AI REPORT: ISSUE NO.1

Prepared for you by the

team at Invisible Hand

AI TREND REPORT

July, 2026

The 2026

Invisible Hand

Report on

AI,

Inside: Expert insights,

emerging risks, and a

practical guide to

protecting your company.

THE UPPER HAND

If you’re surprised to learn that Invisible Hand’s inaugural trend

report is focused on Artiﬁcial Intelligence, you are not alone.

Nobody is more surprised than me. Here’s how that happened:

A few months after I started Invisible Hand, we were asked by a

major social media platform to work on a series of projects about

ethical tech and artiﬁcial intelligence.

The work was in our wheelhouse–convene brilliant minds, build

strategies that kept both communities and commerce centered.

The topics, though? Like something from a land faraway: How does

one build a code of conduct for virtual agents? What role should

identity and belonging play in personal avatars…. And those were

the easy ones. I ﬁgured we’d leave the project with a fascinating

case study, but in all my lifetimes I never thought these topics

would impact my own business.

Welp.

An underappreciated perk of agency work is that we are perpetual

students. One moment we are in deep research on mental health.

The next, we’re elbows-deep in education policy. Then we’re

learning about the inner workings of the Super Bowl. This makes

us excellent partners for your trivia night, but it also means that we

are often ringside to big cultural shifts as, or before, they happen.

Thanks to that initial AI project, and the many similar we’ve done

since, we’ve had an active, inside view of how the ﬁeld has evolved

— working with both the companies building it and the

organizations making sure we don’t bungle the largest tectonic

shift of our lifetime.

Friend, hello.

Genevieve Roth

Founder and CEO of Invisible Hand

This also meant that we were relatively early on embedding AI into

our own work. And like many of you, we did this without a map.

While I was besotted with the efﬁciency we experienced, I also

started to feel the nag of some pretty big questions. What is our

obligation to obtain client permission if we’re uploading their docs

to an agent? Did I just break the law? Or my own professional code

of ethics? How do we adopt innovation without quietly

compromising privacy, security, and trust?

We are all out here using these tools for our most essential work

while most of these questions remain unanswered. And the

stakes? They’re high. In this work, a data leak isn’t a ‘glitch.’ It’s a

breach of our only real currency: trust.

Earlier this year, Invisible Hand took the time to build that map we

couldn’t ﬁnd. And now we’re sharing it with you. Consider it your

practical guide to using AI thoughtfully, securely, and with purpose.

This is a living conversation. I’d love to know what you want to

learn next.

Your fan,

To have said it:

We built this report for everyone,

but we know it’s particularly

important for those who don’t

have the luxury of failing up —

especially women founders, and

underrepresented leaders.

Also, we’re just scratching the

surface here in terms of the

broader implications of artiﬁcial

intelligence. To name a few:

● Climate and

Environmental Impact

● Bias in the Model

(Training Data)

● Impact on Marginalized

Communities

While this report focuses on risks

for small businesses, we will be

looking at these very real issues in

subsequent volumes of this

ongoing discussion.

THE UPPER HAND

How Do I Use AI

(Safely) in My Work

The Practical Guide

to Co-Creation

The Control + V

Checklist

The Humans

in the Machine

Table of

Contents

THE UPPER HAND: A 2026 INVISIBLE HAND REPORT ON AI, PRIVACY,

+ YOUR BUSINESS

THE UPPER HAND

This report is built in two parts.

First, we look directly at the risks, gray areas, and quiet vulnerabilities

emerging across the way we work.

Then, we get practical: the conversations, guardrails, and next right

moves for protecting your people, your creative equity, and your

business without killing momentum.

What you will

not

find here is panic, posturing, or pretending that the

answer is to stop using AI altogether. Instead, we’ll take a clear-eyed

look at the moment we’re in and how to move through it intelligently.

Let’s get into it.

THE UPPER HAND CHAPTER ONE: HOW DO I USE AI SAFELY IN MY WORK?

Let’s talk about

privacy, trust,

and AI at work

safely

THE UPPER HAND

What a time to be alive and leading a company. We are all in the middle of the

largest shift in how work gets done in our lifetime.

The tools are extraordinary. The pressure to adopt them is real. So is the gap

between how fast we’ve moved and how much we actually understand about

what we’ve signed up for.

That gap is where this report lives.

It was written for people we at Invisible Hand stand shoulder to shoulder with:

leaders of nonproﬁts, executives of growing brands, founders of companies like

ours. Organizations that are already seeing massive efﬁciencies from AI, but

that might not fully know where the blind spots live. Teams that aren’t ignoring

the risks, but don’t fully know what those risks actually are.

Make no mistake, the litigators are outpacing the policymakers on this.

Without your own AI policy, you are unwittingly opening your organization up

to massive liability.

EVERYONE’S USING IT. ALMOST

NOBODY HAS A POLICY.

I’m genuinely optimistic about how AI

will transform the future of work, but I

also understand the uncertainty so many

leaders are carrying right now. What I

want everyone to understand is that AI is

not destiny, it is design. There are no

inevitabilities and no set future. This

technology does not have to happen to

us—it will be shaped by the choices we

make about what’s right for our people

and our organizations. There has

never been a more important

moment to lean in, learn, and build

the future we actually want.

HOW DO I USE AI SAFELY IN MY WORK?

“

Michele L. Jawando

CEO and Board Member

Omidyar Network

THE UPPER HAND

When privacy guardrails get murky, you are potentially compromising the

safety and trust of clients as well as opening yourself up to signiﬁcant liability

issues. While nobody wants to be left behind, few small businesses or nonproﬁts

have the resources to provide time and space for employees or contractors to

experiment and train on AI tools. So, many employees strike out on their own,

often without the proper protections in place to secure data, IP, and the mission of

their work.

Like yours, our team loves these new ways to take notes, draft emails, and organize

data. But these well-intentioned, low-information integrations are being used

without policies and without basic privacy protections. We don’t know enough

about how these tools actually work to know what we’re putting at risk.

We built this report to help you navigate that gray area. We aren’t interested in

white papers from ivory towers. We’re interested in the messy implementation —

the reality of protecting a mission-critical donor list while using tools that help us

scale without losing our humanity — or landing in court.

We talked to some of the smartest experts in the AI ﬁeld, including Michele L.

