Commercial Contracts

As generative AI becomes increasingly accessible and pervasive, many companies are experimenting with these tools to draft full legal agreements. For start-ups and businesses with limited resources, the appeal is obvious: AI can produce contracts quickly and at a fraction of the cost of traditional legal drafting. What once may have required days of attorney time and high legal fees can now theoretically be generated in minutes with a simple prompt.

While this efficiency is attractive, it comes with significant risks. AI-generated agreements frequently contain significant issues that ultimately make them unusable. Unlike an experienced attorney, AI lacks legal judgment, contextual understanding, and knowledge of specific client needs. It can generate provisions that appear polished on the surface but collapse under scrutiny.

One recurring issue is the inclusion of multiple conflicting provisions. For example, a recent AI-generated supply agreement included three different payment mechanisms for the same transaction: upfront payment, milestone-based installments, and payment upon delivery after invoicing. With three competing payment obligations for a single transaction, the contract leaves the payor guessing and sets the stage for potential disputes.

Another problem is language that reads like legal boilerplate but is, in fact, incoherent or legally meaningless. AI may generate complex wording that mimics the tone of a lawyer’s drafting, but it lacks the precision required in contract language. This can make agreements unnecessarily confusing and difficult to interpret. For example, a recent AI-generated commercial contract included the following dispute resolution provision:

“Any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or invalidity thereof, shall be finally settled by arbitration in São Paulo, Brazil, in accordance with the rules of the American Chamber of Commerce, Canadian Chamber of Commerce, or other mutually agreed renowned Chamber of Arbitrations.”

This dispute resolution clause has several problems. First, it does not identify the exact set of rules governing arbitration proceedings between the parties. More importantly, there are no such rules of the “American Chamber of Commerce” or the “Canadian Chamber of Commerce” and it is unclear what would be considered a “renowned Chamber of Arbitrations.” Finally, it is highly unlikely that parties resolving a dispute in Brazil would choose to apply American or Canadian-based arbitration rules. An attorney with even minimal experience in drafting arbitration provisions would not make these errors.

The underlying issue is that AI generates text based on patterns, not legal reasoning. It predicts what “sounds” like a contract without understanding enforceability, legal doctrine, or commercial practicality. Given the risks, companies should treat AI-generated contracts with caution. As such, attorney review remains essential to make sure agreements are clear, consistent, and tailored to the business’ needs.

After a US$750 million acquisition, the parties ran the usual post-closing true-up that adjusts the price based on the target’s actual financials at closing. It turned out the seller had misapplied a revenue-recognition accounting standard in its pre-closing books, and once the standard was applied correctly the buyer owed roughly US$38.3 million more. The buyer paid, then sued separately for indemnification, arguing the seller had promised its financial statements complied with accounting standards and that promise was false. The Delaware Court agreed and let the buyer recover the extra payment.

The Court rejected the seller’s arguments that the buyer should have caught the error in due diligence, that the claim belonged in the earlier case, or that a contract clause barring double recovery blocked it. Diligence is not an audit, the claim was not ripe until the true-up concluded, and the anti-duplication clause was meant to prevent collecting twice, not to eliminate indemnity claims. The Court determined that a price true-up fixes the number, but does not by itself decide who bears the cost of an inaccurate representation.

One of the most common legal missteps among emerging companies involves the classification of the people doing the work. In the earliest days of a startup, founders often bring on talented individuals as “consultants” or “independent contractors,” compensating them primarily or exclusively with equity. This arrangement feels natural when cash is scarce and everyone is pitching in to build something from the ground up. But what begins as a practical solution can quickly become a significant legal liability if the company does not revisit these classifications as it matures and secures funding.

This article provides a high-level overview of the risks associated with worker misclassification, the key legal frameworks that govern these determinations, and the steps founders should take to clean up classification issues before they become costly problems.

The Common Pattern: Early “Consultants” Who Are Really Employees

It is extremely common for pre-revenue startups to engage early team members as independent contractors or consultants. The logic is straightforward: The company cannot yet afford salaries, payroll taxes, or benefits, so it issues equity in exchange for labor. On paper, the individual signs a consulting agreement, invoices the company (or doesn’t), and is treated as a 1099 worker for tax purposes.

The problem is that many of these individuals are, as a matter of law, employees regardless of what the agreement says. Classification is not a matter of mutual agreement between the parties. It is determined by the nature of the working relationship under applicable federal and state law. If the engagement looks and feels like employment, then government agencies and courts are likely to treat it as such.

