The Evolving Landscape of Trade Secret Protection: GenAI, Cyber Risk, and the ‘Reasonable Steps’ Standard
2025 marked a pivotal year where Generative AI (GenAI) became commonplace and cyber threats escalated. While initial fears of a surge in trade secret litigation directly linked to these factors haven’t fully materialized in UK courts, a crucial question is emerging: what constitutes “reasonable steps” to protect trade secrets in this new era? The intersection of equitable duties, contractual obligations, and rapidly evolving technology is reshaping the legal landscape.
Director Accountability: A Heightened Focus
Recent cases, such as Illiquidx Ltd v Altana Wealth Ltd & others [2025] EWHC 299 (Ch) and IBM United Kingdom Ltd v LzLabs GmbH & Ors [2025] EWHC 532 (TCC), demonstrate a growing trend of holding directors personally liable for breaches of confidentiality. The key isn’t simply a breach occurring, but whether the director possessed knowledge of the facts rendering the act unlawful. This underscores the need for directors to be actively informed about data security protocols and contractual obligations related to trade secrets.
The Challenge of Precise Identification
Successfully pursuing a trade secret misappropriation claim hinges on clearly defining the confidential information. Courts, as highlighted in Celgard LLC v Shenzhen Senior Technology Material Co Ltd [2020] EWCA Civ 1293 and reiterated in Playtech Software Limited v Realtime SIA & Anor [2025] EWCA Civ 1472, require a “particularized” description. Vague assertions of confidentiality are insufficient. This is particularly critical when dealing with complex technical information or data sets.
Did you know? A well-defined trade secret policy, regularly updated and communicated to employees, is a crucial first step in establishing the necessary level of specificity.
Public Knowledge in the Age of Data Breaches
Traditionally, information entering the public domain extinguished its status as a trade secret. However, the rise of data breaches and the dark web complicate this principle. If stolen trade secrets are published on the dark web, does that automatically negate their confidential status? Courts are beginning to grapple with this question, leaning towards maintaining confidentiality if the information remains “relatively secret” – meaning not widely accessible or understood beyond a limited group. The key is whether the publication fundamentally alters the information’s commercial value due to its widespread availability.
GenAI and the ‘Reasonable Steps’ Threshold
The most pressing question for 2026 and beyond revolves around the “reasonable steps” required to protect trade secrets in the face of GenAI and escalating cyber risks. Regulation 2 of the Trade Secrets (Enforcement, etc.) Regulation 2018 outlines this requirement. Simply having NDAs and “confidential” markings may no longer be sufficient.
Several factors will likely be considered:
- Employee Training: Comprehensive training on the risks of using GenAI tools with confidential information.
- Data Loss Prevention (DLP) Systems: Implementing robust DLP systems to monitor and prevent the unauthorized transfer of sensitive data.
- Cybersecurity Posture: Demonstrating a proactive and robust cybersecurity framework, including regular vulnerability assessments and incident response plans.
- GenAI Usage Policies: Clear policies governing the use of GenAI tools, prohibiting the input of confidential information.
- Monitoring and Auditing: Regularly monitoring employee activity and auditing GenAI usage to detect potential breaches.
The focus is shifting from simply preventing access to actively mitigating the risk of misuse, even in scenarios where data is compromised. Organizations will need to demonstrate a layered approach to security, adapting to the evolving threat landscape.
The Role of AI-Powered Security Solutions
Emerging AI-powered security solutions are offering new avenues for trade secret protection. These tools can identify and classify sensitive data, monitor user behavior for anomalies, and even detect the unauthorized use of confidential information in GenAI outputs. Investing in these technologies may become increasingly crucial to demonstrating “reasonable steps.”
Looking Ahead: Predictive Litigation and Proactive Measures
We can anticipate a rise in predictive litigation – where companies proactively seek to prevent potential breaches rather than reacting to them. This will involve more sophisticated risk assessments, enhanced due diligence during mergers and acquisitions, and a greater emphasis on contractual protections. The courts will likely scrutinize organizations’ security measures more closely, particularly in cases involving data breaches and GenAI misuse.
Frequently Asked Questions (FAQ)
- What is a trade secret?
- Information that is secret, commercially valuable because it is secret, and subject to reasonable steps to keep it secret.
- What are ‘reasonable steps’ to protect a trade secret?
- Measures taken by a company to protect confidential information, including physical security, data encryption, employee training, and contractual agreements.
- Can a director be held personally liable for a trade secret breach?
- Yes, if the director had knowledge of the facts making the act unlawful and failed to take appropriate action.
- Does publishing stolen trade secrets on the dark web automatically invalidate their trade secret status?
- Not necessarily. Courts may still consider the information confidential if it remains relatively secret and not widely accessible.
Protecting trade secrets in 2026 and beyond requires a proactive, multi-faceted approach. Organizations must adapt to the evolving threat landscape, embrace new technologies, and prioritize employee training and awareness. The legal framework is evolving, and a failure to demonstrate “reasonable steps” could have significant financial and reputational consequences.
Explore further: Read more articles on trade secret law and visit Norton Rose Fulbright’s IP litigation page for expert legal guidance.