Jawando of Omidyar Network, Nabiha Syed of Mozilla Foundation, Zoe

Weinberg of ex/ante, Vasanth Sarathy of Leidos, Inc., Jen Weedon of Columbia

University, and Dr. Camille François of ROOST, among others. We are eager to

share our research and learning so that you can stop worrying about putting your

company in danger and start following our guide to keeping it safe.

HOW DO I USE AI SAFELY IN MY WORK?

LEARNING BY

DOING HAS A

LIABILITY

CLAUSE

THE UPPER HAND

75%

The Adoption Pressure: 75% of small businesses are already

leaning in, and those seeing the most growth are twice as likely to be

investing in AI. To opt out entirely is to risk being left behind. But few have

actual policies around the use of AI.

40%

Embedded Agents: AI is now built into 4 out of every 10 work

apps. Odds are, your team is using AI right now without even realizing it’s

there.

First, let’s look at the state of the state. How are we really

using AI in our work?

Lacking Guardrails: 79% of organizations DON’T have a mature

governance model for agentic AI. The technology is moving faster than the

guardrails.

79%

HOW DO I USE AI SAFELY IN MY WORK?

THE UPPER HAND

Will I lose ownership of our company

data and IP?

The Open vs. Closed Divide

Am I breaching my client’s conﬁdentiality

and breaking new laws?

Client Exposure & the Contract Gap

My company and personal data are

converging. Who can see what?

The “Shadow AI” Problem

Could AI get my employees — or me — ﬁred?

HR Violations and Risks

Is AI making me and my team look stupid?

How much are hallucinations costing you?

Is my company at risk of bad actors?

Exposure to Fraud and Bad Actors

HOW DO I USE AI SAFELY IN MY WORK?

THE SIX EXPOSURE

AREAS OUR

RESEARCH AND

EXPERTS SAY EVERY

BUSINESS SHOULD

BE THINKING

ABOUT

These are the questions to

ask (and answer).

THE UPPER HAND

WILL I LOSE OWNERSHIP

OF MY COMPANY DATA

AND IP?

HOW DO I USE AI SAFELY IN MY WORK?

The ﬁrst step in protecting your company, clients, and team is understanding

where your data actually goes when you use an AI product or service in your work.

Context: Many companies are uploading all manner of internal documents — mission

statements, style guides, databases — in the hopes of ﬁnding efﬁciencies,

brainstorming partners, etc. Efﬁcient? Yes. Risky? Perhaps…

Example: Imagine this: You’re planning an event and receive three RSVP ﬁles that need

to be combined and deduped. You could spend hours going line-by-line, or you could

upload the three lists and have an AI tool do it for you. Caution here, dear reader, for

not all AI tools are created equally.

The AI tools most of us use at work like Claude, ChatGPT, and Gemini come in two

versions: open and closed.

● Open/Consumer LLMs: Think of these as a public park. When you feed data

into a free, consumer-grade tool, that information is often used to “train” the

model. Anything you put in — a client’s case ﬁle, a sensitive strategy memo —

could theoretically resurface in someone else’s query.

● Closed/Enterprise LLMs: These are the digital equivalent of a locked vault.

These versions explicitly state that your data is not used for training and

remains within your organization’s walls.

If you aren’t paying for the seat, you are likely paying with

your data. Nothing in 2026 is free. Nearly 60% of

organizations cite data leakage as their primary

generative AI concern,

but if you’re using these ‘free’

tools, you are holding the door open for your data to be

used in training. IH recommends moving to a paid plan and

understanding the data share structure of that plan. At the

very least, you need to know what the AI’s policy is before

you share anything.

“Free sounds nice, but you

really have no control over

your context. What are

you paying with? You’re

paying with your training

data.”

Zoe Weinberg

Founder & Managing Partner @ ex/ante

ex/ante is the ﬁrst venture fund dedicated to

agentic technology, or tools that support human

agency by increasing privacy, security, and

information integrity

A bird’s-eye view of where common tools fall:

The AI ecosystem is vast and evolving. Every tool should be evaluated individually, but this provides a practical

framework for understanding some of the most widely used platforms and where they land.

Closed

Open

Claude ChatGPT Gemini

MetaAI/Grok DeepSeek

Anthropic and OpenAI both now

provide meaningful consumer opt-outs,

but only if you know how to use them or

if you’re in the “right” paid tier.

These systems provide the strongest

theoretical privacy because you can run

models locally, but only if you actually

self-host them, which most users do not.

Google has historically

had more fragmented,

difﬁcult to understand

consumer data controls.

HOW DO I USE AI SAFELY IN MY WORK?

THE UPPER HAND

Vasanth Sarathy, PhD, JD

Principal AI/ML Scientist

Leidos, Inc.

AM I BREACHING MY CLIENT’S

CONFIDENTIALITY AND

BREAKING NEW LAWS?

Client Exposure and the Contract Gap

Context: Perhaps the greatest immediate return that businesses see when using AI is the

ability to consolidate information quickly and ask questions about the work.

AI tools can streamline a lot and help you better reach some productivity goals. But if

you’re not checking in on your own employment contracts or your client agreements, you

might be violating the law.

Example: It’s your seventh meeting of the day. Your coffee stopped working about two

calls ago. A friend told you about an AI tool that will take notes and provide a summary for

you after the call. Sounds amazing! But if you haven’t checked your client’s ﬁne print or

your own NDA, you may very well be breaking your own contract.

Your clients and donors trust you with their IP and their data. In most scenarios, that trust

is underscored with contracts — NDAs, data usage agreements, etc. If you are using AI to

process any of that — dropping brand guidelines into Claude to make sure your work hits

the right tone, recording meetings and using AI to synthesize — you may well be in

violation. And if you’ve been thinking that nobody is paying attention or that your org is

too small to be on anyone’s radar, think again.

HOW DO I USE AI SAFELY IN MY WORK?

“Courts view sharing information

with AI as voluntary third-party

disclosure, one that could violate

NDAs and one that is not protected

by attorney-client privilege. AI

may not be human, but it’s a third

party and it never forgets anything

you tell it.”

We spoke with Vasanth Sarathy, Principal AI/ML Scientist at Leidos,

Inc., a Fortune 500 science, engineering, and information

technology company. Sarathy offered an important reminder:

Many of the legal protections that people assume apply to

information shared with AI simply don’t.

According to the Stanford 2025 AI Index Report, mentions of AI in

global legislation increased 21.3% over two years from 2023

to 2025.

This marks a ninefold increase since 2016.

