Don’t hoard your knowledge. Don’t dump it in a tool. Label it.

Companies tend to fail with knowledge in one of three ways. They hoard it in a few people’s heads, keep it in places or ‘vaults’ that gathers dust and irrelevance, or worse, they dump it into an AI tool nobody governs. All comes from the same gap: the knowledge has no labels. This guide maps ten places AI automation fits across company knowledge, workflows, and proprietary know-how. For each, it gives the evidence, who keeps the decision, and where to start. It also covers the secrecy rules your attorney will want you to know.

At a glance: 42% of the institutional knowledge is centered within one person in the company and nowhere else. Up to a 1/3 error rate for info retrieval for crucial knowledge or data. Proprietary information online isn’t always secure, with IBM breaches involving their use of AI, and lastly, the governance of AI usage is not followed through, with 78% of company users of AI bringing their own into the workplace.

What You’ll Find in This Article

• A story about an AI assistant that quoted a confident price from 2019 and a free chatbot that received a pricing formula, in the same month
• The Hoard-or-Dump Mistake: the two ways companies fail with knowledge, and why most owners worry about only one
• What AI can read and what it can’t: written memory versus practiced memory
• The Four-Label Rule (Owner, Date, Tier, Home) and a three-tier map of your knowledge: Open, Guarded, and Vault
• Ten places AI automation fits across company knowledge, workflows, and secrets, each with the evidence, the check, who decides, and where to start
• Three cases and studies: Air Canada’s chatbot ruling, Morgan Stanley’s internal assistant, and a Stanford test of retrieval-based AI
• What trade-secret law says about protecting what makes you hard to copy, including federal and Utah rules and a little-known notice requirement
• Six best practices, six little-known gems, a direct next step, and five FAQs

The Assistant Gave a Confident Price. It was from 2019

The assistant gave a confident price. It was from 2019.

A home-services company (illustrative composite, not a single named client)

The home-services company decided to give its team an AI assistant. The owner pointed it at twelve years of shared-drive files: price sheets, job notes, warranty terms, checklists, and old emails. In the first week, the office loved it. Answers came back in seconds.

In week two, a new scheduler asked the assistant what to quote for a standard repair. It answered quickly and confidently, with a price from a 2019 price sheet that sat in the same folder as the current one. The company honored the quote. Nobody had told the assistant which sheet was current, because nobody had ever labeled one. Their pricing had moved higher in the meantime, and they had to ‘eat’ the deficit.

That same month, an estimator who found the approved assistant slow pasted the company’s pricing formula and customer list into a free chatbot to build a quote template. He meant well. Nobody had told him which information could go into which tool, because nobody had ever decided.

The owner saw two problems. They were one problem. The company’s knowledge had no labels: no owner, no date, no rule about who could see it, and no rule about where it could live. So they wrote four labels, sorted their knowledge into three tiers, and rebuilt the assistant on the safest tier first, with every answer citing its source and date. It took longer to launch and was far easier to trust.

The Hoard-or-Dump Mistake is treating only one of two failures as the problem. A company can hoard its knowledge in a few people’s heads, or dust it off from the storage drive and dump all of it into an AI tool without deciding what is current, what is secret, or who may see it. Most owners worry about the first. AI makes the second easy to do by accident.

The Hoard-or-Dump Mistake

Companies tend to fail with knowledge in one of two main directions. They hoard it, leaving the know-how in a few experienced people’s heads. Or they dump it, loading everything into a tool without labeling what is current, what is secret, and who may see it. The mistake is solving one and creating the other.

The Hoard: Knowledge Only One Person Holds.

Panopto’s 2018 Workplace Knowledge and Productivity survey of 1,000 U.S. workers, as reported by HR Dive, found that 42% of institutional knowledge is unique to the employee in the role and not shared with coworkers. The same survey found workers lose 5.3 hours a week waiting for information from coworkers or recreating knowledge that already exists. It measures perception, not output, but the direction matches what most owners see.

McKinsey Global Institute’s 2012 report The Social Economy put a number on the search cost. It estimated that skilled office workers spend nearly 20% of the workweek looking for internal information or tracking down colleagues who can help with specific tasks. That is one day in five spent on a company’s memory problem.

The Dump: Knowledge Loaded with No Labels.

