The Breach Is Contractual First: Client Data in AI Tools

A consultant has a client's draft board deck open on one screen and a deadline on the other. The slides are dense, the chair wants them shorter, and the firm's approved AI tool is still stuck in procurement. So the consultant pastes the deck's text into the chatbot on their personal account, asks for a tighter version, and has it back in a minute. The client never finds out. The deck is better.

Before any regulator could take an interest, something else has already happened. The deck arrived under a confidentiality agreement, and that agreement almost certainly says who the consultant's firm may share it with. A consumer AI service is not on the list. The firm has breached its contract with the client, quietly and probably without anyone noticing, on an ordinary Tuesday afternoon.

Most discussion of AI and privacy starts with statutes like HIPAA and the GDPR, and those matter. But for most businesses the first exposure from pasting someone else's data into an AI tool is contractual. NDAs, data processing agreements, business associate agreements and vendor terms all decide in advance who may receive the information, and a paste into an unapproved tool sends it to someone outside that circle. The counterparty to that breach is the client, which makes it the exposure most likely to cost you the relationship.

The contract got there first

Regulators act on thresholds. A statute usually needs personal data of a particular kind, a regulated entity, a reportable harm, and someone who notices. A contract needs none of that. If the agreement limits disclosure, an unauthorized disclosure is a breach whether or not anyone is hurt, and the client does not need a regulator's permission to raise it.

Look at how a typical mutual NDA is drafted. The Common Paper Mutual NDA, a free standard form, is a fair example because it is written to be ordinary. It requires the receiving party to "use Confidential Information solely for the Purpose." It allows disclosure without approval only to "its employees, agents, advisors, contractors and other representatives having a reasonable need to know for the Purpose," and only if they are "bound by confidentiality obligations no less protective" than the NDA itself. The receiving party "remains responsible for their compliance."

Run the consultant's paste through those words. An AI provider operating under consumer terms is not an employee or an adviser. One could argue it is a kind of contractor, but the clause then asks whether it is bound by obligations as protective as the NDA, and consumer terms that let a provider keep conversations or use them to improve its models are hard to describe that way. One way to read the clause is that an enterprise AI agreement with confidentiality terms and no training on your data might fit the representative exception, while a personal chatbot account almost never will. The gap between those two cases is the gap between approved and unapproved AI tools.

What people are actually sending

None of this would matter much if employees kept client material out of AI tools. They do not, and the reason is less carelessness than convenience. When Microsoft and LinkedIn surveyed 31,000 people for the 2024 Work Trend Index, 75 percent of knowledge workers said they used AI at work, and 78 percent of those users were bringing their own tools rather than waiting for their employer to choose.

A narrower survey shows what goes into those tools. In a January 2025 poll of 1,000 American employees at companies with at least 5,000 staff, published by TELUS Digital, 57 percent admitted entering sensitive information into publicly available AI assistants, and 68 percent said they used those assistants through personal accounts. The categories they reported read like a list of things that arrive under contract: personal data (31 percent), product or project details (29 percent), customer information (21 percent) and confidential financial information (11 percent). It is one self-reported sample published by a technology vendor, and it measures what people admit, so the real figures could run either way.

The detail that should worry a general counsel is the one about overlap. Of employees who had a company-provided AI assistant, 22 percent still used personal accounts. Buying an approved tool reduces the problem without closing it, because the approved tool has to be better than the personal one at the exact moment someone is in a hurry.

Three clauses that turn a paste into a breach

NDAs are the broadest case. Three narrower kinds of agreement are stricter, because the law tells the parties what to put in them.

Data processing agreements

If your company handles personal data on behalf of a client in Europe or the UK, you are probably a processor under a data processing agreement, and Article 28 of the GDPR shapes that contract. Article 28(2) is short: "The processor shall not engage another processor without prior specific or general written authorisation of the controller." Article 28(4) adds that any processor you do engage must take on "the same data protection obligations" by contract.

An AI provider that receives your client's customer records to summarize or classify them is doing processing on your behalf. If it is not on the sub-processor list your client approved, an employee's paste has engaged an unauthorized sub-processor. That is a breach of the DPA and, separately, a failure of the processor's own duties under the Regulation. Our explainer on what Anthropic's DPA actually covers shows what the authorized version looks like, sub-processor list included.

Business associate agreements

Health data follows the same pattern with different vocabulary. Under 45 C.F.R. § 164.502(e), a business associate may pass protected health information to a subcontractor only after obtaining "satisfactory assurances" that the subcontractor will safeguard it, which in practice means a signed business associate agreement. A billing company or a transcription service that lets staff paste patient details into a chatbot with no such agreement has broken the terms its covered-entity client relies on. The client then has its own problem under HIPAA, which we cover in Is ChatGPT HIPAA Compliant?

Service-provider terms in financial services

Financial regulators push the same logic onto vendors through their clients. The SEC's amended Regulation S-P requires covered institutions such as broker-dealers and investment advisers to have written policies "reasonably designed to require oversight, including through due diligence and monitoring, of service providers," and to make sure those providers give notice "as soon as possible, but no later than 72 hours" after becoming aware of a breach involving unauthorized access (17 C.F.R. § 248.30). A plausible reading is that firms will meet this duty through contracts, so a vendor to an adviser should expect its agreement to carry both the restriction and the 72-hour clock. Whether a single paste into a chatbot counts as a breach that triggers the clock is a fair question that the rule does not answer directly. A vendor would be wise not to be the test case. The broader picture for banks and advisers is in our guide to AI under GLBA and FFIEC expectations.

