Your employees are using AI to write to your investors.

Your employees are using AI to write to your investors.

Your AUP doesn’t cover it.

A few weeks ago I was working with the general counsel of a company going public. He warned his workforce about AI tools with two stories.

The first was Samsung. In 2023, Samsung engineers pasted proprietary source code into ChatGPT to help debug it. The code left the building. Samsung banned ChatGPT internally a few weeks later.

The second was Tesla. Employees pasted internal product details into ChatGPT. Those details ended up in discussion threads outside the company.

Then he listed what couldn’t go into any AI tool: earnings figures, deal terms, legal analyses, anything not yet public. That’s “material non-public information” in securities law, or MNPI.

The company had an AI AUP. It covered customer data and source code. It said nothing about investor emails, earnings language, or the MNPI list.

Here’s why this matters to you.

Most AUPs were written for a 2023 problem: don’t leak customer data, don’t let the model eat your source code. Real risks.

But AI doesn’t stop at customer data. It touches every regulated communication: investor content, legal analyses, HR investigations, tax positions. Each has rules about what can be said, to whom, and when. Each has employees asking AI for help drafting it.

Reg FD, gun-jumping, and Rule 10b-5 weren’t created for AI. AI changes the speed, not the game. An employee could always send a risky investor email. Now they can generate twenty in a minute.

Three rules matter if your company is public or pre-IPO. Reg FD (“Fair Disclosure”): no selective disclosure. Gun-jumping: no saying too much during the quiet period before an IPO. Rule 10b-5: no false or misleading statements to investors. Cross any line and the company owns it. Not the AI vendor.

If your company is private, the pattern still applies. Your AUP needs to name content AI can’t touch without review. For you, that might be legal analyses, HR investigations, or tax positions. Different rules, same exposure.

So what should you do?

1. Pull your AI acceptable use policy. Read it with your general counsel or outside counsel next to you. If they haven’t read it, you have a gap.
2. List the content that can’t go into any AI tool. For public or pre-IPO companies: anything non-public about the business. For private: anything with real legal or regulatory exposure.
3. Split your AI tools into tiers. Approved enterprise tools with logging on one side, consumer tools on the other. Spell out which content goes where.
4. Add a quiet-period clause if you’re heading toward an IPO. “Because we said so” loses to “because it could delay the IPO by six months.”
5. Train the teams most likely to use AI for outside communication: marketing, investor relations, communications, legal, HR.

Does your AI acceptable use policy end at data leakage, or does it cover what your team writes to customers, investors, and regulators?

-Kip