THE UPPER HAND

HOW DO I USE AI SAFELY IN MY WORK?

Historically, when society faces changes this substantial, we can at least partly expect our

governments to enact policies that make our guardrails clear. (The automobile industry begat

trafﬁc guidelines and speed limits, the airplane prompted the formation of the FAA.) It remains

to be seen where we land on legislation globally, but at this moment in the United States, AI

litigation is far outpacing legislation. The legal landscape is shifting beneath our feet. What’s

more, legislation like the Small Business AI Advancement Act is moving the burden of

accountability from the developer to the user. Mozilla Foundation Executive Director Nabiha

Syed, a highly acclaimed media lawyer and AI privacy expert, said that even when plaintiffs try

to hold AI companies accountable, the courts aren’t there yet: “They might also try to go after

AI executives, but as it stands right now, it’s not likely that they’re going to win that one.”

With both the legal and policy landscape unsteady, small business owners ﬁnd themselves in a

uniquely precarious position — not big enough to withstand major legal claims but established

enough to sue.

If an AI tool makes a biased hiring decision or violates a privacy law on your watch, the risk

doesn’t sit with the AI parent company — it sits with you, your employee, or your company. The

same is true when conﬁdential client documents get uploaded to a general purpose tool, when

an NDA is quietly broken because someone wanted a faster synthesis, or when a child’s

medical information gets dropped into a work chatbot without a second thought.

The mental model most people operate with — that AI tools are like any other enterprise

software — is wrong. The information you put into an AI tool is discoverable and not

private, even when you think you are in a closed system. Do not interact with them as

though they are. The right mental model, as Syed frames it, is: “Would you hand this

information to a stranger who just knocked on your door? If not, it doesn’t go in the chat.”

The Liability Lands on You

Examples of Big Known Exposure Issues

Contracts That Address AI Usage: If you are a private company, a

consultant, or a nonproﬁt, you may be unknowingly violating “no

third-party sharing” clauses simply by using an AI note-taker during

a Zoom call.

Collection Without Consent: AI tools often scrape data from

across the web or from integrated apps (like your email or calendar).

If your team hasn’t audited these permissions, you might be feeding

client data into an AI without ever having asked the client for

permission.

The Free Feed: If employees don’t have a company policy or

framework to fall back on, they are likely leaking sensitive material

to an unrestricted system. While there are no documented cases of

this — yet— it is easy to imagine a world where a chatbot could sell

the data entered into a “free” version to a competitor or peer, with

little to no room for a company or employee to get their data back.

Intellectual Property Leakage: When you feed a proprietary

framework or a unique narrative strategy into a global model, that

model doesn’t just store it, it learns from it. Your unique way of

solving a conﬂict or connecting an issue area today becomes a data

point that can be surfaced to a rival asking a similar question

tomorrow. For a small business, your intellectual property is your

greatest leverage. In the black box, that leverage is commoditized,

turning your uncommon insights into a generic “best practice”

available to anyone with a login.

THE UPPER HAND

HOW DO I USE AI SAFELY IN MY WORK?

We don’t see these risks as a reason to retreat.

As with many things in life, if you are sloppy

with your tools, you will open yourself up to

risk. The good news is that the same practices

that protect you also make your organization

better. Well-organized data, clear access

boundaries, and intentional prompting don’t

just reduce your legal exposure — they

dramatically improve the quality of what AI

produces for you.

So what should we do?

We humanize. By building a human-in-the-loop

culture, where we always have at least one

team member reviewing and approving the AI’s

output, we ensure that while AI might do the

heavy lifting, we are always the ones holding

the wheel.

Dr. Camille François

Founding President,

ROOST

"The good news here is that we are seeing

regulation move in one direction globally: more

accountability, more transparency, and a higher

floor. However, the pace is uneven and in the

United States, especially, the gaps are hard to

ignore. Safety and privacy were never built into

the DNA of many of these companies. That's

particularly true of smaller, upstart platforms

without the resources for professional-grade

safety infrastructure. For small businesses

using AI today, one thing is non-negotiable:

you need to understand what you're actually

doing when you interact with an LLM."

Digital hygiene is more than worth

the hassle.

THE UPPER HAND

The “Shadow AI” Problem

Context: The work and home laptop have become a thing of the past. In one tab you’re

reviewing a client’s note on feedback, in another you’re checking your teen’s screentime for

the day. And the iPad that Grandpa uses to watch his police procedural? Connected to the

same account. It seems problem free, but is it?

Example: It’s 4:35 p.m. The proposal needs to be uploaded by 5 p.m. All the elements are

done. But has anyone copyedited it? You send it over to a colleague who has approximately

15 other things due by 5. So he uploads it into ChatGPT and asks it for help. But that

colleague is using a free version, and there’s no company oversight. Suddenly your

company’s secret sauce is part of global training models.

“Shadow AI” refers to employees, volunteers, interns, or anyone using AI tools without

ofﬁcial IT approval or oversight. It’s rarely malicious; it’s usually a symptom of a

high-performing employee trying to be efﬁcient. At Invisible Hand we often joke about “AI

intern,” so ingrained has it become in our work.

The Home vs. Ofﬁce Account Trap:

When staff use personal accounts to handle work tasks, your corporate IP and client data are

now living on a personal device, under a personal login, outside your security reach.

MY COMPANY AND PERSONAL

DATA ARE CONVERGING. WHO

CAN SEE WHAT?

HOW DO I USE AI SAFELY IN MY WORK?

78%

of people using AI bring

their own tools to work

Invisible Tools, Real Risks

Microsoft’s Work Trend Index found that 78% of AI

users are bringing their own tools to work (BYOAI).

This creates a massive blind spot where sensitive data

exﬁltration can happen, introducing risks like data

leakage, regulatory violations, or exposure to malicious

models. And because these tools are unsanctioned, IT and

security teams don’t even know they’re being used.

THE UPPER HAND

Beyond data exﬁltration, transparency is a growing concern for

companies navigating Shadow AI. The trap starts small — in the

everyday decisions about whether a tool is supporting human

judgment or quietly replacing it.

“Would you hand this

information to a stranger

who just knocked on

your door? If not, it

doesn’t go in the chat.”

Nabiha Syed

Executive director, Mozilla Foundation

Highly acclaimed media lawyer and

AI privacy expert

HOW DO I USE AI SAFELY IN MY WORK?

Don’t worry!

