Using Artificial Intelligence Within Your Company: A Legal Checklist

The number of companies using Artificial Intelligence (AI) technologies has exploded in recent years. This is true across most sectors and with companies of all sizes. In many cases, companies have pursued and paid for AI software as part of an intentional business strategy. In even more cases, companies have a few AI enthusiasts using their preferred AI tools on their own initiative. In all cases, usage of AI technologies by a company’s personnel can create some risk: risk of losing protection for trade secrets, of accidentally violating non-disclosure agreements, of losing valuable intellectual property, and more.

Verrill’s Artificial Intelligence and Emerging Technologies practice helps its clients manage these AI-related risks. To do so, we sometimes use a legal gap analysis: an inventory of what a company is doing today with AI and how that current-state compares to AI best practices. Where there’s a gap between the ideal and the reality, we help companies close it. This article contains a checklist that any company can use to conduct a similar assessment. No answer to any of the questions below is a cause for alarm. Instead, we recommend using the checklist to better understand the nature of your company’s AI practices and determine whether any steps should be taken to change them.

1.) AI Usage & Awareness

• Do employees use AI tools (e.g., ChatGPT, Copilot, Midjourney) as part of their jobs?
  ☐ Yes ☐ No ☐ I don’t know
• Are employees using AI with or without company authorization?
  ☐ Authorized ☐ Unauthorized ☐ Unsure
• Has your company inventoried which AI tools are in use?
  ☐ Yes ☐ No
• Has your company reviewed the Terms of Use for the AI tools employees use to determine whether they comply with applicable laws and will not disclose your company’s trade secrets?
  ☐ Yes ☐ No

2.) Policies & Governance

• Does your company have a written AI usage policy?
  ☐ Yes ☐ No
• Has your employee handbook been updated to address AI use?
  ☐ Yes ☐ No ☐ N/A
• Do you have procedures for approving or disallowing new AI tools?
  ☐ Yes ☐ No
• Does your confidentiality policy reference employee obligations related to confidential information and AI?
  ☐ Yes ☐ No
• Are employees trained on the proper and ethical use of AI?
  ☐ Yes ☐ No

3.) AI Chatbots

• If your website uses chatbots, do they comply with U.S. state laws regarding disclosures to customers?
  ☐ Yes ☐ No ☐ Unsure

4.) Data Privacy & Confidentiality

• Do you allow confidential business information to be entered into AI tools?
  ☐ Yes ☐ No ☐ Unsure
• If your company provides confidential information to third parties, do your NDAs restrict them from inputting that information into AI?
  ☐ Yes ☐ No ☐ N/A
• If you collect customer or employee data, do you inform them it may be processed using AI?
  ☐ Yes ☐ No ☐ N/A
• Do your privacy policies explicitly reference AI usage?
  ☐ Yes ☐ No

5.) Intellectual Property

• Has your company considered whether AI-generated content is owned by the company or by employees?
  ☐ Yes ☐ No
• Do you verify that AI-generated outputs do not infringe on third-party IP?
  ☐ Yes ☐ No
• Do your contracts with vendors address ownership of AI-created materials?
  ☐ Yes ☐ No ☐ N/A

6.) Compliance & Risk

• Are you aware of current or pending laws/regulations on AI that may affect your industry?
  ☐ Yes ☐ No
• Do you operate, sell, or advertise in jurisdictions (e.g., the European Union, California, Colorado, Maine) with specific AI or privacy regulations?
  ☐ Yes ☐ No
• Has your legal or compliance team reviewed AI use for liability risks?
  ☐ Yes ☐ No
• Does your business insurance policy appropriately cover any AI-related risks that your company’s usage of AI presents?
  ☐ Yes ☐ No

7.) Labor & Employment

• Have you addressed employee concerns about AI replacing or altering job duties?
  ☐ Yes ☐ No
• Does your company use AI in hiring, performance evaluation, or HR decision-making?
  ☐ Yes ☐ No
• If yes, do you conduct bias or fairness audits of these tools?
  ☐ Yes ☐ No ☐ N/A

8.) Security

• Do you have security controls preventing sensitive data from being shared with external AI platforms?
  ☐ Yes ☐ No
• Have you assessed AI vendor security practices (e.g., SOC 2, ISO 27001)?
  ☐ Yes ☐ No
• Do you log and monitor employee use of AI tools for compliance purposes?
  ☐ Yes ☐ No

9.) Strategic & Operational

• Do you have an internal committee or working group overseeing AI adoption?
  ☐ Yes ☐ No
• Do you have a process to evaluate the cost-benefit of AI tools?
  ☐ Yes ☐ No
• Is your company considering AI for customer-facing products or services?
  ☐ Yes ☐ No

For more information about using Artificial Intelligence in companies, please contact Andrew Ferrer, Adam Nyhan, or Andrew Walsh in Verrill’s Artificial Intelligence & Emerging Technologies practice.

Adam Nyhan is a Partner in Verrill’s Artificial Intelligence & Emerging Technologies and Intellectual Property practices. He advises software, FinTech, AdTech, and other companies on privacy and Artificial Intelligence issues in compliance, licensing, B2B negotiations, and venture capital and M&A deals.

Tawny Alvarez is a Partner in Verrill’s Labor & Employment Group. She centers her practice on the understanding that the employment landscape is ever-changing and organizations do not have the time or resources to keep abreast of all these changes including: how AI affects hiring and the employment relationship; pay transparency laws and the effect on equal pay and pay practices more generally; diversity, equity, and inclusion program and maintaining a diverse work environment within the confines of Title VII and state and federal anti-discrimination laws; bias at work, including its effect on the decision-making; and remote work policies and effectively managing remote workers.