Recently, while having lunch with a colleague, I heard an interesting story. A senior member from the adjacent team received a call from the IT department after using their personal ChatGPT account to draft a customer email on their company laptop.

To cut to the chase, that senior member only received a warning. However, everyone at our table had a strange expression upon hearing this. In fact, half of us sitting there, myself included, had done something similar.

So today, I want to dig into this question properly. If someone gets caught using AI tools secretly at work, could it really be grounds for termination?

First, let's look at some data that shows this isn't just our issue. There's a study commissioned by PagerDuty and conducted by Wakefield Research in April 2026.

They surveyed 1,250 non-IT office workers from companies with over $500 million in revenue, and 66% of them admitted to having used AI tools even though they believed it was against company policy. That's two out of three people, which honestly surprised me.

There's an even more striking number. 88% of respondents reported having shared work-related information with public AI tools.

Of course, we should consider that this study was commissioned by a company selling AI operational solutions. Still, the overall direction isn't significantly different from other studies.

This suggests that using AI tools secretly has become a routine for quite a few employees. The company might just be pretending not to notice.

Now, let's get into the legal aspects. Most states in the U.S. operate under at-will employment, and California's labor laws also assume at-will employment as a basic premise.

This means that unless specified otherwise in a contract, a company can terminate an employee for a wide range of legal reasons. Violating company AI policies can certainly fall under those legal reasons.

However, there are limits to at-will employment. Employees cannot be terminated for illegal reasons, such as discrimination based on race or gender, or retaliation for legitimate reporting.

So what actually becomes problematic? Labor law resources commonly highlight a key point.

It's not just the fact that someone used AI; it's what they violated in the process that matters. Did they paste company secrets or customer information? Did they breach a signed NDA? Did they present unverified AI-generated results as their own? Ultimately, it's the behavior, not the tool, that's the issue.

Particularly, confidentiality issues are extremely sensitive for companies. To be protected as a trade secret, a company must demonstrate that it took reasonable steps to keep that information confidential.

But if an employee publicly inputs that information into an AI tool? That puts the very protection at risk. It could also lead to the company inadvertently breaching an NDA with a client.

This isn't just theoretical; there's a real case involving Samsung. In April 2023, an engineer was found to have uploaded internal source code to ChatGPT.

Following that, in early May, Samsung issued a notice to employees in key business units stating that they would temporarily prohibit the use of generative AI on company devices. They also advised against uploading sensitive work information on personal devices.

The company's concern was straightforward. Data stored on external AI servers is difficult to retrieve or delete, and it could be exposed to other users.

I understand the company's logic. One mistake could lead to lawsuits or customer loss, so it's natural for them to want to manage this risk.

But there's also the employee perspective. Using AI can definitely speed up work, but there are either no approved tools from the company or they are implemented too slowly, which can be frustrating.

In the PagerDuty survey, 75% of respondents said they would consider changing jobs if they had a workplace that enhanced their AI capabilities. So, it's clear that an outright ban isn't the only solution.

So, let me summarize some realistic approaches. First, check if there are any AI-related clauses in your company handbook or IT policies.

Second, if you're unsure, just ask your manager or the IT team. Asking and then using it won't be a policy violation; it becomes a suggestion.

Third, never input names, customer information, internal numbers, or codes into personal AI accounts. This is something I believe should be followed regardless of policy.

Fourth, don't submit AI-generated content as is. A final review must always be done by a person, and if there's an error, the responsibility ultimately falls on the person who submitted it.

Whether a termination or disciplinary action was justified can vary greatly depending on contract terms, company policies, and state laws. If issues arise, consulting an employment lawyer is the most reliable course of action.

My conclusion is this: using AI secretly carries too much risk, and it's much better to ask openly and use it.

Since that lunch, I asked my team leader directly. Surprisingly, there was an enterprise version that the company uses; I should have asked sooner.

How about your company? Does it have an AI policy, and how is everyone using it? Please share in the comments.