We have a guide that will help

you and your employees (and

maybe even Grandpa and his

iPad) build some (simple!)

guardrails of protection.

Transparency: Who’s Actually in Control?

Transparency doesn’t stop at internal workﬂows. It ladders

up to trust: how your work is perceived by partners, clients,

and the communities counting on you to use these tools

responsibly.

Which makes it even more important that business leaders

actually know what tools their teams are using. We

encourage you and your team to build an atmosphere of

transparency about your AI usage.

THE UPPER HAND

AI hasn’t earned the trust you are giving it.

Context: Every greeting, prompt, “You’re thinking about this in such a

great way, Jack!” that a chatbot provides is meant to build a connection

and establish trust so you use it more. And while it’s great to receive

those afﬁrmations (your hair looks really great today, by the way), your

AI chatbot is not your friend, and the things you tell it will stay about as

private as if you’d told the group chat.

Example: Consider the employee who began using their work

enterprise AI account to process personal stress, conﬁding feelings of

burnout and exhaustion into the same platform they used for daily

tasks, simply because the work account had more generous usage

limits. When questions later arose about their performance, HR pulled

the chat logs. What felt like a private outlet became time-stamped

documentation — a record of when the burnout started, what triggered

it, and how it evolved.

Take it down a different path. If the data used to train AI models is

incomplete or skewed, the resulting decisions can perpetuate

discrimination in hiring, promotions, or performance evaluations,

leading to reputational damage and even legal consequences. This risk

is closer than most people realize — and it’s already showing up in

courtrooms. Employment lawyers are now sending demand letters

requesting full AI chat logs when employees are terminated, and

companies are quietly settling rather than face the discovery

process.

COULD AI GET MY EMPLOYEES

— OR ME — FIRED?

HOW DO I USE AI SAFELY IN MY WORK?

THE UPPER HAND

“People speak to AI with a

casualness they’d never

use with HR , not realizing

that unlike venting to a

trusted colleague, there’s

no context, no discretion,

and no expiration date.”

Nabiha Syed

HOW DO I USE AI SAFELY IN MY WORK?

Your work AI account is not a journal, a

therapist, or a trusted friend.

Every casual complaint you’ve typed about a colleague, every

“help me write this email because they’re being difﬁcult,” every

question about severance terms — it’s all potentially part of a

personnel ﬁle. The informality people bring to these tools

makes it worse. Nabiha Syed put particular emphasis on this

point, noting that people speak to AI with a casualness

they’d never use with HR, not realizing that unlike

venting to a trusted colleague, there’s no context, no

discretion, and no expiration date. The risk runs in both

directions — it’s not just what you say about others, but what

you reveal about yourself.

Like your work email, your AI account belongs to the

environment that issued it, and everything you put into it can

be retrieved, reviewed, and used in ways you never intended.

We have to think about AI more like a public-facing third

party, not like a private chat. We all need places to talk freely.

We suggest you meet a colleague for a coffee (again, instead

of telling the group chat) instead of venting to the chatbot.

THE UPPER HAND

Context: For the non-tech-wizzes among us, an AI hallucination is

when the machine says something with full conﬁdence… that is

completely made up.

Example: You walk into a crowded boardroom. You’ve practiced your

speech 10 times over. You deliver it with gusto. The issue? All of the

stats you got from AI intern about the likelihood of people living on

Mars by 2032? 100% false. Sure, AI intern delivered them with

authority, but just because they were expertly delivered doesn’t mean

they are correct.

No conversation about AI privacy and safety is complete without

addressing the glitch in the machine: hallucinations. According to a

recent piece in The New York Times, AI Overview answers are correct 9

out of 10 times.

While a 90% accuracy rate for AI Overviews sounds

promising, the scale of 5 trillion annual searches translates to hundreds

of thousands of erroneous answers every minute.

How much are hallucinations costing you? (Also,

what’s a hallucination?)

IS AI MAKING ME AND MY

TEAM LOOK STUPID?

HOW DO I USE AI SAFELY IN MY WORK?

This reliability gap is further complicated by the fact that over half of

“accurate” responses are ungrounded — linking to sources that don’t

actually support the claim — sparking a critical debate over whether we

can truly trust an “almost accurate” digital landscape. When we

overestimate the quality of work we are getting, it inevitably leads to the

denigration of our own work product. This can lead to embarrassment, a

lack of trust, and even lost business.

THE UPPER HAND

Jen Weedon

Lecturer and researcher,

Columbia University

HOW DO I USE AI SAFELY IN MY WORK?

“There’s the hallucination

that embarrasses you, and

then there’s the one that

makes you unknowingly

mislead a client, a donor,

or a board. Those are very

different problems, with

very different stakes.”

In the world of generative AI, a hallucination

isn’t just a minor typo; it’s a conﬁdent, ﬂuent,

and entirely fabricated piece of information

delivered as if it were an objective fact. For a

founder or a nonproﬁt leader, these aren’t

just technical errors — they are reputational

landmines: According to a 2024 Joseph

Rowntree Foundation AI for Public Good

Report, 63% of nonproﬁts are worried

about the accuracy of answers given by

generative AI, and yet 76% of nonproﬁts

do not have an AI policy.

We spoke with Jen Weedon, a trust and

safety expert and lecturer at Columbia

University, who has spent her career

studying exactly how these tools fail us.

When we asked her about hallucinations, she

drew a distinction most people miss…

THE UPPER HAND

Context: It is difﬁcult to demand vigilance when

the public has been conditioned to see breaches as

an inevitable tax of online life. We sign those

license and privacy agreements quickly, without

really looking at the risks. But it’s high time we

take a closer look…

Example: At a nonproﬁt or small business, the only

thing protecting your data from a highly effective

scam is Chad from Development’s ability to think

twice before clicking on an email offering him

tickets to a Taylor Swift secret session. Weave

Chad’s use of AI chatbots into this and the risk

compounds quickly.

IS MY COMPANY AT

RISK OF BAD ACTORS?

Exposure to Fraud and Bad Actors

HOW DO I USE AI SAFELY IN MY WORK?

scoped room in your house rather than the

whole building. Most of us have a folder in

our inbox ﬁlled with digital apologies: those

ubiquitous alerts from retailers, social media

platforms, or credit bureaus informing us

that our data has been “involved in a security

incident.” As these notiﬁcations have become

routine, our collective expectations of

privacy have undergone a slow, dangerous

erosion.

