AI REPORT: ISSUE NO.1
Prepared for you by the
team at Invisible Hand
AI TREND REPORT
July, 2026
The 2026
Invisible Hand
Report on
AI,
Inside: Expert insights,
emerging risks, and a
practical guide to
protecting your company.
THE UPPER HAND
If you’re surprised to learn that Invisible Hand’s inaugural trend
report is focused on Artificial Intelligence, you are not alone.
Nobody is more surprised than me. Here’s how that happened:
A few months after I started Invisible Hand, we were asked by a
major social media platform to work on a series of projects about
ethical tech and artificial intelligence.
The work was in our wheelhouse–convene brilliant minds, build
strategies that kept both communities and commerce centered.
The topics, though? Like something from a land faraway: How does
one build a code of conduct for virtual agents? What role should
identity and belonging play in personal avatars…. And those were
the easy ones. I figured we’d leave the project with a fascinating
case study, but in all my lifetimes I never thought these topics
would impact my own business.
Welp.
An underappreciated perk of agency work is that we are perpetual
students. One moment we are in deep research on mental health.
The next, we’re elbows-deep in education policy. Then we’re
learning about the inner workings of the Super Bowl. This makes
us excellent partners for your trivia night, but it also means that we
are often ringside to big cultural shifts as, or before, they happen.
Thanks to that initial AI project, and the many similar we’ve done
since, we’ve had an active, inside view of how the field has evolved
— working with both the companies building it and the
organizations making sure we don’t bungle the largest tectonic
shift of our lifetime.
Friend, hello.
Genevieve Roth
Founder and CEO of Invisible Hand
2
This also meant that we were relatively early on embedding AI into
our own work. And like many of you, we did this without a map.
While I was besotted with the efficiency we experienced, I also
started to feel the nag of some pretty big questions. What is our
obligation to obtain client permission if we’re uploading their docs
to an agent? Did I just break the law? Or my own professional code
of ethics? How do we adopt innovation without quietly
compromising privacy, security, and trust?
We are all out here using these tools for our most essential work
while most of these questions remain unanswered. And the
stakes? They’re high. In this work, a data leak isn’t a ‘glitch.’ It’s a
breach of our only real currency: trust.
Earlier this year, Invisible Hand took the time to build that map we
couldn’t find. And now we’re sharing it with you. Consider it your
practical guide to using AI thoughtfully, securely, and with purpose.
This is a living conversation. I’d love to know what you want to
learn next.
Your fan,
To have said it:
We built this report for everyone,
but we know it’s particularly
important for those who don’t
have the luxury of failing up —
especially women founders, and
underrepresented leaders.
Also, we’re just scratching the
surface here in terms of the
broader implications of artificial
intelligence. To name a few:
● Climate and
Environmental Impact
● Bias in the Model
(Training Data)
● Impact on Marginalized
Communities
While this report focuses on risks
for small businesses, we will be
looking at these very real issues in
subsequent volumes of this
ongoing discussion.
THE UPPER HAND
How Do I Use AI
(Safely) in My Work
5
The Practical Guide
to Co-Creation
22
The Control + V
Checklist
30
The Humans
in the Machine
34
Table of
Contents
THE UPPER HAND: A 2026 INVISIBLE HAND REPORT ON AI, PRIVACY,
+ YOUR BUSINESS
3
THE UPPER HAND
4
This report is built in two parts.
First, we look directly at the risks, gray areas, and quiet vulnerabilities
emerging across the way we work.
Then, we get practical: the conversations, guardrails, and next right
moves for protecting your people, your creative equity, and your
business without killing momentum.
What you will
not
find here is panic, posturing, or pretending that the
answer is to stop using AI altogether. Instead, we’ll take a clear-eyed
look at the moment we’re in and how to move through it intelligently.
Let’s get into it.
THE UPPER HAND CHAPTER ONE: HOW DO I USE AI SAFELY IN MY WORK?
Let’s talk about
privacy, trust,
and AI at work
V
safely
THE UPPER HAND
What a time to be alive and leading a company. We are all in the middle of the
largest shift in how work gets done in our lifetime.
The tools are extraordinary. The pressure to adopt them is real. So is the gap
between how fast we’ve moved and how much we actually understand about
what we’ve signed up for.
That gap is where this report lives.
