Most companies do not lose their trade secrets to hackers. They lose them to people who were given the keys: employees who leave and take something with them on the way out. That has always been true. What has changed is how much an employee can take, how many places it can go, and how little of it looks like theft at the time.
For years, the standard exit process was a conversation, a signed acknowledgment of confidentiality obligations, a returned laptop and badge, and a disabled email account. That process was built for a world of file servers and thumb drives. It is badly outmatched by a workplace in which employees sync corporate data to personal cloud accounts, collaborate in a dozen SaaS platforms the IT department never provisioned, and increasingly paste confidential information into artificial intelligence tools that retain, index, and personalize it.
The exit interview is no longer an HR formality. It is the last, best opportunity to inventory what a departing employee has, to lock down what they still control, and to preserve evidence before it disappears. Treated seriously, it is also powerful proof that your company took reasonable measures to protect its confidential information, a threshold question in nearly every trade secret case.
Why the stakes have risen
Two developments have converged.
First, the restrictive-covenant landscape has shifted toward employers relying less on non-competes and more on trade secret and confidentiality protections. The Federal Trade Commission's 2024 rule banning most non-competes never took effect; after a Texas district court blocked enforcement, the Commission dismissed its appeals in September 2025 and formally removed the rule from the Code of Federal Regulations in early 2026. But the reprieve is narrower than it looks. Enforceability is once again governed entirely by a patchwork of state law that continues to tighten, and the FTC has pivoted to case-by-case enforcement under Section 5, targeting overbroad covenants through investigations and consent orders. Notably, those consent orders have generally left intact covenants tailored to protecting confidential information and trade secrets. The practical message for employers is clear: the durable protection is the one you build around your data, not the one you build around the employee's next job.
Second, generative AI has created exfiltration pathways that traditional exit checklists do not touch. An employee who forwarded a customer list to a personal email account left an obvious trail. An employee who spent 18 months pasting pricing models, draft patent applications, source code, and client strategy memoranda into a personal AI assistant account left a far more valuable and far less visible trail: a searchable, summarized, portable body of institutional knowledge that goes with them, in an account your company has never seen and cannot audit.
The AI-era risk inventory
A modern digital exit review should account for categories that did not exist five years ago:
- Personal and "shadow" AI accounts: Consumer AI subscriptions purchased on personal cards, used for work, and never disclosed to IT. Their chat histories may contain more distilled confidential information than any single document the employee ever downloaded.
- AI memory and personalization features: Many assistants now retain persistent user-level memory across sessions. Company information supplied months ago may continue to shape outputs in the employee's account long after their access is cut off.
- Coding assistants and development environments: AI pair-programming tools with repository access, local model caches, and prompt histories that may embed proprietary code.
- Agentic tools and standing credentials: Automations, API keys, OAuth tokens, and connected apps that continue to reach into corporate email, calendars, drives, and CRM systems after the employee's primary credentials are disabled. Deprovisioning a user account does not necessarily revoke what that user connected.
- AI meeting assistants and note-takers: Bots joining calls under a personal account, generating transcripts and summaries stored outside company systems.
- Browser profiles and extensions: Synced credentials, session tokens, bookmarks, and AI browser extensions that captured page content, often persisting on a personal device signed into the same browser profile.
Rebuilding the exit interview
The conversation itself should be structured, documented, and conducted by someone prepared to ask follow-up questions rather than read a script.
Ask where the employee worked, not just what they worked on: which devices, which personal accounts, which cloud storage, which collaboration platforms, which AI tools. Ask directly whether they used any AI tool with company information, which ones, under whose account, and whether any of that history still exists. Ask about home offices, personal phones, tablets, external drives, and family-shared computers.
Update your certification language accordingly. A representation that the employee has "returned all company property" was drafted for physical media. It should now expressly cover data stored in personal cloud accounts, personal email, messaging applications, personal AI tool accounts and chat histories, as well as any credentials or automations connected to company systems, and should include an affirmative obligation to delete and certify that the deletion has been completed.
Ask about destination as well: where the employee is going, and what role they will hold. This informs how much risk the departure carries and whether a notice letter to the new employer is warranted. Reasonable, well-documented follow-up is legitimate; overreaching is not, and can generate its own liability.
Preserve first, wipe later
The single most common self-inflicted wound in departing-employee litigation is reimaging the laptop. Devices are routinely wiped and reissued within days, destroying precisely the forensic evidence needed to prove what happened, such as USB connection logs, cloud sync artifacts, mass-download activity, browser history, and file access patterns immediately preceding resignation.
Adopt a hold-and-image protocol by preserving a forensic image of the device before it re-enters circulation, and retaining it for a defined period. Preserve email, messaging, and cloud logs on the same schedule. Where circumstances warrant, such as departure to a competitor, a particularly sensitive role, or anomalous pre-departure activity, review the image promptly rather than waiting months, when the trail has gone cold and the window for emergency relief has closed.
The same discipline applies when bringing employees on board. When you hire, confirm in writing that the incoming employee will not bring, use, or rely on a former employer's confidential information, including material stored in their personal AI accounts. Claims that a new hire improperly used a former employer's confidential information can be just as costly and disruptive for the receiving employer as misappropriation claims are for the former employer.
Watch the run-up, not just the exit
By the time a resignation letter arrives, the download has usually already happened. Data-loss-prevention tooling that flags unusual volume, off-hours access, mass syncing to personal storage, or bulk exports of customer records provides the early signal an exit interview cannot. Pair that monitoring with periodic reminders about approved AI tools, and with an approved-tool list clear enough that employees have no reason to reach for a personal account.
The takeaway
Trade secret protection is judged by what a company did before the loss, not by how loudly it objected afterward. A documented exit process that inventories AI usage, revokes standing integrations, obtains meaningful certifications, and preserves the device does more than manage risk. It creates the evidentiary record on which a future trade secret claim will succeed or fail. For more information about strengthening your company's exit procedures and protecting confidential information in the AI era, please contact Edward Lanquist Jr., Jennifer K. McCarty, or any member of Baker Donelson's Artificial Intelligence and Labor & Employment teams.