Most major AI platforms offer one-click

integration with Gmail and Google Drive, and

most users grant that access without a second

thought — effectively opening the front door of

their organization and saying “come on in.” The

discipline required isn’t just caution about

what you type; it’s being ruthlessly intentional

about what you toggle on. Separate accounts

and separate drives for separate clients mean

that when you do grant access, you’re offering

a precisely

THE UPPER HAND

Example: When a transcript containing a donor’s private ﬁnancial history or sensitive

internal strategy is fed into a third-party AI for a quick summary, that data isn’t just

processed — it’s often archived and potentially used to train future models. This is the

“soft” data breach: no hacker, no notiﬁcation email, no clear moment at which you

realize something has gone wrong. Just your organizational soul, voluntarily

surrendered to a corporate cloud, one convenient summary at a time.

For a small-business or mission-driven founder, a breach like this is rarely just a

technical ﬁx — it’s an existential crisis. Larger entities can survive a ﬁne from a

regulator, but for the gate openers and community builders, a breach of data is a breach

of the human sanctuary we’ve spent years building, often leaving no clear path to earn

that trust back.

HOW DO I USE AI SAFELY IN MY WORK?

AI represents the next great frontier

of this risk.

Unlike a traditional hack of a credit card number —

which can be canceled and replaced — the data we feed

into AI models is often our most intimate intellectual

property, strategic thinking, and human narrative. At a

publicly traded company, there are whole departments

focused on data security.

The fraud risk is arguably more immediate than a formal

data breach. When an organization’s tone, relationships,

and internal language are scattered across AI platforms

without governance, they become raw material for bad

actors. A convincing phishing email doesn’t require a

sophisticated hack — it just requires enough context to

sound like it belongs. As Nabiha Syed noted, the more

pressing danger for small organizations isn’t the breach

that generates the apologetic inbox notiﬁcation; it’s

someone quietly draining your Stripe account

because your organizational data has been left, piece

by piece, across a dozen different platforms.

A soft breach is still a serious breach.

PRACTICAL

THE

GUIDE

AI PRIVACY

THE UPPER HAND

Easy steps to safeguard

your organization

CHAPTER TWO: THE PRACTICAL GUIDE

THE UPPER HAND

Don’t panic. Plan.

With new technologies — especially those

that have devoured the zeitgeist the way that

AI has — it can be easy to get swept up in the

noise. Don’t let it get you. The gold rush

mentality — that frantic “everyone is hanging

out without me” feeling that tells you to

sprint or risk obsolescence — is a strategic

liability. Now is not the time to let haste or

anxiety cloud your judgement. This is an

important moment for humankind, yes, but

also for you and your organization.

Government policies and ethical product

guidelines are not coming to save you. What

companies need is a plan.

No matter where you are in your integration

journey, there is no time like the present to

pause and assess what you’re actually using,

your policies, and your boundaries.

THE PRACTICAL GUIDE TO AI PRIVACY

Begin with values and vision.

At the end of the day, your policy on AI isn’t just

a legal document — it’s a reﬂection of your

organizational ethos and values. How do you

want to protect your staff from accidental

vulnerabilities? How will you show your clients

that you value their privacy? How will you show

them that your org can be trusted to innovate

responsibly?

While there are a few important fundamentals

to consider, there is not one right way of doing

this. Invisible Hand is a company rooted in

community and trust. No matter how much tech

we integrate, there is always a human at the

wheel. The values that govern our entire

organization are people centered and equitable.

Against a rapidly changing landscape, we are

staying true to our mission and our

human-centered work. So can you. It’s the old

adage: How you do anything is how you do

everything. No different here.

Move slow to go fast.

That’s exactly what the pages that follow are. A

practical guide built for people who are moving

fast and can’t afford to get this wrong. No

bureaucratic checklists. Just the things you

actually need to know, and the steps you can

take starting today.

“The speed of this change is

disorienting. Strong leaders

will commit to active

learning, and will adjust

their plans and policies as

the landscape evolves. Not

their mission or values –

just how they show up in

this new world.”

Genevieve Roth

Founder and CEO, Invisible Hand

THE PRACTICAL GUIDE TO AI PRIVACY

THE UPPER HAND

PHASE 1: THE DIGITAL AUDIT

The audit process is a critical ﬁrst step to safeguarding your company. Take a moment to

audit and deﬁne your boundaries.

THE PRACTICAL GUIDE TO AI PRIVACY

(Alignment, Assessment & Selection)

I. Find all of your AI

You are using so much more agentic tech than you

think you are. Tools you’ve been using for years

(hello, Google G Suite!) are rapidly rolling out

agentic integrations. These changes don’t arrive with

ticker-tape parades; they are often announced via

dense privacy updates that most users accept

automatically. Conduct a full inventory of your

current use among your employees, contractors

— everyone who touches your organization. What

are your already-approved tools, what is hiding in

your existing tech stack? What about “Shadow AI”

(the use of artiﬁcial intelligence tools by employees

without the knowledge or approval of the

organization’s leadership)? Once you have that list,

work to understand the basics of each: What are the

privacy policies of each? Do we know if the model is

open or closed? Do we understand what happens to

our data?

II. Build & communicate your tool stack

Determine the tools that make sense for your

business. Do this at the level of detail that makes

you feel covered — this could mean something like,

“Yes, you may use Claude. But only on the

company account and only at setting X, Y, Z.”

Having a clear list of integrations is a critical

bedrock step in a strong company plan and policy.

Internal communications here are critical. Just as

an employee at your organization should know

what you specialize in, they should also know what

tools you use and any speciﬁc requirements

therein. Then double-check your contracts, your

NDAs, anything that talks about how you do your

work and make sure that your AI use case — both

how you use AI and how you want others to use AI

when working with you — is clearly stated.

The “Pro-Tier” Standard: Before you roll your

eyes that we’re telling you to spend money on AI,

remember that nothing in 2026 is free. It’s just

unprotected. We strongly recommend building

your own tool whenever possible. For anything

that is going to train on your data, a custom option

is the best. If that’s not possible, then move away

from free, consumer-grade tools. Invest in “Pro” or

Enterprise tiers that offer data non-retention and

SOC-2 compliance.

A basic best practices to get you started:

A tip on tone: A common reason employees and

contractors use AI on the sly is because they worry they’ll

get in trouble or their work/role will be seen as less

valuable or even something that AI could do. By letting

them know what tools are allowed and which are

prohibited, you’ll make disclosure more comfortable and

violations easier to address.

