AI chatbots (like ChatGPT, Gemini, and Claude) offer new opportunities for businesses to analyze and synthesize information in support of informed decision-making. But this apparent efficiency comes with legal risks, the primary being the release of confidential or proprietary information.
Covenants to protect confidential information are found in many agreements, often in the so-called “boilerplate” provisions, although these obligations should not be considered afterthoughts. Confidentiality covenants are usually more robust and central to the consideration for entering into contract in the context of Confidentiality Agreements or Non-Disclosure Agreements (NDAs). Entering into an NDA is often the first step taken when parties are considering a transaction or contractual relationship that will rely on one or both parties sharing protected or sensitive information, the broad release of which would risk a business’s competitive advantage. The promise made to protect confidential information is the consideration offered in exchange for access to new business opportunities.
While there may be some nuance based on AI tools’ terms and conditions of use and the specific language of the NDA, you should assume that feeding confidential information obtained under the protection of an NDA into an AI chatbot will be a breach of the NDA.
NDAs and Third-Party Disclosure
NDAs are built around the core obligation that the recipient of confidential information must safeguard that information and not disclose it to unauthorized third parties. The definition of “disclosure” in most well-drafted NDAs is deliberately broad.
When a user inputs confidential material into an AI chatbot, that information is transmitted to and processed by the platform’s servers. In most cases, the AI provider would qualify as a third party for NDA purposes unless the NDA expressly carves out AI tools or the platform operates under a separate confidentiality arrangement that would satisfy the duties of the receiving party under the NDA terms. Many standard NDAs predate generative AI entirely so do not include an express prohibition of AI use, but silence on the issue does not signal permission.
The Data Retention Problem
The risk of an NDA breach is compounded by what happens to data after it is uploaded to an AI chatbot. Many AI platforms retain user inputs and may use them to train their models. Even where providers offer opt-out mechanisms, default settings on consumer-facing tools frequently involve data retention or review, meaning confidential information may persist in a third-party environment indefinitely. Once stored, that information may be subject to further use, including being sold, shared, or disclosed to third parties in future outputs.
Enterprise or closed-model AI platforms may offer stronger protections and therefore not constitute disclosure, but this assumption should not be assumed.
Practical Recommendations
The use of NDAs serves, first and foremost, as a deterrent. By clearly defining what information is confidential and how it may be used or disclosed, the NDA removes ambiguity and puts every recipient on notice of exactly what is expected to ensure performance.
Organizations should not wait for litigation to crystallize the risk. If you or your company is party to any NDAs (you probably are), four steps are advisable to take now: (1) audit existing NDAs for language that may capture AI platform disclosure; (2) update standard templates to expressly address AI tool usage; (3) implement internal policies that distinguish between consumer and enterprise AI deployments; and (4) review AI provider terms of service, data retention policies, and available confidentiality provisions before using any platform with sensitive data.
The convenience of AI tools should not come at the cost of confidentiality obligations. Businesses handling sensitive commercial information, operating under multiple NDAs, or relying on trade secret protection should treat AI usage as a live compliance issue, not a future one.
For assistance with managing confidentiality obligations in the evolving AI landscape, contact Carol Kingery Ritter and DP&F’s Business Law group.
ABOUT THE AUTHOR
Carol Kingery Ritter is Co-Managing Partner of DP&F and leads the firm’s business law and real property practice groups. Her practice includes general corporate formation, compliance, and restructuring and business contracts, with specific expertise in essential wine business contracts, such as grape purchase agreements, distribution agreements, wine production agreements, vineyard leases and vineyard redevelopment agreements, and counseling clients through complex vineyard, winery and wine business sales and acquisitions.
Carol received her J.D. from the University of California, Berkeley School of Law, having previously earned a B.A. in Anthropology from UC Berkeley, graduating with Highest Honors.