When these individuals are never reclassified, the company accumulates exposure over time. That exposure includes unpaid wages, overtime, employment taxes, penalties, and potential liability under both federal and state law. These issues often surface at the worst possible moment: during due diligence for a funding round, an acquisition, or in response to a complaint filed by a disgruntled former worker.

Why Reclassification Should Be a Priority After Funding

Securing any meaningful financing event should serve as a trigger for the company to revisit every worker classification. There are several reasons for this.

First, the original justification for the consulting arrangement, namely the inability to pay cash compensation, has likely changed. Once the company has capital, it has the resources to bring workers onto payroll and provide the protections required by law. Continuing to classify a worker as an independent contractor when the company now has the means to pay wages and withhold taxes weakens any argument that the arrangement was legitimate.

Second, investors and their counsel will scrutinize the company’s employment practices during due diligence. Misclassification issues are a well-known red flag. Unresolved classification problems can delay or even derail a financing, reduce the company’s valuation, or result in specific indemnification obligations imposed on the founders.

Third, as the company grows, the risks multiply. More workers mean more potential claimants. Longer periods of misclassification mean larger back-pay and tax liabilities. And the shift from a small, informal team to a structured organization makes it increasingly difficult to argue that any given worker was genuinely operating as an independent business.

The bottom line is that reclassification is not merely a housekeeping exercise. It is a critical step in putting the company on sound legal footing for its next phase of growth.

Federal Law: The Key Frameworks

At the federal level, worker classification is governed by several overlapping tests, depending on the statute at issue.

The Fair Labor Standards Act

‍The FLSA uses an “economic reality” test to determine whether a worker is an employee or an independent contractor. The inquiry focuses on whether the worker is economically dependent on the company or is in business for themselves. Factors include the degree of control the company exercises over the work, the worker’s opportunity for profit or loss, the worker’s investment in equipment or materials, the permanence of the relationship, the degree of skill required, and the extent to which the work is an integral part of the company’s business. The Department of Labor has historically taken a broad view of employment under this test, and the consequences of misclassification include liability for unpaid minimum wages and overtime, liquidated damages, and attorneys’ fees.

The Internal Revenue Code

‍The IRS applies a common-law test that examines the degree of control and independence in the relationship. The IRS groups relevant factors into three categories: behavioral control (whether the company directs how the work is done), financial control (whether the company controls the business aspects of the worker’s role, such as how the worker is paid and whether expenses are reimbursed), and the type of relationship (including written contracts, benefits, and the permanence of the engagement). Misclassification under the tax code can result in liability for unpaid employment taxes, penalties, and interest. In some cases, officers of the company may face personal liability under the trust fund recovery penalty.

Exempt vs. Non-Exempt Classification

‍Once a worker is properly classified as an employee, the company must also determine whether the employee is exempt or non-exempt under the FLSA. Exempt employees are not entitled to overtime pay, but they must meet specific salary and duties tests. The most commonly applicable exemptions for startups are the executive, administrative, professional, and computer employee exemptions. Each requires that the employee be paid on a salary basis at or above a specified threshold and that the employee’s primary duties satisfy specific criteria. Founders should not assume that simply paying a salary or giving someone a managerial title is sufficient. The analysis turns on the actual duties performed, not the job title.

State Law: Where the Rules Get Stricter

Many states impose classification standards that are more restrictive than federal law, and compliance with federal standards alone does not guarantee compliance at the state level.

California’s ABC Test

‍California applies a particularly stringent standard under its ABC test, codified by Assembly Bill 5. Under this test, a worker is presumed to be an employee unless the hiring entity demonstrates that the worker (A) is free from the company’s control and direction in performing the work, (B) performs work that is outside the usual course of the company’s business, and (C) is customarily engaged in an independently established trade, occupation, or business of the same nature as the work performed. Prong B is often the most difficult to satisfy for startups, because early workers are typically performing tasks that are central to the company’s core business. California law also provides for significant penalties for misclassification, including penalties under the Private Attorneys General Act, which allows employees to bring representative actions on behalf of the state.

Other Notable State Frameworks

‍Several other states have adopted or are moving toward ABC-style tests, including Massachusetts, New Jersey, and Illinois. New York applies a similar multi-factor test and has aggressive enforcement mechanisms. States vary considerably in their approaches, and companies with remote workers in multiple states must ensure compliance in each jurisdiction where a worker is located, not merely where the company is headquartered. Founders should be particularly attentive to any state in which the company has workers, as the applicable test is generally determined by the worker’s location.