It was written for people we at Invisible Hand stand shoulder to shoulder with:
leaders of nonprofits, executives of growing brands, founders of companies like
ours. Organizations that are already seeing massive efficiencies from AI, but
that might not fully know where the blind spots live. Teams that aren’t ignoring
the risks, but don’t fully know what those risks actually are.
Make no mistake, the litigators are outpacing the policymakers on this.
Without your own AI policy, you are unwittingly opening your organization up
to massive liability.
6
EVERYONE’S USING IT. ALMOST
NOBODY HAS A POLICY.
I’m genuinely optimistic about how AI
will transform the future of work, but I
also understand the uncertainty so many
leaders are carrying right now. What I
want everyone to understand is that AI is
not destiny, it is design. There are no
inevitabilities and no set future. This
technology does not have to happen to
us—it will be shaped by the choices we
make about what’s right for our people
and our organizations. There has
never been a more important
moment to lean in, learn, and build
the future we actually want.
HOW DO I USE AI SAFELY IN MY WORK?
“
Michele L. Jawando
CEO and Board Member
Omidyar Network
THE UPPER HAND
When privacy guardrails get murky, you are potentially compromising the
safety and trust of clients as well as opening yourself up to significant liability
issues. While nobody wants to be left behind, few small businesses or nonprofits
have the resources to provide time and space for employees or contractors to
experiment and train on AI tools. So, many employees strike out on their own,
often without the proper protections in place to secure data, IP, and the mission of
their work.
Like yours, our team loves these new ways to take notes, draft emails, and organize
data. But these well-intentioned, low-information integrations are being used
without policies and without basic privacy protections. We don’t know enough
about how these tools actually work to know what we’re putting at risk.
We built this report to help you navigate that gray area. We aren’t interested in
white papers from ivory towers. We’re interested in the messy implementation —
the reality of protecting a mission-critical donor list while using tools that help us
scale without losing our humanity — or landing in court.
We talked to some of the smartest experts in the AI field, including Michele L.
Jawando of Omidyar Network, Nabiha Syed of Mozilla Foundation, Zoe
Weinberg of ex/ante, Vasanth Sarathy of Leidos, Inc., Jen Weedon of Columbia
University, and Dr. Camille François of ROOST, among others. We are eager to
share our research and learning so that you can stop worrying about putting your
company in danger and start following our guide to keeping it safe.
7
HOW DO I USE AI SAFELY IN MY WORK?
LEARNING BY
DOING HAS A
LIABILITY
CLAUSE
THE UPPER HAND
75%
The Adoption Pressure: 75% of small businesses are already
leaning in, and those seeing the most growth are twice as likely to be
investing in AI. To opt out entirely is to risk being left behind. But few have
actual policies around the use of AI.
1
40%
Embedded Agents: AI is now built into 4 out of every 10 work
apps. Odds are, your team is using AI right now without even realizing it’s
there.
2
First, let’s look at the state of the state. How are we really
using AI in our work?
Lacking Guardrails: 79% of organizations DON’T have a mature
governance model for agentic AI. The technology is moving faster than the
guardrails.
3
79%
HOW DO I USE AI SAFELY IN MY WORK?
8
THE UPPER HAND
Will I lose ownership of our company
data and IP?
The Open vs. Closed Divide
1
Am I breaching my client’s confidentiality
and breaking new laws?
Client Exposure & the Contract Gap
2
My company and personal data are
converging. Who can see what?
The “Shadow AI” Problem
3
Could AI get my employees — or me — fired?
HR Violations and Risks
4
Is AI making me and my team look stupid?
How much are hallucinations costing you?
5
Is my company at risk of bad actors?
Exposure to Fraud and Bad Actors
6
9
HOW DO I USE AI SAFELY IN MY WORK?
THE SIX EXPOSURE
AREAS OUR
RESEARCH AND
EXPERTS SAY EVERY
BUSINESS SHOULD
BE THINKING
ABOUT
These are the questions to
ask (and answer).
THE UPPER HAND
01
WILL I LOSE OWNERSHIP
OF MY COMPANY DATA
AND IP?
10
HOW DO I USE AI SAFELY IN MY WORK?
The first step in protecting your company, clients, and team is understanding
where your data actually goes when you use an AI product or service in your work.
Context: Many companies are uploading all manner of internal documents — mission
statements, style guides, databases — in the hopes of finding efficiencies,
brainstorming partners, etc. Efficient? Yes. Risky? Perhaps…
Example: Imagine this: You’re planning an event and receive three RSVP files that need
to be combined and deduped. You could spend hours going line-by-line, or you could
upload the three lists and have an AI tool do it for you. Caution here, dear reader, for
not all AI tools are created equally.