When a company loads every file into an assistant (and even this move is fraught with error and mistakes for keeping the data safe from prying eyes), the assistant has no way to know that a retired price sheet, a draft policy, and the current procedure are not equally true. Gartner’s February 2025 research predicted that through 2026 organizations will abandon 60% of AI projects unsupported by AI-ready data. It also found that 63% of organizations either do not have, or are unsure whether they have, the right data management practices for AI.

Dumping also moves secrets. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of AI users bring their own AI tools to work. IBM’s 2026 Cost of a Data Breach report, as summarized by the law firm Baker Donelson and the security firm Varonis, found that shadow AI (unapproved AI use by employees) was involved in 43% of breaches, up from 20% in the 2025 report.

If your knowledge has no labels, you are running both failures at once: part of it is stuck in a few heads, and the rest is loose in tools nobody chose.

What AI can read, and what it can’t

Every company has two memories. Written memory is what sits in documents, tickets, emails, recordings, and systems. Practiced memory is what people do without looking it up: which customer gets a call first, which supplier slips in December, which setting works on which machine. An AI tool pointed at your files can read only the first.

The philosopher Michael Polanyi named the problem in The Tacit Dimension (1966): we can know more than we can tell. A good share of practiced memory is exactly that: knowledge a person uses well and cannot easily explain. Asking an expert to “write it all down” usually produces a thin document, which is why that advice so often fails.

Practiced memory is not out of reach, though. In a study of 5,179 customer support agents published in the Quarterly Journal of Economics in 2025, Erik Brynjolfsson, Danielle Li and Lindsey Raymond found that an AI assistant raised productivity 14% on average and 34% for novice and low-skilled workers, with minimal impact on experienced workers. The authors report suggestive evidence that the model disseminates the best practices of more able workers, and they found it increased employee retention. Practice shows up as behavior in conversations, decisions, and edits, and AI can help spread it once a company records and reviews that behavior.

The sibling article on key-person risk, AI Operations: Automating Supply Chain, Scheduling & More, covers the hoard side in depth. This article covers the other half: what to do once the knowledge is out.

The Four-Label Rule: Owner, Date, Tier, Home

Before AI touches any piece of company knowledge, a company should be able to answer four questions about it. We call this the Four-Label Rule. It is MediaBus Marketing Group’s working method, not an industry standard, and it is built to fix both halves of the mistake.

• Owner: one named person is accountable for the knowledge being right.
• Date: the last time anyone confirmed it, so old answers expire on a schedule instead of lingering.
• Tier: who may see it.
• Home: which systems may hold it and which AI tools may read it.

A fact missing any label is not ready for an AI assistant.

Three tiers: Open, Guarded, Vault.

• Open knowledge is safe for every employee and for approved AI tools: standard procedures, FAQs, public product specs, checklists.
• Guarded knowledge is available only to the roles that need it, inside tools with access controls: pricing logic, customer records, contracts, financials.
• Vault knowledge is the small set of things that make you hard to copy: formulas, process settings, source code, supplier terms, unannounced plans. It stays out of public AI tools and goes into any other AI system only if your attorney and the vendor’s contract allow it.

Start with the Vault. List the five things a competitor would pay the most to know about how you operate. Decide where each one may live before you load anything else into an AI tool.

The Ten Places AI Fits Across Company Knowledge

Company knowledge moves through three jobs: capturing it, using it, and keeping it true and safe. The map groups ten places under those jobs. Each place below carries a starting level from MediaBus Marketing Group’s Autonomy Ladder: Level 1 Assist, Level 2 Workflow, and Level 3 Agent. The pillar article, Mastering AI Automation for LLM Success, explains the ladder, and its rule applies here: treat each automation like a hire, and promote it only after it has earned the next level.

Where to start each place

The matrix summarizes the starting level for each place. A filled circle means start there. A ring means the tool should earn that level with a track record first. A cross means a person stays in charge, because a wrong or leaked answer costs too much to automate away.

Case 1: Air Canada’s chatbot and its own policy page

In February 2024, British Columbia’s Civil Resolution Tribunal decided Moffatt v. Air Canada. A customer asked the airline’s website chatbot about bereavement fares and was told he could request the discount within 90 days of ticketing. Air Canada’s own bereavement page, which the chatbot linked to, said the policy did not apply after travel. Air Canada argued it could not be held liable for what its chatbot said. The tribunal rejected that, writing, “It should be obvious to Air Canada that it is responsible for all the information on its website,” and finding the airline “did not take reasonable care to ensure its chatbot was accurate.” It ordered a total of C$812.02.

