Ethical, legal and AI-assisted communication, and capstone: a communication portfolio

Every message you send at work carries ethical and legal weight. Words can defame, mislead, breach privacy, violate anti-spam law or create records that surface years later in a lawsuit. At the same time, generative artificial intelligence (AI) tools have become everyday writing assistants, raising new questions about accuracy, confidentiality, authorship and disclosure. This final lesson covers the ethics of business communication, the main legal risks (defamation, privacy, electronic marketing and records), responsible use of AI writing tools, and then brings the course together in a capstone communication portfolio.

Ethical communication

Ethical communication is truthful, fair and respectful. It does not lie, but it also avoids subtler forms of deception: omitting material facts, burying important terms in fine print, using technically true statements to create a false impression, presenting opinions as facts, exaggerating, or using visuals that distort data (lesson 8). It respects confidentiality, gives credit for others' work and ideas, and avoids language that demeans people or groups. Most professional bodies, from accounting and engineering associations to public relations societies, include honest communication in their codes of conduct.

A few practical tests help when you are unsure. The publicity test: would you be comfortable if this message appeared in the news or in front of a judge? The reversal test: how would you feel if you received it? The disclosure test: would the reader make a different decision if they knew what you know? And the trusted-colleague test: would a respected colleague see a problem with it? If a message fails any of these tests, revise it or seek advice before sending.

Defamation

Defamation is a false statement of fact, communicated to at least one other person, that harms someone's reputation. Written defamation (including emails, posts and reviews) has traditionally been called libel, and spoken defamation slander. Businesses face defamation risks when employees criticize competitors, former employees, customers or suppliers, and when they write references or post online. The main defenses include truth (justification), opinion or fair comment on a matter of public interest, privilege (for example, statements in court or, in some circumstances, references given in good faith) and, for the media and others, responsible or public-interest communication.

In the United States, defamation is governed by state law, shaped by the First Amendment. Since New York Times Co. v. Sullivan (1964), public officials, and later public figures, must prove actual malice: that the speaker knew the statement was false or acted with reckless disregard for the truth. Private individuals usually need to show at least negligence. Statements of pure opinion are generally protected. More than 30 states have anti-SLAPP laws, and Section 230 of the Communications Decency Act generally shields online platforms from liability for content posted by users, though not the users themselves.

Practical rules reduce the risk: stick to verifiable facts, label opinions as opinions, avoid speculation about people's motives or character, keep criticism of competitors to documented comparisons, and give references that are honest and limited to facts you know. When responding to a negative online review, stay factual and courteous; an angry response can create a new problem.

Privacy

The United States has no single comprehensive federal privacy law. Instead, federal laws protect particular kinds of information, such as health information under HIPAA, financial information under the Gramm-Leach-Bliley Act and children's information online under COPPA, while the Federal Trade Commission treats broken privacy promises and lax data security as unfair or deceptive practices. About 20 states, led by California with the California Consumer Privacy Act as amended by the California Privacy Rights Act, have passed comprehensive consumer privacy laws that give residents rights to know, delete and opt out of the sale or sharing of their data, and every state has a data breach notification law. For communicators, privacy means collecting only the personal information you need, using it only for the purposes you stated, sending it only to people entitled to see it and protecting it in emails and files.

Commercial electronic messages: CASL and CAN-SPAM

Marketing emails and texts are regulated on both sides of the border, and the two laws take different approaches. Canada's anti-spam legislation (CASL) is an opt-in law: in general, you need the recipient's consent before sending a commercial electronic message. The US CAN-SPAM Act is an opt-out law: you may send commercial email without prior consent, but you must follow content rules and honor unsubscribe requests. A message sent from or to Canada must comply with CASL, and a message sent to US recipients must comply with CAN-SPAM, so organizations that market in both countries usually design to the stricter Canadian standard.

Business records and retention

Emails, chat messages, documents and recordings are business records. Organizations keep records to meet legal and tax requirements, to support decisions and to defend themselves in disputes, and they destroy records on a schedule to limit cost and risk. A records retention schedule sets how long each type of record is kept.

In the United States, the Internal Revenue Service generally requires tax records to be kept for at least three years after filing, and up to seven years in some cases, and federal employment laws require payroll and personnel records to be kept for set periods (for example, three years for payroll records under the Fair Labor Standards Act).

When litigation is reasonably anticipated, an organization must preserve relevant records, including emails and chat messages, under a legal hold, even if the normal schedule would destroy them. Deleting relevant records after that point can lead to severe court sanctions. In discovery, the other side can request relevant electronic records, which is why the advice in lesson 1, to write every message as if a judge might read it, is practical rather than theoretical.

Using AI writing tools responsibly

Generative AI tools can draft emails, summarize documents, suggest rewrites, translate and create slide outlines in seconds. Used well, they save time and can improve clarity. Used carelessly, they create serious problems. AI models can produce confident, fluent text that is wrong, including invented facts, figures and citations (often called hallucinations). Text pasted into a public AI tool may be stored or used in ways that breach confidentiality, privacy law or a client agreement. AI output may echo biased patterns in its training data. And readers may feel misled if they discover that a message presented as personal was generated by a machine.

Disclosure norms are still developing. There is no general federal AI disclosure law in the United States, but the Federal Trade Commission has warned that using AI to deceive consumers, such as fake reviews or undisclosed chatbots posing as people, can violate the FTC Act, and its 2024 rule on fake reviews bans AI-generated reviews attributed to people who do not exist. Several states have disclosure laws: California requires bots used to sell goods or influence votes to identify themselves, and Utah requires disclosure of generative AI in certain consumer interactions. New York City and Illinois regulate AI in hiring (lesson 11). For organizations that also operate in Europe, the European Union's AI Act sets transparency obligations, such as telling people when they are interacting with a chatbot and labeling certain AI-generated content, which began to apply in August 2026.

Capstone: building your communication portfolio

Throughout this course, each lesson has ended with a portfolio task. The capstone brings the best of that work together into a professional communication portfolio that shows an employer what you can do. The portfolio has three core pieces built around one realistic business scenario, plus a reflection.

• A business email or memo (lessons 3 to 5): a purpose-first message to a decision-maker, for example announcing a recommendation, requesting approval or delivering bad news, with a specific subject line and a clear action and deadline.
• A short report or proposal (lessons 6 to 8): four to six pages with an executive summary, talking headings, at least one accessible chart with a takeaway title, a weighted decision matrix or budget table, and at least three sources cited in APA or Chicago style.
• A presentation (lesson 9): six to eight slides and a recorded five-minute talk presenting the report's recommendation, with takeaway headlines, minimal text and a call to action.
• A reflection of about 500 words: what you learned, which feedback changed your work, how you adapted to your audience, and how you used (or chose not to use) AI tools, with a note of what you verified.

Keep your portfolio after the course. Remove confidential details, store it as a PDF or a simple website, and update it as you produce new work. In interviews, a portfolio turns claims such as "strong communication skills" into evidence.