The Line: What Manufacturing CI Can and Can't Do

Legal fear stops more manufacturing CI programs than budget ever does. The fix is not a lawyer on retainer; it is a written boundary your team can execute without asking permission every week.

Why CI programs stall on legal, not on budget

Ask a manufacturing CI team why it produces so little and the answer is usually framed as resources. Watch the team for a week and a different mechanism appears. Someone finds a promising collection idea: a competitor's booth layout worth photographing, a former employee willing to talk, a supplier portal worth monitoring. The idea travels up one level and hits the same question. Can we do this? Nobody in the room can answer with confidence, so the idea dies quietly, without a decision ever being recorded.

Repeat that scene for a year and the program converges on the safest possible output: summaries of published news. Nobody gets in trouble for reading a press release. The program survives, the budget survives, and the lead time, the entire reason the function exists, goes to zero. The team has become a clipping service with a strategy title.

The confusion underneath is a category error. Teams argue about whether a piece of information is sensitive, when the actual risk lives in how the information was obtained. Public availability and acquisition method are two separate questions. A competitor's pricing is fine when it comes from a published tender award. The same number is a serious problem when it comes from a fake identity on a phone call. Once you separate the fact from the method, most debates dissolve, because the method is what you can actually write rules about.

Green: public by design

Green sources share one property: the owner published the information, or a public authority did, for anyone to read. No deception, no access circumvention, no breach of anyone's duty. A team that builds most of its collection on this list can move fast without asking permission each time.

• Financial reports and prospectuses. Filed with regulators precisely so outsiders can read them; analysis is the expected use.
• Patent and trademark filings. Publication is the price of protection; the document exists to be read by competitors.
• Tenders and award announcements. Public procurement is published by design, and many private buyers post awards as well.
• Government disclosures, registries, and official lists. Subsidy recipients, environmental permits, licenses: published for public oversight, usable for analysis.
• Public standards and certification directories. Certification bodies publish who holds which certificate; a competitor's new certification is a public fact.
• Trade show public materials and booth observation. Anything displayed to the floor is displayed to everyone; the booth is a stage, not a vault.
• Job advertisements. The employer wrote them to attract strangers; role, skills, and location are deliberate disclosures.
• Customs and trade statistics. Data released by authorities for public use, aggregated or shipment-level depending on the jurisdiction.
• Trade media and association reports. Published analysis is a legitimate input; the work is reading it earlier and more carefully than rivals do.

Notice what this list already covers: capacity, technology direction, certifications, hiring, customers, and pricing signals. Most programs that complain about legal constraints have never come close to exhausting the green list.

Yellow: defensible only with process

Yellow activities are legitimate only under conditions. Each is fine when done one way and indefensible when done another. The difference is process, and process is what you write down before the activity, not after someone questions it.

• Public professional-network interaction with competitor employees. Condition: your profile is real, your affiliation is honest, and you engage on what they publicly post, never probing for confidential work. Record: the profile used and the message log.
• Interviews with former employees. Condition: you ask only about public information or the person's own general experience and skills, and you state at the start that you do not want the former employer's confidential information; ideally the interviewee acknowledges that scope in writing. Record: the scope statement, date, and interviewer.
• Conversations with your suppliers and customers about competitors they also serve. Condition: you never ask them to violate a confidentiality obligation; you ask what they are free to share, such as their own plans, public roadmaps, and market impressions. Record: meeting notes that show the question framing.
• Automated collection of public pages. Condition: respect the site's terms of use and robots directives, keep a conservative request rate, and collect only what a logged-out visitor could read. Record: the crawler configuration, the target list, and the terms reviewed.
• Commissioned third-party field observation. Condition: the brief requires lawful, public-observation methods only, and the contract says so explicitly; you do not outsource what you may not do yourself. Record: the brief, the contract clause, and the deliverable.

The pattern is consistent: a yellow activity becomes defensible when you can show the condition was set in advance and the record exists. A yellow activity without a record is treated, by courts and by partners, as a red one you forgot to log.

Red: do not do, and write it down

Red is short on purpose. Each item carries the same double cost: legal exposure, and the trust destruction that follows when customers, suppliers, or your own board learn how you operate.

• Misrepresenting your identity to obtain quotes or internal information. A fake buyer persona is not a clever hack; it is misrepresentation, and it poisons every number it produces.
• Inducing anyone to breach a confidentiality duty. The breach is theirs, but the inducement is yours, and many jurisdictions treat the two as the same act.
• Buying or accepting trade secrets. Possession with knowledge is enough; "we did not steal it ourselves" is not a defense.
• Bypassing access controls. Passwords shared in confidence, scraped login areas, and technical circumvention convert legitimate work into unauthorized access.
• Feeding information obtained under an NDA into your intelligence repository. The repository outlives the agreement, and one contaminated dataset compromises every product built on it.
• Writing guesses as facts in decision documents. Not a legal violation, but the fastest way to destroy the internal trust a CI function runs on. Label estimates as estimates.

Turn the three lists into a one-page internal SOP. Green items need no approval, only logging. Yellow items need the stated condition met and the record filed. Red items need no discussion. The SOP's second half is one sentence: every entry in the intelligence repository records the source, the date, the collection method, and the person who collected it. That single habit is what lets you answer, a year later, the only question legal actually asks: how do you know this?

One boundary applies to this article itself: this is an operating framework, not legal advice. Law varies by jurisdiction and by fact pattern, and any specific practice should be reviewed by your own counsel before adoption.