Why the remedy clause matters more than the fine

People tend to measure legal risk in regulatory penalties because those are the numbers in the headlines. Contracts carry quieter costs that are often larger.

Go back to the Common Paper NDA. Section 10 says a breach "may cause irreparable harm for which monetary damages are an insufficient remedy" and entitles the disclosing party "to seek appropriate equitable relief," including an injunction. Section 6 lets the disclosing party demand that the receiving party destroy its confidential information and "confirm its compliance with these obligations in writing." Picture signing that confirmation after a team has spent a year pasting the client's material into personal AI accounts. You cannot delete what sits in a provider's systems under someone else's retention terms, and the NDA's exception for "standard backup or record retention policies" applies to the receiving party's own records, not to a stranger's. Our guide to whether ChatGPT saves your prompts shows how varied those terms can be.

Then there is the commercial cost. When a client's security questionnaire asks how a vendor uses AI, the answer becomes a representation. Someone filling one in may say AI use is limited to approved tools because the policy says so. If the practice differs, the false answer can matter more than the paste.

Contracts are also starting to name AI directly. Common Paper now publishes an AI Addendum for agreements with AI vendors, and its default is blunt: "Provider may not use Customer's Inputs or Outputs to Train any Model" unless the parties agree otherwise. That clause protects buyers of AI services. Expect the same instinct to reach the other direction, as clients write AI terms into what they ask of the firms that hold their data.

Why the usual fixes leave a gap

The standard responses each solve part of this and leave part open.

A policy is the first step and the weakest control on its own. In the TELUS survey, 29 percent of employees said their company had policies prohibiting them from putting company, client or other sensitive information into AI assistants, and sensitive data still went in. A policy also tends to be written about tools ("do not use ChatGPT"), while the contract is written about data ("do not disclose this"). A sound AI acceptable use policy is organized around categories of information for exactly this reason.

An approved enterprise tool fixes the recipient problem for the work that goes through it. Enterprise and API terms differ sharply from consumer terms on retention and training, as we explain in ChatGPT API vs consumer privacy. But approval has to reach the client contract too. If your DPA requires prior authorization for sub-processors, adding an AI provider means telling the client, and some clients will say no. The 22 percent who keep using personal accounts are a reminder that a tool can be approved and still be skipped.

Traditional data loss prevention watches files, email and uploads well. Text typed or pasted into a browser tab is harder for it to see, and that is where most of this activity happens. Professional consent rules do not close the gap either. Lawyers face additional duties about client confidences in AI tools, which we cover in Can Lawyers Use ChatGPT?, but consent from one client does nothing for the next client whose file is open in the other tab.

What these fixes share is that each operates at a distance from the moment of disclosure. The policy was read months ago. The approved tool is one option among several. Nothing in the path of the paste asks whether the text contains a client name, an account number or a figure the NDA protects.

Frequently asked questions

Does a standard NDA forbid pasting confidential information into an AI chatbot?

Most NDAs do not mention AI, but they do not need to. They limit use to a stated purpose and limit disclosure to named categories of people who are bound by equivalent confidentiality. A consumer AI service usually falls outside those categories, so the paste is an unauthorized disclosure under the existing language. An enterprise AI agreement with strong confidentiality terms may fit inside them, depending on the drafting.

Is an AI provider a sub-processor under a GDPR data processing agreement?

If it processes personal data on your behalf as part of work you do for a controller, it is acting as another processor, which most DPAs call a sub-processor. Article 28(2) of the GDPR requires the controller's prior written authorization before you engage one. An AI service missing from your client's approved list should not receive that client's personal data.

Can a firm cure an AI disclosure by asking the provider to delete the data?

Deletion can limit further harm, but it does not undo the breach, which occurred when the data was sent. Provider retention depends on the account type, the settings in use and any legal holds, and a firm generally cannot verify deletion inside another company's systems. Many confidentiality agreements also ask for written confirmation of destruction, which is difficult to give honestly in this situation.

Should client contracts address AI use explicitly?

It helps both sides. A clause that lists which AI services may receive client data, under what terms and with what notice, replaces guesswork with a rule employees can follow. Firms that rely on AI should raise it at signing rather than hoping the general confidentiality clause will be read generously.

Read the contract before the policy

The practical lesson is to start from your inbound obligations. List the agreements under which you hold other people's data: NDAs, DPAs, BAAs, service agreements, engagement letters. For each, ask who you are allowed to tell and what notice you owe if you tell someone else. That map tells you which AI providers you can approve, which clients must be told first, and which data should never reach an AI tool in identifiable form. Data minimization and pseudonymization are the principles that let useful work continue inside those limits, because a contract that protects a client's name and numbers is not breached by a prompt that contains neither. For professional teams the legal use case shows how this plays out day to day.

The last step is putting a check where the breach actually happens, in the second between copying the text and sending it. That is the gap Locke is built to close: it runs on your device, detects names, account numbers and other sensitive values in the AI tools it screens, and swaps them for placeholders before the prompt leaves, and the unmasked content is never sent to Sonomos. Download Locke and try it on the client work you already do with AI.