A content agency gets a polite but pointed email from a client. The client ran the agency’s last three blog posts through a detection tool, and all three came back as “likely AI-generated.” The contract, signed eight months earlier, says deliverables must be original human-written work. The account manager forwards the email to the writer, who insists she wrote every word. Now the agency director has to decide who to believe, using a tool nobody at the agency has ever used, against a clause nobody remembered was in the contract.
Versions of that scene are playing out in agencies, law firms, consultancies, and marketing teams everywhere. The question underneath it is whether employers should check the work their people produce for AI involvement, and if so, how to do it without wrecking trust or punishing people for things they didn’t do.
There isn’t a single answer that fits every organisation. A team writing regulated financial disclosures has different obligations from a startup whose staff use chatbots to draft internal meeting notes. What follows is a framework for deciding, and a set of policy elements that keep checking fair if you decide to do it.
Why some employers want to check
The reasons tend to be more specific than “we don’t trust AI.”
Client contracts. Some clients now include clauses requiring human authorship, disclosure of AI use, or both. If your organisation signed one, you need some way of knowing whether the work meets it.
Confidentiality. An employee who pastes a client’s unreleased product plans into a public chatbot to “clean up the wording” may have breached a confidentiality agreement. Checking output for AI patterns doesn’t detect this directly, but it often prompts the conversation that reveals it.
Accuracy and liability. AI tools invent facts, figures, and citations. In legal, medical, financial, and engineering work, a confident fabrication in a client document is a liability problem.
Copyright and ownership. The legal status of purely AI-generated content remains unsettled in many jurisdictions, and some registries have declined to register works without meaningful human authorship. Organisations selling content or IP need to know what they’re selling.
Quality and search performance. Marketing teams worry that thin, generic AI text performs poorly with readers and search engines. That’s less about AI itself and more about low-effort content, but AI makes low-effort content cheap to produce at scale.
None of these reasons requires banning AI. Most of them require knowing when and how it’s used.
Why employers should be cautious
Detection tools are probabilistic. An ai content detector estimates the likelihood that text was machine-generated, based on patterns such as how predictable the word choices are and how uniform the sentence structure is. The better tools highlight specific passages and distinguish between fully AI-written text and human writing that’s been lightly refined with AI, which is far more useful in a workplace than a single percentage.
All of them can be wrong in both directions. They flag human writing as AI more often when the text is short, formulaic, highly technical, or written by someone working in a second language. A compliance officer who writes in a deliberately plain, structured style, or an engineer whose English is precise and limited to the vocabulary of the field, may score as “likely AI” while having written every word by hand. They also miss AI text that has been edited heavily.
That has consequences:
- Unfair outcomes. Disciplining someone on the basis of a detection score alone risks punishing honest work, and the risk falls unevenly on non-native speakers.
- Morale and trust. Staff who feel surveilled, or who feel accused by software, tend to disengage. People who’ve been wrongly flagged rarely forget it.
- Legal exposure. Depending on where you operate, employee monitoring may require notice, a legitimate purpose, proportionality, and in some places consultation with employee representatives. Running staff writing through a third-party tool also means sending their work, and potentially client data, to an outside processor.
- Perverse incentives. If people know their work will be scored, some will spend time making text “pass” rather than making it good.
A framework for deciding
Before writing a policy, answer four questions candidly as a leadership team.
- What specifically are we trying to prevent or confirm? “Contract compliance on client deliverables” is a clear purpose. “Keeping AI out of the building” is not, and probably isn’t achievable.
- Which content does that purpose apply to? Usually a narrow set: client-facing deliverables, published content, regulated documents, and submissions where authorship is contractually specified.
- Is checking the least intrusive way to achieve it? Sometimes a clear disclosure rule plus normal editorial review is enough, and no detection tool is needed at all.
- What happens after a flag? If you can’t describe a fair process for handling a positive result, you aren’t ready to check.
If the answer to the first question is vague, stop there. A vague purpose leads to broad monitoring, and broad monitoring is where most of the legal and morale problems come from.
Matching the approach to the content
Different kinds of work justify different levels of scrutiny. This is one way to tier it.
| Content type | Typical risk | Suggested approach |
|---|---|---|
| Internal notes, chat messages, brainstorming docs | Low | No checking. Clear guidance on what data can go into AI tools. |
| Internal reports and presentations | Low to moderate | Disclosure of AI use encouraged; normal manager review. |
| Client deliverables without AI clauses | Moderate | Disclosure required; fact-checking mandatory; spot checks optional. |
| Client deliverables with human-authorship clauses | High | Disclosure required; checking before delivery with human review of any flags. |
| Regulated or legal documents | High | Approved tools only; full human verification of every claim; documented sign-off. |
| Published marketing and editorial content | Moderate | Editorial review for originality and accuracy; detection as a secondary signal only. |
The table is a starting point. A law firm and a social media agency will draw the lines in different places.
What a fair policy includes
If you decide to check some content, the policy around it matters more than the tool you pick. These are the elements that tend to make the difference between a policy staff accept and one they resent.