THE UPPER HAND

I. Write a Policy for: A good policy is not a cage

— it is a set of boundaries designed to safeguard

you and your team. Your AI policy should be as

unique as your organization’s culture, reﬂecting

the speciﬁc trust you’ve brokered with your team

and partners.

Your policy is yours to own, but at a minimum,

we’d recommend outlining these basic steps:

1. Allowed contexts (brainstorming,

draft 1, etc.) and forbidden ones

(ﬁnal decision-making, sensitive

client research, Personal Identifying

Information).

2. Data Hygiene requirements (all client

projects pull from an independent,

protected drive).

3. Disclosures you may record any

meeting, but you disclose you are

recording. You must highlight what

work was done with AI support, etc.

PHASE 2: POLICIES AND THE STEPS TO

GET THERE (POLICIES & PROTECTION)

Data minimization is nonnegotiable: Before you use a tool, ask: Do I

truly need this data to get the result? If you do, anonymize ﬁrst.

Replace client names with placeholders. De-identify your datasets

before they ever touch a cloud-based model.

Sanitize before you paste: Never include PII (Personally Identiﬁable

Information) like names, addresses, or speciﬁc ﬁnancial ﬁgures in a

prompt unless you are 100% certain that you are on a secure, closed

Enterprise account.

Check your permissions: Disable “Training” in your settings. Most

major platforms allow you to opt out of having your data used to train

their models, but the default is almost always “On.”

Draft a simple “yes/no” list: Give your team a one-page guide on

what can go into AI (general research, drafting emails) and what is

strictly forbidden (donor lists, medical info, legal strategy).

Update your disclosure language: Transparency isn't a hurdle; it's a

trust-builder. Being clear about how you use secure, closed AI to

better serve them shows you are competent, not just “tech-forward.”

Update your contracts: Review your master service agreements and

vendor contracts. Ensure your legal language reﬂects that you use

secure, vetted AI tools as part of your internal workﬂows, and clarify

that this does not constitute a third-party data breach.

TL; DR Essentials

II. Create a Company Etiquette Guide: Do you

use a transcription service on calls? While you

might write the use of them into a client contract,

it’s still good manners to acknowledge it at the

start of the calls. Replying with some research that

Claude helped you with? Acknowledge it up front!

You’ve already established some of your AI

boundaries in Phase 1. In this etiquette guide, you

now want to create language around when you say

no to AI use, so nobody is ever caught off guard.

III. Make Socializing the Policy and Etiquette

Guide a “Moment”: Don’t bury this in an employee

handbook. Hold a meeting to review the policy

guidelines, take questions, and be clear that the

policy will evolve. Email the policy to your team.

Share and pin it on Slack. Share it with everyone

you collaborate with: clients, contractors, and

vendors. Showing exactly how you use AI to better

serve them proves you are both tech-forward and

professionally rigorous.

Policies aren’t meant to sit on a shelf; they are the rules of the road for your digital survival.

THE PRACTICAL GUIDE TO AI PRIVACY

THE UPPER HAND

PHASE 3: THE PILOT &

THE PEOPLE

AI is moving fast. A great policy acknowledges that while we are all

building the plane while it’s taking off, we agree on who is holding the

wheel and where the no-ﬂy zones are. By moving from a culture of

Shadow AI to one of Collaborative Governance, you ensure that your

team’s efﬁciency never comes at the cost of your organization’s

integrity.

For the AI you are using and need to change manage:

I. The “opt-out” audit: Most major AI tools default to “training mode.” Go into the

settings of every tool your team uses and toggle off “Use my data for training.” For

enterprise versions, ensure you have a “zero data retention” agreement.

II. The literacy effort: Involve your team early. Provide training that focuses on

ethics and bias, not just “how to prompt.” Make sure your team knows what data

you’re willing to share with AI, and what data has to remain human only. Remind them

of this consistently. A policy won’t work if it’s gathering dust at the bottom of their

inbox.

III. The ethics committee: Even at small companies, this is an important step. Set up

a small, cross-functional team (or designate one employee as your Ethics Czar) to

guide tough calls on vendor vetting, chatbot using, and policy implementation.

IV. Small wins, big data: Launch pilot projects or tools with 2–5% of your staff. This is

your sandbox to see what works and — more importantly — what glitches. It also

gives you the opportunity to create ownership of a policy, a procedure, and a culture

among other members of your team. That’s just good management.

Don't roll out AI to

the whole team on

a Monday morning.

Start small, learn

fast, and keep it

human.

THE PRACTICAL GUIDE TO AI PRIVACY

(Education & Culture)

THE UPPER HAND

PHASE 4:

MAINTENANCE & THE

VERIFICATION TAX

AI is not “set it and forget it.” It

requires constant, human vigilance.

I. The human-in-the-loop (HITL)

mandate: Ensure that every grant, every

service communication, and every

strategic decision is signed off by a

human. We call this the Veriﬁcation Tax

— the necessary price of maintaining our

reputational edge.

II. Security hygiene: Treat your AI logins

like your bank accounts. Use strong

MFA and update your devices on a

regular basis. Remember: AI is not your

close friend, it’s more like the Nigerian

Prince of yesteryear.

III. RAG it: Stop asking AI to rely on its

internal memory — that’s the stuff of

hallucinations. Instead, practice

Retrieval-Augmented Generation (RAG).

By providing the model with your own

veriﬁed documents or other exclusive

source material, you can reduce

hallucination rates by up to 86%.

Our

golden rule: Never ask the AI to

remember a fact; always give it the fact

to work with.

IV. Track the real ROI: Is AI actually

making you more efﬁcient, or is it just

generating more drafts that your team

then has to ﬁx? Measure the impact over

time and be brave enough to sunset

tools that aren’t serving the mission or

your team. According to Nonproﬁt PRO,

“81% of organizations report using AI

individually and on an ad hoc basis,

while only 4% say they have

documented, repeatable workﬂows.

Very few measure and track the impact

of AI. Without deﬁned benchmarks,

nonproﬁts cannot easily determine

whether AI is expanding fundraising

capacity or simply accelerating existing

tasks.”

V. Stay up-to-date: Update software

and devices on a regular basis to ensure

security features are up to date,

reducing the chance of data breaches.

THE PRACTICAL GUIDE TO AI PRIVACY

THE UPPER HAND

I. Find your state lawmakers: Research who represents you at the

state level and what AI-related legislation is currently being

discussed in your state. Every state is paying attention.