Cleaning Up Past Misclassification

For companies that have already been operating with misclassified workers, there are several steps to consider when undertaking a remediation effort.

The first step is to conduct an honest internal audit. Identify every individual who has been engaged as a contractor or consultant and evaluate each engagement under the applicable federal and state tests. Determine which individuals are likely misclassified and assess the duration and scope of the exposure.

The second step is to consult with experienced employment counsel. Remediation strategies vary depending on the jurisdiction, the number of affected workers, the duration of misclassification, and the company’s financial position. In some cases, the IRS Voluntary Classification Settlement Program may be available, which allows companies to prospectively reclassify workers with limited look-back liability in exchange for a modest payment. Similar programs or settlement frameworks may exist at the state level.

The third step is to transition misclassified workers to employee status going forward. This includes placing them on payroll, withholding applicable taxes, providing required benefits, and ensuring compliance with wage and hour laws, including proper exempt or non-exempt classification.

The fourth step is to address the equity arrangements already in place. Early equity grants made to individuals who should have been classified as employees may have been structured as contractor grants, which have different tax treatment than employee equity awards. Companies should work with both employment counsel and tax advisors to evaluate whether corrective filings or revised equity documentation are necessary, particularly with respect to Section 409A of the Internal Revenue Code, which governs deferred compensation and imposes significant penalties for noncompliance.

Finally, companies should implement classification policies and procedures that will prevent these issues from recurring as the company continues to hire. A brief intake process for every new engagement, whether employee or contractor, can go a long way toward ensuring that the correct classification is applied from the outset.

Generative artificial intelligence (GenAI) tools are becoming increasingly utilized by employees in the workplace to enhance productivity. However, employees are frequently leveraging these tools without formal approval or oversight. While the benefits of GenAI tools may be substantial, use of GenAI may pose significant risks to organizations, including legal liabilities, data breaches, and reputational damage. This article explores certain key concerns associated with employee use of GenAI tools and essential components of an AI use policy.

Understanding the Risks

Data Privacy and Security

One of the most significant risks with the use of GenAI is that information entered into prompts or uploaded to common GenAI platforms may reveal to the AI tool sensitive or confidential company information or information about clients or customers, including information the company may have contractually agreed to keep confidential. Similar risks exist with inputs of personally identifiable information, such as email addresses or other identifiers. Typically, on publicly-available versions of such tools, data that is entered is used to train the AI or may otherwise be stored or used by the AI tool developer.

To mitigate risks of exposing potentially sensitive company data or potentially breaching customer confidentiality agreements, companies may want to consider purchasing enterprise versions of GenAI tools that operate in a closed-loop system, meaning the developer is not permitted to use or store inputs for purposes other than to provide the GenAI tool. Companies may also want to have an approved list of AI tools, which might include enterprise versions of common GenAI tools. Also helpful in mitigating risks is employee training and raising awareness of these risks.

Another significant and emerging risk is that GenAI tools are increasingly being used as a tool for cybercriminals, including through the orchestration of complex injection attacks that exploit the fact that these tools do not think, but rather, simply follow instructions. For example, attackers can embed instructions in publicly available links that, when uploaded to the GenAI tool, tell the tool to maliciously attack the host system and override instructions. Alternatively, the embedded instructions in public links could produce PDFs or other outputs that themselves contain malicious code. Companies should consult with their security team about the risks unique to their business and implement recommended controls if applicable. In addition, companies may want to consider working with external cybersecurity training providers to ensure their materials include coverage of AI tool injection attacks in employee training modules.

Intellectual Property Concerns

Companies should also seriously consider the significant intellectual property (IP) risks posed by employees’ use of GenAI tools. These IP risks arise from two factors: (1) the material used as “input” to train the AI models; and (2) the material generated by the AI model as “output”. AI models are frequently trained on vast datasets which include copyrighted material used without the author’s permission. Furthermore, use of such copyrighted material may cause the GenAI tool to generate outputs that replicate or closely resemble the copyrighted material, further exposing the user to potential copyright infringement claims.

Another IP risk associated with employees’ use of GenAI tools is the lack of IP protection for works and innovations created using GenAI. In the United States, works and innovations created solely by AI without human contribution are not eligible for copyright or patent protection. Without such protections, a company’s competitive advantage may fall into the public domain, where anyone can use it for free.

