Confidential information disclosed to AI tools

What it is

Staff use AI tools on the material in front of them: source code, product plans, draft contracts, board papers, another company's documents received under a confidentiality agreement. Entering it into an external tool is a disclosure. The legal consequences differ from those for personal data, covered in personal data in prompts and context. A trade secret is protected only while reasonable steps are taken to keep it secret. Legal privilege can be lost by disclosure. A confidentiality agreement may forbid passing information to any third party, which a tool's provider is.

How it happens

• An engineer pastes proprietary code into a public assistant to find a fault.
• A lawyer uses a general tool to summarise privileged advice.
• Documents received in a transaction are uploaded for analysis.
• A meeting assistant records and transcribes a confidential discussion by default.
• The approved tool is less capable, so staff use another.

Why it matters

Protection that depends on secrecy may be lost for good. The organisation may be in breach of contracts with others and of professional duties. If the provider trains on inputs, the information may later surface in answers to other users, as vendor reuse of organisation data describes.

Warning signs

• No guidance tells staff what classes of information may go into which tools.
• Confidentiality agreements have not been reviewed for their effect on AI use.
• Transcription and note-taking tools join meetings automatically.
• Network data shows large uploads to AI providers.

Who owns it

The owner of the AI policy is accountable for the rules. Information owners classify what they hold. Legal advises on privilege and third-party confidentiality. Security monitors and blocks.

In practice

During due diligence on an acquisition, an analyst uploads the target's customer contracts to a public tool to extract key terms. The confidentiality agreement with the target prohibits disclosure to anyone outside the deal team. The same pattern generalises to any confidential material handled by people with a deadline and a capable tool one tab away.