Say clearly what AI use is allowed
Employees can’t comply with a rule they can’t see. Spell out which tools are approved, which uses are encouraged (grammar checking, summarising your own notes, brainstorming), which need disclosure (drafting sections of client work), and which are prohibited (pasting confidential client data into public tools, submitting unreviewed AI output as final). Update it at least once a year, because tools change quickly.
Tell people what will be checked, and why
Covert checking is the fastest way to destroy trust and, in many places, may breach monitoring rules. The policy should state which categories of work may be checked, the purpose, the tool used, and who sees the results. A line in the employee handbook nobody reads isn’t enough. Brief teams directly.
Never act on a score alone
This is the most important clause in the policy. A detection result should trigger a conversation, not a consequence. Write it down explicitly, something like:
Results from AI detection tools are treated as indicators only. No disciplinary action will be taken solely on the basis of a detection score. Any concern will be discussed with the employee, who will have the opportunity to explain their process and provide supporting evidence such as drafts, notes, or version history.
Build in a human review step
When something is flagged, a manager or editor reviews the work in context. They look at the employee’s drafts and version history, talk to them about how the piece was produced, and consider whether the flagged passages are simply formulaic (a methods section, a standard disclaimer, a template paragraph) rather than generated.
Give people a way to respond
Employees should be able to explain, provide evidence, and escalate if they disagree. Version history in Google Docs or Word, research notes, and earlier drafts are usually decisive. Encourage staff to work in tools that keep that history.
Handle the data properly
Check the detection tool’s terms. Where does submitted text go? Is it stored? Is it used to train models? If you’re submitting client documents, does that comply with your client agreements and data protection obligations? For sensitive material, an enterprise agreement with clear data handling terms may be necessary, or it may mean detection isn’t appropriate for that content at all.
Train the people who read the results
Managers who review flags need a short briefing before they see their first one. Cover what the score represents, the kinds of writing that get falsely flagged, how to ask about someone’s process without sounding accusatory, and where to log the outcome. Twenty minutes is usually enough. Without it, a manager who sees “87% AI” on a report from a strong performer will often react to the number, and the employee will remember the tone of that first conversation long after the facts are cleared up. Keep a short record of each review, including flags that turned out to be false, so the organisation learns how the tool behaves on its own writing.
Make disclosure easy and safe
The best outcome is one where people tell you when they’ve used AI, so checking becomes a backstop rather than the main control. That only happens if disclosure doesn’t lead to punishment for permitted use. A simple field in your project management tool or a line at the end of a deliverable (“AI tools used: grammar check, outline brainstorming”) normalises it.
Handling the agency scenario
Go back to the agency at the start. A fair process might run like this.
The director thanks the client and asks which tool they used and whether they can share the highlighted passages. Separately, they ask the writer for her drafts and version history for the three posts, explaining that it’s routine and not an accusation. They run the posts through their own detection tool to see whether the result holds up, and read the flagged passages closely.
Suppose the version history shows each post built over two or three days, with an outline, a messy first draft, and visible rewrites. The flagged sections turn out to be the intro and conclusion paragraphs, which follow the client’s own content template closely. The director shares a summary with the client, explains the template issue, and offers to vary the structure in future posts. The writer is told the outcome directly and thanked for providing the history.
Now suppose instead the history shows each post pasted in whole, in a single session, with no prior drafts. That’s a different conversation, but it’s still a conversation, starting with a question rather than a conclusion. The writer may have drafted elsewhere. Or she may have used AI and not realised the contract prohibited it, which is a training gap as much as a conduct issue.
In both versions, the detection score started the process and the human evidence settled it.
Common mistakes
Checking everything. Running every email and document through a detector creates noise, costs money, and feels like surveillance. Scope it to the content where it serves a defined purpose.
Treating the percentage as a verdict. A 70% score is not a 70% probability that the person is lying.
Banning AI without offering alternatives. If people are using AI to cope with unrealistic deadlines, a ban pushes it underground. Address the workload.
Forgetting the client side. If a client contract restricts AI use, the people doing the work need to know about that clause. Many disputes start because the restriction lived only in a contract file the writer never saw.
Using unvetted free tools on confidential material. The check itself can become the data breach.
FAQ
Is it legal to check employees’ work for AI? In many jurisdictions, reviewing work product is a normal part of employment. Monitoring rules vary, though, particularly around notice, proportionality, and the use of third-party processors. Get local legal advice before introducing systematic checking, especially in the EU, UK, and Canada.
Should we tell clients when we use AI? If the contract requires it, yes. If not, many organisations are choosing transparency anyway, since clients increasingly run their own checks and a surprise discovery damages the relationship more than a disclosed one.
Which detection tool should we use? Look for sentence-level highlighting, categories that separate AI-generated from AI-refined text, clear data handling terms, and a vendor that openly discusses false positives. An ai content detector that shows its uncertainty is more useful in a workplace than one that only gives a single headline number.
A first step this month
Pull your five largest client contracts and search them for “AI,” “artificial intelligence,” “machine-generated,” and “original.” Note what each one requires. Then ask the people who produce that client’s work whether they knew. That short exercise will tell you whether your organisation needs a detection process, a disclosure rule, a training session, or simply a better way of passing contract terms to the people doing the work.