The amount was small, and the lesson was not. Two parts of one website disagreed; the chatbot repeated the wrong one with full confidence, and the company owned the answer. The decision is from a Canadian tribunal, not a U.S. court, so treat it as a warning, not as binding law here. The lesson is about knowledge hygiene: your own pages must agree before an assistant can be trusted to repeat them.

Case 2: Morgan Stanley’s internal assistant

OpenAI’s published case study describes AI @ Morgan Stanley Assistant, an internal chatbot built on GPT-4 for the firm’s financial advisors. The firm went from answering about 7,000 questions to answering from a corpus of 100,000 documents, and over 98% of advisor teams actively use it, according to the case study. It is a vendor-published account and not an independent audit, but it shows the pattern that works: a defined group of users, a defined body of documents, and a question the people actually ask every day.

Case 3: Stanford’s test of retrieval-based AI

Stanford researchers tested leading AI legal research tools from LexisNexis and Thomson Reuters that use retrieval-augmented generation, meaning they search a document set before answering. They found each tool hallucinated between 17% and 33% of the time. That was less often than GPT-4, but it contradicted vendor claims of “hallucination-free” or “eliminated” errors, and the authors concluded those claims were overstated.

One caution applies: this study covers legal research, so borrow the principle, not the number. The principle is that pointing an assistant at your documents lowers its errors without removing them. Citations, dates, a way to say “I don’t know,” and a person checking anything consequential are how you manage what remains.

A Secret is Only a Secret IF You Can Show You Protected It

Federal law defines a trade secret in 18 U.S.C. § 1839(3). Information qualifies only if the owner has taken “reasonable measures to keep such information secret” and the information derives independent economic value from not being generally known. Utah’s Uniform Trade Secrets Act (Utah Code § 13-24-2) similarly requires that the information be “the subject of efforts that are reasonable under the circumstances to maintain its secrecy.”

Law-firm commentary in 2026 warns that pasting trade secrets into public AI tools can undermine that showing. Sheppard Mullin wrote in March 2026 that “the mere act of entering trade secrets into a public generative AI tool may itself threaten their protected status,” especially where a vendor’s terms may permit using inputs for model training. Polsinelli made a similar point in August 2026 and recommends identifying and categorizing trade secrets so employees know what can’t go into AI tools. These are lawyers’ analyses, not court rulings, and enterprise tools with contractual confidentiality terms may be treated differently.

The practical point is that “reasonable measures” is something you can show or fail to show. A written AI-use policy, approved tools, labeled tiers, access controls, and documented training are evidence you took reasonable measures. Sheppard Mullin notes that reasonable measures are judged when the alleged misappropriation occurred, so a policy adopted after a leak does not protect you retroactively.

A related rule catches many companies by surprise. Under 18 U.S.C. § 1833(b), an employer must give employees notice of the federal whistleblower immunity in any contract or agreement that governs the use of a trade secret or other confidential information. An employer that fails to give the notice cannot recover exemplary damages or attorney fees against that employee in a trade secret action. If your confidentiality agreements were written from an older template, ask your attorney whether they include it.

Sources Cited in This Article

• Moffatt v. Air Canada, 2024 BCCRT 149
• Stanford, “Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools” (arXiv)
• Brynjolfsson, Li and Raymond, Generative AI at Work (NBER)
• HR Dive on Panopto’s 2018 knowledge-sharing survey
• McKinsey Global Institute, The Social Economy
• Gartner, Lack of AI-Ready Data Puts AI Projects at Risk
• Microsoft and LinkedIn, 2024 Work Trend Index
• Baker Donelson, Ten Takeaways from IBM’s 2026 Cost of a Data Breach Report
• Varonis, IBM’s 2026 Cost of a Data Breach Report
• OpenAI, Morgan Stanley case study
• CIO Dive, McKinsey’s Lilli
• 18 U.S.C. § 1839 (govinfo)
• 18 U.S.C. § 1833 (govinfo)
• Utah Code § 13-24-2
• Sheppard Mullin, The AI Knows Too Much
• Polsinelli, Is Your AI Strategy Putting Your Trade Secrets at Risk?
• Orrick, Utah AI law tracker