II. Request a meeting: If you have a speciﬁc concern (wrongful

termination exposure, contract indemniﬁcation gaps, client data

liability), bring it. Lawmakers at the state level are actively looking

for real-world business examples to inform what they write.

III. Join or build a consortium: Small business owners tend to

organize by industry, not by risk proﬁle. But the risks you face as a

small business using AI cut across industries. Finding or forming a

group of peers who share your concerns gives your voice more

weight and your experience more reach.

IV. Stay current: The legal landscape is shifting faster than any

single report can track. Designate someone on your team as your

Accountability Lead whose job it is to monitor state-level AI

legislation in the markets in which you operate. This doesn’t have to

be a lawyer. It just has to be someone who pays attention.

You have more power than you think.

Most of the guidance in this report puts the onus on you —

the business owner or team leader — to ﬁgure it out and

protect yourself. But that’s not the whole story.

We are in a consequential window. Policy around AI is being

written right now. At the state level, there is real work

happening to address concerns. Lawmakers, particularly in

New York, California, and Colorado, are actively looking for

the voices of small-business owners and founders to help

them understand what protection actually needs to look

like on the ground.

This means your voice matters right now to help set the

rules.

PHASE 5: POLICY AND

COLLECTIVE ACTION

Know your rights and use them

THE UPPER HAND

The Control + V Checklist

Infrastructure & Access

The “Rules of the Road” (Policies)

Daily Habits & Prompting

Client Trust & Transparency

Accuracy & Veriﬁcation

Emergency & High-Stakes Security

We believe this part of the work

is so mission critical that we even

made you a downloadable

checklist to accompany the

practical guide.

Here’s what’s on the list:

THE PRACTICAL GUIDE TO AI PRIVACY

THE UPPER HAND

The CTRL + V

THE TASK CHECKLIST

❏ Invest in enterprise or paid models for security: Think of enterprise access as your

insurance policy. It provides stronger privacy protections, ensuring your data remains private,

closed source and excluded from public AI training.

❏ Draw a hardware line: Don’t use the same account and chatbot to help you visualize client

data that you use to diagnose the weird rash on your kid’s back (also, call your doctor, not AI

about that) on a device that links to the iPad Grandpa has access to. Make sure that you’re

not over-indexing the amount of information a chatbox has about you, your work, and your

personal life or sharing proprietary data on unintentionally linked devices.

❏ Kill the universal password: Implement mandatory Multi-Factor Authentication (MFA) and

a team-wide password manager. Replace “SwiftieChad13” with 24-character random strings.

Infrastructure & Access

❏ Establish an “accountability lead”: Designate one “the buck stops here” person to stay

updated on legislation and internal safety protocols.

❏ Establish a data tiering system. Use a trafﬁc-light system:

❏ Red: Board minutes/ﬁnancials (No AI)

❏ Yellow: De-identiﬁed drafts (Enterprise AI only)

❏ Green: Public copy/brainstorming (Safe for most tools)

❏ Build and maintain a list of tools: Keep a living list of approved tools. Have a quick process

to vet new tools so the team can innovate safely.

❏ Stop spontaneous downloads: Instate a global rule that all new AI software, including

browser extensions and bots, must pass a “Trust Audit” before being added to any workﬂow.

The “Rules of the Road” (Policies)

Checklist

Protecting your company’s

privacy should be at the top of

your to-do list. Here’s how to

support your staff to get it done.

THE UPPER HAND

THE TASK CHECKLIST

Daily Habits & Prompting

❏ Start “blind” prompting: Strip out speciﬁcs when using AI. Use placeholders like “regional expansion”

instead of names.

❏ Stop inputting proprietary frameworks into free tiers: If it makes your company unique, keep it out of

the global training loop.

❏ Standardize grounding prompts: Create standardized templates for your team to use with AI. “Use only

provided context. If the answer isn’t there, say you don’t know. Do not speculate.”

❏ Ensure work is reviewed and approved by a human: Treat every AI output as a draft. Nothing is

published or sent — especially regarding hiring or client deliverables.

❏ Stop oversharing with AI: Never use your employer-issued or work-linked AI account for personal

reﬂection, health concerns, or anything you wouldn’t want HR to read.

❏ Keep personnel conversations off the record: Avoid venting about colleagues, drafting termination

language, or asking for HR guidance in your AI tool.

Client Trust & Transparency

❏ Audit your “third parties”: Ensure your MSAs and contracts clarify that Enterprise AI is a tool you use, not

a third-party data disclosure.

❏ The “note-taker” protocol: Make AI transcription a standard part of your meeting intro. Ask: “We use an

internal AI tool to capture notes. Are you comfortable with that?”

❏ Draft an “AI Transparency Statement”: A one-pager for donors and clients that explain which tools you

use, how you’ve secured them, and how it beneﬁts them.

❏ Add an “AI Disclosure” to due diligence: Keep an “AI Folder” ready for investors or acquirers

documenting your tools and privacy settings.

The CTRL + V

Checklist

THE UPPER HAND

THE TASK CHECKLIST

❏ Require every AI claim to include a citation: This helps ensure that the responses

are not hallucinations.

❏ Use “maker-checker” model logic: Use one model to draft and a different one (e.g.,

GPT-5.5 and Claude Opus 4.8) to check for inconsistencies.

❏ The “conﬁdence score” ﬁlter: Flag any response with a conﬁdence score under 90%

for a deep manual dive.

❏ Bias-check your prompts: Speciﬁcally prompt the AI to identify and remove

potential gender or racial bias in tasks like job descriptions or screening.

Accuracy & Veriﬁcation

Emergency & High-Stakes Security

❏ Turn off “web scraping” integrations: Audit browser extensions and email

plugins that automatically scrape your inbox or calendar.

❏ Build a response team: Identify a cybersecurity ﬁrm or legal consultant before

a breach happens.

❏ Establish AI “clean room” sessions: For the most sensitive work (conﬂict

resolution, major strategy), go analog. Use local, ofﬂine documents or physical

paper.

The CTRL + V

Checklist

Human connection is still

the only way through.

These are the people who

reminded us of that on

every page.

THE

Humans

IN THE

MACHINE

THE UPPER HAND GRATITUDE

THE UPPER HAND

Thank you to all of our contributors for helping

bring this report and roadmap to life.

