Electronic communications policy: wording that covers AI and data reuse

What an electronic communications policy needs to cover#

An electronic communications policy covers who owns company communication systems, what employees can expect about privacy and monitoring, how long messages are kept and what counts as acceptable use. Most handbooks have one, often written for email and phones before team chat, recorded meetings and AI tools arrived.

For data reuse, the policy is supporting evidence rather than a license. It shows what employees were told about company records. Rights to license those records still depend on customer contracts, privacy laws and what the records actually contain.

Illustrative policy text: ownership, monitoring and retention#

The illustrative wording below is a starting point for discussion with counsel, not a finished policy.

Illustrative text: Company communication systems, including email, chat and messaging tools, video meeting platforms, ticketing and project systems, and any AI tools provided by the Company, are Company property and are provided for business use. Messages, files and records created or received in the course of Company business on these systems are Company business records.

Illustrative text: The Company may access, review and monitor use of its systems for legitimate business purposes, including security, compliance, investigations and records management, consistent with applicable law. Employees should not expect privacy in business records on Company systems. Records are kept according to the Company's retention schedule and any legal hold.

Illustrative policy text: the AI and data reuse paragraph#

The AI and data reuse paragraph is the part most handbooks lack. It should say what may be reused, how people are protected and which limits apply.

Illustrative text: The Company may analyze and reuse business records, including email, chat, tickets, documents and meeting transcripts, to operate and improve its business, including developing or evaluating software and AI tools. The Company may also license business records to third parties, including AI developers, after removing or masking personal details and confidential client information, and only under written agreements that restrict use and require confidentiality. The Company will not license recordings of employees' voices or images for AI use without separate consent.

The last sentence is optional but useful. It draws the line at voice and likeness, where publicity and biometric laws may apply, and makes a transcript-only approach explicit.

Carve-outs and records to keep out of reuse#

Communications policies need carve-outs so that monitoring and confidentiality language does not overreach. Broad wording that appears to stop employees from discussing pay or working conditions can draw scrutiny under federal labor law, so counsel usually reviews it line by line.

Federal trade secret law adds a specific item. 18 U.S.C. 1833(b) protects individuals who disclose a trade secret in confidence to a government official or attorney to report a suspected violation of law, and requires employers to give notice of that immunity in any contract with an employee that governs use of trade secrets or confidential information.

Some records stay out of any licensed dataset no matter how the employee handbook email policy is worded, because other duties or laws govern them. The table after the list shows the usual exclusions.

• 1Protected activity: nothing in the policy limits employees' rights to discuss wages, hours or working conditions.
• 2Whistleblower immunity: the notice described above, wherever the policy or a related agreement governs confidential information.
• 3Privileged material: communications with company counsel are excluded from reuse and licensing.
• 4Sensitive categories: health, accommodation, complaint and investigation records are excluded from reuse.
• 5Personal messages: incidental personal content is not licensed, even when it sits on company systems.
• 6State notices: where state law requires notice or acknowledgment of monitoring, the policy refers to it.

Does a new policy cover records created under the old one?#

A new policy generally speaks to records created after employees receive it, not to the archive that already exists. Records from earlier years were created under whatever the old policy said, and that is the version a careful reviewer will read.

This is why dated versions matter. Keep each version of the handbook, the date it took effect and evidence of acknowledgment. When a record family is scoped for licensing, match its date range to the policy in force, and let counsel decide how older records are handled.

California needs specific attention. The CCPA's exemption for employee personal information expired on January 1, 2023, and the California Privacy Protection Agency began preliminary rulemaking on April 20, 2026 on how the law applies to employee, applicant and contractor data. Which rules may apply is assessed with counsel.

• 1Publish the updated policy with a clear effective date and a short summary of what changed.
• 2Collect acknowledgments and store them with the policy version they acknowledge.
• 3Archive the prior version unchanged, with its own effective dates.
• 4Brief managers so questions about monitoring and reuse get consistent answers.
• 5Note in the licensing file which policy version covers each record family's date range.

Illustrative: a consulting firm updates its handbook before a licensing review#

Illustrative: a fictional management consulting firm runs on Microsoft 365, Teams and Slack, and its handbook policy, unchanged for years, says only that systems are for business purposes. Leadership is considering licensing de-identified proposal reviews and project retrospectives.

HR and counsel adopt an updated policy with an AI and data reuse paragraph, collect acknowledgments and keep the prior version on file. The licensing scope is limited to project channels and shared documents, with direct messages, HR channels and client deliverables excluded. Records from before the update are reviewed against the old policy before any decision is made about them.

How SourceX uses communications policies#

SourceX reviews communications policies as part of the Rights step of the SourceX five-step transaction, alongside customer contracts and privacy notices. Policy versions and their dates are matched to the record families in scope.

The versions relied on, the channels excluded and the preparation applied are recorded in the SourceX Evidence Packet, so the company can show what employees were told when the records were created.