Training and review processes should make clear that prompts can themselves create disclosure risk.
• Adopt Clear AI Governance Policies. Internal policies should identify which AI platforms may be used, what categories of information may be submitted, and who may approve exceptions. Those policies should be paired with employee training, access controls, and periodic audits so companies can demonstrate reasonable efforts to protect secrecy.