The AI tools most of us use at work like Claude, ChatGPT, and Gemini come in two
versions: open and closed.
● Open/Consumer LLMs: Think of these as a public park. When you feed data
into a free, consumer-grade tool, that information is often used to “train” the
model. Anything you put in — a client’s case file, a sensitive strategy memo —
could theoretically resurface in someone else’s query.
● Closed/Enterprise LLMs: These are the digital equivalent of a locked vault.
These versions explicitly state that your data is not used for training and
remains within your organization’s walls.
If you aren’t paying for the seat, you are likely paying with
your data. Nothing in 2026 is free. Nearly 60% of
organizations cite data leakage as their primary
generative AI concern,
4
but if you’re using these ‘free’
tools, you are holding the door open for your data to be
used in training. IH recommends moving to a paid plan and
understanding the data share structure of that plan. At the
very least, you need to know what the AI’s policy is before
you share anything.
“Free sounds nice, but you
really have no control over
your context. What are
you paying with? You’re
paying with your training
data.”
Zoe Weinberg
Founder & Managing Partner @ ex/ante
ex/ante is the first venture fund dedicated to
agentic technology, or tools that support human
agency by increasing privacy, security, and
information integrity
A bird’s-eye view of where common tools fall:
The AI ecosystem is vast and evolving. Every tool should be evaluated individually, but this provides a practical
framework for understanding some of the most widely used platforms and where they land.
Closed
Open
Claude ChatGPT Gemini
MetaAI/Grok DeepSeek
Anthropic and OpenAI both now
provide meaningful consumer opt-outs,
but only if you know how to use them or
if you’re in the “right” paid tier.
These systems provide the strongest
theoretical privacy because you can run
models locally, but only if you actually
self-host them, which most users do not.
Google has historically
had more fragmented,
difficult to understand
consumer data controls.
HOW DO I USE AI SAFELY IN MY WORK?
THE UPPER HAND
Vasanth Sarathy, PhD, JD
Principal AI/ML Scientist
Leidos, Inc.
02
AM I BREACHING MY CLIENT’S
CONFIDENTIALITY AND
BREAKING NEW LAWS?
Client Exposure and the Contract Gap
Context: Perhaps the greatest immediate return that businesses see when using AI is the
ability to consolidate information quickly and ask questions about the work.
AI tools can streamline a lot and help you better reach some productivity goals. But if
you’re not checking in on your own employment contracts or your client agreements, you
might be violating the law.
Example: It’s your seventh meeting of the day. Your coffee stopped working about two
calls ago. A friend told you about an AI tool that will take notes and provide a summary for
you after the call. Sounds amazing! But if you haven’t checked your client’s fine print or
your own NDA, you may very well be breaking your own contract.
Your clients and donors trust you with their IP and their data. In most scenarios, that trust
is underscored with contracts — NDAs, data usage agreements, etc. If you are using AI to
process any of that — dropping brand guidelines into Claude to make sure your work hits
the right tone, recording meetings and using AI to synthesize — you may well be in
violation. And if you’ve been thinking that nobody is paying attention or that your org is
too small to be on anyone’s radar, think again.
HOW DO I USE AI SAFELY IN MY WORK?
“Courts view sharing information
with AI as voluntary third-party
disclosure, one that could violate
NDAs and one that is not protected
by attorney-client privilege. AI
may not be human, but it’s a third
party and it never forgets anything
you tell it.”
We spoke with Vasanth Sarathy, Principal AI/ML Scientist at Leidos,
Inc., a Fortune 500 science, engineering, and information
technology company. Sarathy offered an important reminder:
Many of the legal protections that people assume apply to
information shared with AI simply don’t.
According to the Stanford 2025 AI Index Report, mentions of AI in
global legislation increased 21.3% over two years from 2023
to 2025.
5
This marks a ninefold increase since 2016.
12
THE UPPER HAND
HOW DO I USE AI SAFELY IN MY WORK?
Historically, when society faces changes this substantial, we can at least partly expect our
governments to enact policies that make our guardrails clear. (The automobile industry begat
traffic guidelines and speed limits, the airplane prompted the formation of the FAA.) It remains
to be seen where we land on legislation globally, but at this moment in the United States, AI
litigation is far outpacing legislation. The legal landscape is shifting beneath our feet. What’s
more, legislation like the Small Business AI Advancement Act is moving the burden of
accountability from the developer to the user. Mozilla Foundation Executive Director Nabiha
Syed, a highly acclaimed media lawyer and AI privacy expert, said that even when plaintiffs try
to hold AI companies accountable, the courts aren’t there yet: “They might also try to go after
AI executives, but as it stands right now, it’s not likely that they’re going to win that one.”