Use of GenAI may also compromise trade secret protection of a company’s proprietary information. If an employee inputs confidential proprietary information into GenAI tools without proper contractual protections, such information may be used to train the underlying AI models. As noted above, GenAI tools may generate outputs that replicate or closely resemble the inputs, in this case, the proprietary information, potentially exposing the trade secret to other users and compromising the company’s trade secret protection of the information.

Hallucinations and Bias

AI systems, particularly generative models, can produce outputs that appear plausible but are factually incorrect or nonsensical, a phenomenon known as “hallucinations.” These inaccuracies can lead to misguided business decisions, flawed reports, and erosion of trust in AI tools. For instance, an AI-generated report might cite non-existent studies or fabricate data, potentially leading to compliance issues or reputational damage.

Shadow AI Usage

Employees may use unauthorized AI tools (sometimes referred to as “shadow AI”) without the knowledge or approval of IT departments. This practice can result in data security breaches, compliance violations, and loss of control over sensitive information. For example, inputting confidential company data into unvetted AI platforms could inadvertently expose proprietary information. Companies should implement strict policies around shadow AI use and consider limiting access to popular AI tools on workplace computers.

Regulatory Compliance Challenges

The rapidly evolving landscape of AI regulations, such as the European Union’s AI Act, presents compliance challenges for organizations. Failure to adhere to these regulations can result in legal penalties and hindered innovation. Organizations must stay informed about regulatory changes and implement robust governance frameworks to ensure compliance.

DO’S & DON’TS:

Legal Compliance & Policy Design

DO:

• Establish a clear, tailored AI usage policy in collaboration with legal, IT, and compliance teams.
• Define “AI” in plain language, and specify which tools are approved.
• Include a mission or purpose statement to ground the policy in transparency, fairness, and innovation.
• Update the policy regularly to reflect evolving laws (e.g., EU AI Act, state legislation like Colorado’s).

DON’T:

• Don’t use one-size-fits-all policy templates. Each policy should reflect specific business risks and use cases.
• Don’t treat the AI policy as a one-time exercise. Legal exposure grows without active maintenance.

Data Security & Confidentiality

DO:

• Prohibit inputting sensitive, proprietary, or customer data into public AI tools unless specifically authorized.
• Include clear confidentiality provisions related to AI use in employee and vendor contracts.
• Conduct vendor due diligence to confirm AI platforms’ compliance with privacy laws and data handling standards.
• Consider using enterprise versions of AI tools to keep data inputs confidential.

DON’T:

• Don’t assume that AI tools won’t retain user input; review each tool’s terms of service and retention practices.
• Don’t allow shadow IT (e.g., unauthorized browser plugins, personal-use tools) without approval or audit trails.

Intellectual Property & Ownership

DO:

• Review AI vendor agreements to ensure the vendor has proper rights to use training data and provides adequate protections if infringement claims arise.
• Implement human review processes for AI-generated materials to identify potentially infringing content.
• Document human contributions in connection with the development of AI-assisted works and innovations.

DON’T:

• Don’t allow employees to generate customer-facing or public materials without review for potentially infringing content.
• Don’t use AI models trained on unlicensed data without understanding the risk of potential IP infringement claims.
• Don’t allow employees to input confidential proprietary information into AI tools without proper confidentiality and use restrictions.

Training, Governance, & Oversight

DO:

• Require regular employee training on the capabilities, limits, and risks of AI tools.
• Designate responsible roles (e.g., AI Compliance Lead, Tool Vetting Committee) to oversee implementation and approvals.
• Monitor AI tool usage, audit outputs periodically, and solicit user feedback to improve policies.

DON’T:

• Don’t deploy AI tools enterprise-wide without pilot testing, user education, and risk assessment.
• Don’t assume all departments or roles should have equal access to AI tools — access should be role-specific.

Ethical Use & Bias Prevention

DO:

• Embed fairness, transparency, and accountability principles into the company’s AI governance framework.
• Monitor AI systems for evidence of bias, particularly in HR, marketing, or customer interaction tools.
• Require disclosures when AI is used to create or assist in work product — internally or externally.

DON’T:

• Don’t use generative AI content without fact-checking — misleading outputs could carry reputational or legal costs.
• Don’t let AI output go unlabeled in sensitive contexts (e.g., client deliverables, compliance filings).