THE HUMAN IN THE MACHINE

Dr. Camille François

Founding President,

ROOST

Jen Weedon

Lecturer of International and Public

Affairs, Columbia University

Vasanth Sarathy PhD, JD

Principal AI/ML Scientist,

Leidos, Inc.

Zoe Weinberg

Founder & Managing Partner,

ex/ante

Michele L. Jawando

CEO and Board Member,

Omidyar Network

The Experts The Invisible Hand Team

Chabely Alvarez

Executive Business Partner

Claire Graves

Project Director

Genevieve Roth

Founder & CEO

Jess Peer

Creative Lead

Allen Babaran

Head of IT and Facilities

Omidyar

Jodi Glover Thiel

Research

Joy Engel

Lead Writer

Monisha Lewis

Managing Director

Ulyssa Valdivia

Head of Executive Operations

Nabiha Syed

Executive Director,

Mozilla Foundation

THE UPPER HAND

THE HUMAN IN THE MACHINE

Methodology

Citations:

1. Kristie Poon, “AI and the Future of Small Business,” Salesforce, 2025.

2. InsightMark Research, “AI in Business Statistics and Trends,”

InsightMark Research, 2026.

3. Andy Bayiates, “Business and IT leaders report AI agents are scaling

faster than their guardrails,” Deloitte, 2026.

4. IBM and Ponemon Institute, “Cost of a Data Breach Report 2025,” IBM

and Ponemon Institute, 2025.

5. Nestor Maslej, Loredana Fattorini, et al., “The AI Index 2025 Annual

Report,” Institute for Human-Centered AI, Stanford University, 2025.

6. Microsoft and LinkedIn, “AI at work is here. Now comes the hard part,”

Microsoft Work Trend Index, 2024.

7. Guy Mika, “Where do foundations stand on AI-generated proposals?,”

Candid, 2024.

8. Tripp Mickle, Cade Metz, et al., “How accurate are Google AI

Overviews?,” New York Times, 2026.

9. Yasmin Ibison, Gulsen Guler, et al., “Grassroots and non-proﬁt

perspectives on generative AI,” JRF, 2024.

10. Elizabeth Fuentes L, “Stop AI Agent Hallucinations: 4 Essential

Techniques,” for AWS, DEV 2026

11. Amanda Cole, “Nonproﬁt AI Adoption hits 92%, but only 7% see major

impact,” NonProﬁt PRO, 2026.

This report draws on Invisible Hand’s direct experience with

AI technology and policy as well as our work helping

platforms, advocacy organizations, corporations and

nonproﬁts navigate rapidly changing landscapes—from

communications and operations to trust, reputation and

impact. Alongside this, we conducted subject-matter

expert interviews and a meta-analysis of recent studies,

investigative reporting, and expert commentary from the

past 18 months, all focused on how AI impacts small

businesses, non-proﬁts, and founders.

Study relevance was determined by alignment with the

report topic and adequate sample size. We took special care

to source and analyze unbiased studies — those produced

by advocacy and research groups rather than service

providers.

All sources were human-veriﬁed, read, and synthesized.

Glossary

of Terms

IH TREND REPORT

We’re all learning a new language on the job. Here’s a plain-English guide to the terms you’ll encounter in this

report — and in the wild.

LLM - Open/Consumer: The free version. What you put in may be used to train the model.

Think public park, not private vault.

LLM - Closed/Enterprise: The paid, secure version. Your data is not used for training and

stays within your organization’s walls.

LLM - Open Source: A publicly available AI model whose underlying code and architecture

anyone can access, inspect, and build on.

Personally Identiﬁable Information (PII): Any information that could identify a speciﬁc

person, names, addresses, ﬁnancial records, health information.

Prompt Injection: A cyber attack where bad actors embed hidden instructions into content

an AI will process, manipulating it into exposing sensitive data.

Retrieval-Augmented Generation (RAG): A technique that grounds AI responses in your

own veriﬁed documents rather than its general training data.

Shadow AI: When employees use AI tools without ofﬁcial approval or oversight.

SOC-2 Compliance: A security certiﬁcation that signals a vendor takes data protection

seriously.

Zero Data Retention (ZDR): An agreement with an AI provider that they will not store or

log anything you input.

Agentic AI: AI that takes actions, not just gives answers. A chatbot tells you how to do something,

but agentic AI does it for you, which is exactly why the permissions you grant it matter.

AI Agent: A single AI tool built to act on your behalf for booking, scheduling, sending, retrieving.

Agents are the workers; agentic AI is the category they belong to.

BYOAI (Bring Your Own AI): When employees use their own personal AI tools for work tasks

without organizational oversight.

Data Tiering: A simple system for classifying what information can and can’t go into an AI tool.

Collaborative Governance: The shift from Shadow AI (where everyone is quietly doing their own

thing) to a culture where AI use is transparent, agreed upon, and shared across the team.

Generative AI: The category of AI that creates new content (text, images, audio, code) based on

patterns learned from vast amounts of existing data. ChatGPT, Claude, and Gemini are all

generative AI tools.

Hallucination: When AI conﬁdently states something that is completely made up. Not a glitch — a

ﬂuent, convincing fabrication delivered as fact.

Human-in-the-Loop (HITL): The practice of keeping a human in the review and approval chain for

any AI-generated output.

Large Language Model (LLM): The engine behind the AI tools. It’s trained on vast amounts of text

and generates human-like responses.

Multi-Factor Authentication (MFA): A security layer that requires more than just a password to

access an account.

THE HUMAN IN THE MACHINE

THE UPPER HAND

THE HUMAN IN THE MACHINE

Invisible Hand is a strategic and creative partner for the

world’s most influential brands, institutions, and

individuals. Our agency is made of artists, storytellers,

relationship builders, and architects of social capital

who were born to close the distance between

storytelling, culture, and community.

About Us

Through rapid-response consultation, program development, and ongoing strategic counsel, we work with partners to problem-solve

through an intellectually rigorous approach that is multi-perspective, people-driven, and informed by data and research.

Among many other critical issues, we have been working on tech and privacy since we opened our doors eight years ago. If we’ve got

questions, we figured you do too. This report is the first in an ongoing series exploring the issues shaping how we work, lead, and move

forward — bringing clarity to complexity through expert perspectives, useful frameworks, and conversations worth having. Stay in touch

for what’s next.

THE UPPER HAND

THE HUMAN IN THE MACHINE

Explore our services and other publications, say hello, and get social with us.