With both the legal and policy landscape unsteady, small business owners find themselves in a
uniquely precarious position — not big enough to withstand major legal claims but established
enough to sue.
If an AI tool makes a biased hiring decision or violates a privacy law on your watch, the risk
doesn’t sit with the AI parent company — it sits with you, your employee, or your company. The
same is true when confidential client documents get uploaded to a general purpose tool, when
an NDA is quietly broken because someone wanted a faster synthesis, or when a child’s
medical information gets dropped into a work chatbot without a second thought.
The mental model most people operate with — that AI tools are like any other enterprise
software — is wrong. The information you put into an AI tool is discoverable and not
private, even when you think you are in a closed system. Do not interact with them as
though they are. The right mental model, as Syed frames it, is: “Would you hand this
information to a stranger who just knocked on your door? If not, it doesn’t go in the chat.”
13
The Liability Lands on You
Examples of Big Known Exposure Issues
Contracts That Address AI Usage: If you are a private company, a
consultant, or a nonprofit, you may be unknowingly violating “no
third-party sharing” clauses simply by using an AI note-taker during
a Zoom call.
Collection Without Consent: AI tools often scrape data from
across the web or from integrated apps (like your email or calendar).
If your team hasn’t audited these permissions, you might be feeding
client data into an AI without ever having asked the client for
permission.
The Free Feed: If employees don’t have a company policy or
framework to fall back on, they are likely leaking sensitive material
to an unrestricted system. While there are no documented cases of
this — yet— it is easy to imagine a world where a chatbot could sell
the data entered into a “free” version to a competitor or peer, with
little to no room for a company or employee to get their data back.
Intellectual Property Leakage: When you feed a proprietary
framework or a unique narrative strategy into a global model, that
model doesn’t just store it, it learns from it. Your unique way of
solving a conflict or connecting an issue area today becomes a data
point that can be surfaced to a rival asking a similar question
tomorrow. For a small business, your intellectual property is your
greatest leverage. In the black box, that leverage is commoditized,
turning your uncommon insights into a generic “best practice”
available to anyone with a login.
THE UPPER HAND
HOW DO I USE AI SAFELY IN MY WORK?
We don’t see these risks as a reason to retreat.
As with many things in life, if you are sloppy
with your tools, you will open yourself up to
risk. The good news is that the same practices
that protect you also make your organization
better. Well-organized data, clear access
boundaries, and intentional prompting don’t
just reduce your legal exposure — they
dramatically improve the quality of what AI
produces for you.
So what should we do?
We humanize. By building a human-in-the-loop
culture, where we always have at least one
team member reviewing and approving the AI’s
output, we ensure that while AI might do the
heavy lifting, we are always the ones holding
the wheel.
14
Dr. Camille François
Founding President,
ROOST
"The good news here is that we are seeing
regulation move in one direction globally: more
accountability, more transparency, and a higher
floor. However, the pace is uneven and in the
United States, especially, the gaps are hard to
ignore. Safety and privacy were never built into
the DNA of many of these companies. That's
particularly true of smaller, upstart platforms
without the resources for professional-grade
safety infrastructure. For small businesses
using AI today, one thing is non-negotiable:
you need to understand what you're actually
doing when you interact with an LLM."
Digital hygiene is more than worth
the hassle.
THE UPPER HAND
The “Shadow AI” Problem
Context: The work and home laptop have become a thing of the past. In one tab you’re
reviewing a client’s note on feedback, in another you’re checking your teen’s screentime for
the day. And the iPad that Grandpa uses to watch his police procedural? Connected to the
same account. It seems problem free, but is it?
Example: It’s 4:35 p.m. The proposal needs to be uploaded by 5 p.m. All the elements are
done. But has anyone copyedited it? You send it over to a colleague who has approximately
15 other things due by 5. So he uploads it into ChatGPT and asks it for help. But that
colleague is using a free version, and there’s no company oversight. Suddenly your
company’s secret sauce is part of global training models.
