AI data market

Employees moonlighting as AI trainers: confidentiality risks for employers

By SourceX Editorial · Reviewed by Noah Loul · October 9, 2026

Short answer

Employees moonlighting as AI trainers create confidentiality risk when they bring employer information into the work: real tickets, code, client details or internal methods used as examples. The side job itself is often lawful. The practical rule: allow general expertise, prohibit employer and client information, and route any use of company records through company-level licensing.

Key takeaways

The risk lies in the information employees bring to AI training work, not in the side job itself.
Writing model answers and grading responses invites people to reuse real examples from their day job.
Existing NDAs and invention assignment terms already apply, but employees rarely connect them to AI work.
Some states limit employer control over lawful off-duty work, so policies should target information rather than ban side jobs.
Company records belong in company-level licensing with rights review and preparation, not in individual contributions.

Why does moonlighting as an AI trainer create confidentiality risk?#

Moonlighting as an AI trainer creates confidentiality risk because the work rewards realistic, expert examples, and an employee's most realistic examples come from the day job. Expert networks and AI training platforms recruit engineers, estimators, accountants, project managers and other professionals to write tasks, model answers and grades for AI systems.

Most of that work draws on general skill and is not a concern for the employer. The risk starts when a task asks for a realistic scenario and the employee pastes in a real support ticket, a code snippet, a client's specification or the company's pricing logic, lightly edited to look generic.

Where company information leaks into AI training work#

AI training work usually means writing questions with correct answers, ranking model responses, solving domain problems step by step and reviewing outputs for errors. Each format has its own leak path, and none of them requires bad intent.

Platforms often tell contributors not to submit confidential material, and many require contributors to sign their own NDAs. Those terms protect the platform and its customers; they do not protect the employer, which is not a party to them.

Writing tasks: employees base scenarios on real jobs, clients or incidents.
Model answers: employees reuse internal procedures, templates or calculations.
Code review: employees paste employer code to show a realistic bug.
Grading: employees explain why an answer is wrong by describing how their company handles the case.
Screen recordings and uploads: work tools, client names or documents appear in the background.

Risk checklist for employers#

The checklist covers the risks employers most often need to address and a control for each. Most of these controls already exist in some form; the usual gap is that nobody has connected them to AI training work.

Trade secret protection depends in part on the owner taking reasonable measures to keep information secret; the federal definition in 18 U.S.C. 1839(3) makes those measures a condition of protection. A clear policy, training and consistent enforcement are part of those measures, which is one reason to address AI training work by name rather than rely on a general clause.

Risk checklist for employers
Risk	How it happens	Control to consider
Trade secrets	Pricing logic, methods or formulas used as examples	Named policy, training and access controls
Client confidential information	Client specifications or project scenarios reused	Reminders of client NDAs and confidentiality terms
Code and work product	Employer code pasted into tasks or reviews	Invention assignment terms and repository access controls
Personal data	Customer or colleague details in examples	Privacy training and a clear prohibition
Conflicts of interest	Work for a platform whose customer competes with the employer	Outside activity disclosure
Time and equipment	Tasks done on company devices, accounts or hours	Device and acceptable use policies
Reputation	Contributor profiles that cite the employer	Rules on use of the company name

What a policy can and cannot do#

A moonlighting policy can control which information employees use and how they identify themselves, but it may not be able to ban lawful side work outright. Some states limit how far employers can restrict lawful off-duty activity or claim inventions made on personal time with personal equipment, so counsel should check the law in each state where staff work.

Blanket bans also tend to fail in practice. They push the work out of sight, which is the opposite of what the employer needs, and they can sit awkwardly with remote teams spread across several states. A narrower policy that employees understand is easier to follow and easier to enforce.

Policy clauses to consider#

Policy clauses work best when they name AI training work specifically and are short enough to remember. The clauses below are common starting points for counsel to adapt to the company's existing handbook and agreements.

Definition: AI training work includes writing, rating, reviewing or recording content for AI developers or training platforms.
Disclosure: employees disclose AI training work through the existing outside activity process.
Information: no employer, client or colleague information, in original or edited form.
Equipment: no company devices, accounts, networks or working hours.
Name: no reference to the employer in profiles or submissions without approval.
Existing terms: a reminder that confidentiality and invention assignment agreements still apply.
Company records: any use of company records for AI goes through the company's own approval process.

How to respond if you find a problem#

Responding to a suspected leak works best when the response is calm and fact-based. Start by learning what was shared, on which platform and when, and preserve the relevant evidence before contacting anyone outside the company.

Platforms usually have a process for removing contributor submissions, and counsel can advise on requests to the platform or to the employee. Avoid treating lawful side work itself as misconduct; focus on the information involved and on closing the gap that allowed it.

Illustrative: a quality engineer adapts a real NCR#

Illustrative: a quality engineer at a fictional precision parts manufacturer joins an expert platform that pays professionals to write manufacturing problem sets for AI models. Most tasks use textbook scenarios, but for one task the engineer adapts a real nonconformance report from the company's QMS, with the customer name removed but the part geometry and failure details intact.

A colleague mentions the side work, and the quality director raises it with HR and counsel. They confirm that the engineer's agreement covers confidential information and that the adapted report still carries customer-specific details. The engineer asks the platform to remove the submission, and the company updates its outside activity policy to name AI training work.

The engineer keeps the side job using generic problems. Leadership then asks a separate question: whether the company's own NCR and CAPA history could be licensed under its control, with customer-owned designs excluded and personal details removed.

Why company-level licensing is different#

Company-level licensing differs from individual contributions because the company decides what is shared, reviews its rights and removes personal and confidential details before anything moves. An individual employee cannot grant rights in company records, and a developer that wants operational records has good reason to prefer a documented license from the company.

SourceX runs company-level licensing through the SourceX five-step transaction, Supply, Rights, Preparation, Approval and Delivery, with the company approving every step. Records are licensed, not sold outright, and customer-owned material is identified and excluded during the rights review.

Frequently asked questions

Can we ban employees from working for AI training platforms?

It depends on state law, the employee's role and existing agreements. Some states protect lawful off-duty activity, and broad restrictions can be hard to enforce. Many employers instead require disclosure, prohibit any use of company and client information, and restrict work that serves direct competitors. Counsel can advise on what is enforceable where your staff work.

Do platform NDAs protect our confidential information?

Not directly. A contributor's NDA with a platform protects the platform and its customers, and the employer is not a party to it. The employee's own obligations to the employer still apply, and the employer's remedies run mainly against the employee. That is why internal policy and training carry most of the weight.

What if an employee uses only general knowledge?

General skills and knowledge an employee brings to a job usually remain theirs to use, subject to their agreements and state law. The line is crossed when content reflects the employer's confidential information, such as specific methods, client details or code. Policies work best when they explain that line with concrete examples from the company's own work.

Should we tell employees the company is exploring licensing its own records?

Consider it. Employees who know the company may license records through a controlled process have less reason to think their own contributions are harmless, and employee notices may be relevant to a licensing program anyway. Keep the message factual and avoid promising any outcome.

Are contractors exposed to the same risks?

Yes, and sometimes more so. Contractors may work for several clients and platforms at once, and their agreements may carry weaker confidentiality or IP terms than employee agreements. Review contractor agreements for confidentiality, IP assignment and permitted outside work, and update templates to address AI training work explicitly.

Sources

Under 18 U.S.C. 1839(3), information qualifies as a trade secret only if the owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

Explore licensing records the controlled way Talk to SourceX