How to stop employees selling your company's work files to AI firms

How do you stop employees selling company documents to AI firms?

Remind staff in writing what they agreed to, tighten the confidentiality and offboarding rules, and watch for bulk downloads when people leave. The company's own work product is generally the company's to license. An individual employee has no authority to sell it, and the legitimate route is a company license approved by an authorized sponsor.

AI data firms can approach individual professionals for materials from previous jobs. Whether or not an offer ever reaches your people, the protective steps are the same and cheap to do now.

Who owns the documents in question

Under copyright law, a work prepared by an employee within the scope of employment is a work made for hire, and the employer is the author and owner. The Copyright Office explains this, and the statutory definition is in 17 U.S.C. section 101. Work by contractors may not be owned by the company unless it is assigned in writing.

Copyright is only part of the picture. Documents can also carry confidentiality duties to clients, trade-secret status and contractual limits that an employee cannot waive. Which rules apply depends on the facts and the state. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Prerequisites: know what you hold

Before changing policy, find out what exists and who can reach it. You need an inventory of core systems (email, chat, shared drives, CRM, ticketing, code repositories), a list of who has bulk export rights, and copies of current employment, contractor and confidentiality agreements.

The 7-step protection plan

1. Read the paper. Pull the confidentiality, invention-assignment and acceptable-use agreements employees actually signed. Note gaps, such as contractors with no assignment clause.
2. Update the policy. State plainly that company documents, messages and work product may not be shared with or sold to any outside party, including AI data buyers or brokers, without written approval.
3. Tell people. Send a short notice to staff and contractors that restates the rule and names the approval route. Keep a record of delivery and acknowledgment.
4. Limit export rights. Review who can download whole mailboxes, bulk-export Slack or Teams history, or clone every repository. Remove rights nobody needs.
5. Add offboarding checks. Alert on bulk downloads and forwarding in the weeks before departure. Hold an exit conversation that restates continuing duties and collects devices.
6. Create the legitimate route. Name who can approve an outside license. If the company wants to explore one, an authorized sponsor, such as the owner, CEO, CFO or authorized representative, leads it.
7. Escalate quickly. If you learn of an offer or a sale, preserve evidence and bring in counsel before contacting anyone.

Signs that outside offers are reaching your people

You rarely hear about these approaches directly. Watch for patterns instead, then ask questions calmly before assuming bad faith.

• Staff mention recruiters or "research platforms" asking for samples of past work.
• Someone requests an unusual export of old tickets, proposals or chat threads with no business reason.
• A departing employee forwards mail or syncs a personal drive in the final weeks.
• Clients ask whether their documents could end up in an AI dataset.
• Professional networks start circulating posts about paid "work sample" programs.

Treat each as a prompt to restate the policy, not as proof of wrongdoing. Most employees simply do not know that selling a past employer's files can breach their agreements.

Common mistakes

What to say to staff

Illustrative scenario

Illustrative: a fictional 120-person IT services firm learns a departing account manager has asked a recruiter about "selling samples of past project work." The firm restates the signed confidentiality agreement, checks the manager's export logs, and asks counsel to write to the individual. Separately, the CEO asks whether the firm should explore a licensed deal on its own terms. The two decisions are independent.

Why the authorized route is different

A company license is a scoped transaction: the company keeps ownership, sets scope and exclusions, agrees de-identification and redaction rules with the buyer before any work begins, and delivers data only after an executed agreement and the company's authorization. It is nothing like an individual passing along files. Owners weighing it can read how to sell data to AI companies and what an AI buyer does with licensed records.

An employee's side is covered in what to do when an AI data firm offers to buy your client work files, and the platform angle in whether Slack's API policy stops a company licensing its history. Staff morale is covered in what employees will think if the company licenses records, and the investor view in portfolio data licensing and reputational risk.

What to do the day an offer surfaces

1. Do not confront anyone yet. Write down who, what and when.
2. Preserve logs, messages and the agreement the person signed.
3. Ask counsel whether client contracts require notice.
4. Then have a documented conversation that restates the duties and asks what, if anything, was shared.

When this plan is not enough

If an offer has already led to a sale, or client data left the building, this is a legal and incident-response matter. Stop and call counsel. A policy refresh will not fix it.

Next step

If the company holds years of records and the owner wants to explore a licensed route the company controls, register as a partner to introduce it, or have the company apply at sourcex.si/apply. To see how the partner reward works, use the referral earnings calculator; more answers are in the FAQ.