“Shadow AI” refers to employees, volunteers, interns, or anyone using AI tools without
official IT approval or oversight. It’s rarely malicious; it’s usually a symptom of a
high-performing employee trying to be efficient. At Invisible Hand we often joke about “AI
intern,” so ingrained has it become in our work.
The Home vs. Office Account Trap:
When staff use personal accounts to handle work tasks, your corporate IP and client data are
now living on a personal device, under a personal login, outside your security reach.
15
03
MY COMPANY AND PERSONAL
DATA ARE CONVERGING. WHO
CAN SEE WHAT?
HOW DO I USE AI SAFELY IN MY WORK?
78%
of people using AI bring
their own tools to work
Invisible Tools, Real Risks
Microsoft’s Work Trend Index found that 78% of AI
users are bringing their own tools to work (BYOAI).
6
This creates a massive blind spot where sensitive data
exfiltration can happen, introducing risks like data
leakage, regulatory violations, or exposure to malicious
models. And because these tools are unsanctioned, IT and
security teams don’t even know they’re being used.
THE UPPER HAND
Beyond data exfiltration, transparency is a growing concern for
companies navigating Shadow AI. The trap starts small — in the
everyday decisions about whether a tool is supporting human
judgment or quietly replacing it.
16
“Would you hand this
information to a stranger
who just knocked on
your door? If not, it
doesn’t go in the chat.”
Nabiha Syed
Executive director, Mozilla Foundation
Highly acclaimed media lawyer and
AI privacy expert
HOW DO I USE AI SAFELY IN MY WORK?
Don’t worry!
We have a guide that will help
you and your employees (and
maybe even Grandpa and his
iPad) build some (simple!)
guardrails of protection.
Transparency: Who’s Actually in Control?
Transparency doesn’t stop at internal workflows. It ladders
up to trust: how your work is perceived by partners, clients,
and the communities counting on you to use these tools
responsibly.
Which makes it even more important that business leaders
actually know what tools their teams are using. We
encourage you and your team to build an atmosphere of
transparency about your AI usage.
THE UPPER HAND
AI hasn’t earned the trust you are giving it.
Context: Every greeting, prompt, “You’re thinking about this in such a
great way, Jack!” that a chatbot provides is meant to build a connection
and establish trust so you use it more. And while it’s great to receive
those affirmations (your hair looks really great today, by the way), your
AI chatbot is not your friend, and the things you tell it will stay about as
private as if you’d told the group chat.
Example: Consider the employee who began using their work
enterprise AI account to process personal stress, confiding feelings of
burnout and exhaustion into the same platform they used for daily
tasks, simply because the work account had more generous usage
limits. When questions later arose about their performance, HR pulled
the chat logs. What felt like a private outlet became time-stamped
documentation — a record of when the burnout started, what triggered
it, and how it evolved.
Take it down a different path. If the data used to train AI models is
incomplete or skewed, the resulting decisions can perpetuate
discrimination in hiring, promotions, or performance evaluations,
leading to reputational damage and even legal consequences. This risk
is closer than most people realize — and it’s already showing up in
courtrooms. Employment lawyers are now sending demand letters
requesting full AI chat logs when employees are terminated, and
companies are quietly settling rather than face the discovery
process.
7
17
04
COULD AI GET MY EMPLOYEES
— OR ME — FIRED?
HOW DO I USE AI SAFELY IN MY WORK?
THE UPPER HAND
“People speak to AI with a
casualness they’d never
use with HR , not realizing
that unlike venting to a
trusted colleague, there’s
no context, no discretion,
and no expiration date.”
18
Nabiha Syed
HOW DO I USE AI SAFELY IN MY WORK?
Your work AI account is not a journal, a
therapist, or a trusted friend.
Every casual complaint you’ve typed about a colleague, every
“help me write this email because they’re being difficult,” every
question about severance terms — it’s all potentially part of a
personnel file. The informality people bring to these tools
makes it worse. Nabiha Syed put particular emphasis on this
point, noting that people speak to AI with a casualness
they’d never use with HR, not realizing that unlike
venting to a trusted colleague, there’s no context, no
discretion, and no expiration date. The risk runs in both
directions — it’s not just what you say about others, but what
you reveal about yourself.
Like your work email, your AI account belongs to the
environment that issued it, and everything you put into it can
be retrieved, reviewed, and used in ways you never intended.
We have to think about AI more like a public-facing third
party, not like a private chat. We all need places to talk freely.
We suggest you meet a colleague for a coffee (again, instead
of telling the group chat) instead of venting to the chatbot.