What your NDAs already say about pasting client material into AI

Your client NDAs almost certainly do not mention artificial intelligence. Most of them govern it anyway. The question is settled by three clauses that were already in the document when you signed it: who may receive the information, what you may use it for, and what you must do with it when the engagement ends. As the intellectual-property firm Klemchuk puts it, an NDA “does not need to use the words ‘artificial intelligence’ for AI use to create a contractual problem.”

That is the useful finding, and it points the work somewhere other than where most coverage sends you. Search this topic and you get drafting guidance for in-house counsel: model clauses, negotiation posture, indemnity language. Useful if you are papering a new agreement. Beside the point if you have 60 live contracts you will never reopen and 180 people who all have an AI tab open right now.

The three clauses that already decide this

Pull any mutual NDA off your drive. Ignore the recitals and governing law. Three provisions carry the answer.

Clause	What it usually says	What it means for an AI tool
Permitted recipients	Disclosure limited to employees, affiliates and advisors with a need to know, each bound by equivalent confidentiality obligations	An assistant’s provider is none of those things. If the clause is drafted this tightly, routing covered material through an unvetted tool is disclosure to an unapproved recipient
Permitted purpose	Information may be used solely to evaluate or perform the engagement	Summarizing a covered document to do the work is arguably inside the purpose. Using it to train or fine-tune a model is plainly outside it
Return or destroy	On request, return all copies or certify destruction	Prompt histories, stored conversations and vendor-side logs are copies. You cannot certify destruction of something you cannot reach

The third row is where most companies quietly fail. Return-or-destroy obligations assume copies live in places you control. Material pasted into a personal account lives in a conversation history belonging to an individual, on a system you have no administrative access to, and you have already signed a promise you can no longer keep.

None of this makes every AI use a breach. A broadly written permitted-purpose clause, a tool your client has approved, and a provider contractually barred from training on your content add up to a defensible position. The point is that the answer is already written down, varies by agreement, and nobody at your company has read it.

When an AI vendor stops being a third party

The whole exposure turns on one distinction, and it is contractual rather than technical. The same model sits behind a free login and a managed workspace seat. What differs is the paperwork.

On consumer tiers the common default, though it varies by vendor, is that inputs may be used to improve the service, with an opt-out the user has to find and invoke. On business and enterprise tiers, the commitment reverses: no training on customer content unless the customer asks for it, administrator-controlled retention, and a data processing agreement that makes the provider a contracted processor rather than an unaccounted recipient.

That reversal is what moves an AI tool from outside your permitted-recipients clause to inside it. The provider is now an engaged service provider under written confidentiality terms, which is the same category your accounting platform and your document store already sit in, and nobody worries that a covered file in a cloud drive breaches an NDA. An enterprise AI seat buys the same thing, and we work through what that purchase does and does not fix in the security case for paying for AI accounts.

Two cautions. First, no-training is not no-retention. A vendor can promise never to train on your content while still storing it, logging it, and processing it through subprocessors. Read both commitments separately. Second, the contract covers the tool you licensed, not the three your team also uses. Netskope’s Cloud and Threat Report for 2026 puts the average organization at 223 generative AI data policy violations a month, with intellectual property — contracts, internal documents and proprietary research — accounting for 16% of them. Those are your clients’ documents.

What a court has actually held

On 10 February 2026, Judge Jed Rakoff of the US District Court for the Southern District of New York held in United States v. Heppner that 31 documents a defendant had produced using a consumer AI assistant were protected by neither attorney-client privilege nor the work-product doctrine. He had prepared them on his own initiative, without counsel’s direction, after it was clear he was under investigation.

The reasoning is what matters. The court found the exchanges were not confidential communications with an attorney, that the platform is not an attorney, and that no trusting human relationship exists between a user and a commercial AI service. It appears to be the first ruling that prompts containing protected information are not themselves protected.

Heppner is a privilege case, not an NDA case, and it would be a mistake to report it as deciding contract questions. But the premise it rests on is the same premise your permitted-recipients clause rests on: information routed through a commercial third party has left your control, and asserting confidentiality over it afterwards is hard.

The parallel exposure is trade-secret status, which is worse because it does not come back. Under the Defend Trade Secrets Act, 18 U.S.C. § 1839(3)(A), information qualifies as a trade secret only where the owner has taken reasonable measures to keep it secret. A pricing model or a client list pasted into a consumer account with training switched on is a bad fact in that analysis, and it is a bad fact about your own conduct rather than someone else’s.

The clause arriving in your next client’s first draft

Explicit AI restrictions are still uncommon and growing fast. Ontra’s analysis of more than 645,000 negotiated NDAs found AI-use restrictions in 6.12% of agreements in the second quarter of 2026, up from 0.65% in the first quarter of 2025 — a 9.4-fold rise in five quarters.

The number that should change your planning is a different one from the same dataset: 82% of those restrictions arrive in the counterparty’s first draft. You are not the drafter in this story. You are the signer, and the clause is coming to you.

So read the one you are handed. Three versions circulate, and they are not equivalent.

• A training prohibition. You may not use the disclosed information to train, fine-tune or improve any model. Almost always signable. It describes something you should not be doing anyway.
• An approved-tools requirement. Covered material may only be processed through tools the discloser has approved, or through tools meeting stated conditions such as a no-training commitment and administrator-controlled retention. Signable if you know what your team actually uses. A commitment you cannot verify is the real risk here, not the clause.
• A blanket ban. No AI, full stop. Push back on this one, and do it factually: generative features are now embedded in the document, mail and collaboration platforms both parties already run. A literal reading makes ordinary work a breach, which is why deal-side commentators treat sweeping bans as a drafting failure rather than protection. Offer the conditional version instead.

Watch deletion too. If the agreement requires certified destruction of material held in AI systems, scope the obligation to what is technically within your control.

Read your own agreement stack in an afternoon

This is the step nobody publishes, and it takes one person half a day. It is triage, not a legal opinion — the restrictive outliers are exactly what you then take to counsel.

1. List your top 20 client agreements by revenue. Not all of them. Twenty covers most of your exposure, and you will see the pattern inside the first five.
2. For each, record four things. How permitted recipients is worded, how broadly permitted purpose is drawn, whether return-or-destroy is on request or automatic, and whether any AI language exists. A spreadsheet, four columns, done.
3. Sort into three buckets. Permissive, where a managed tool under a processing agreement is defensible. Restrictive, where recipients are limited to named individuals or purpose is drawn narrowly. Explicit, where AI is addressed directly. Most stacks come out heavily permissive with two or three restrictive outliers.
4. Name the restrictive accounts to the people who work on them. This is the output that matters. Not a policy memo. A short list, held by the account leads, saying which clients’ material does not go into any assistant.
5. Fix the certification problem. Pick one managed workspace where covered work happens, with retention set deliberately and deletion you can execute. The technical side of that is covered in what actually works for data-loss prevention on AI assistants.

Run the same pass on the NDAs you asked vendors and contractors to sign, because your own template binds them the same way and most companies have never checked whether it says anything useful. A generic download usually does not, which is one of the places template policies break.

What to tell the team on Monday

Here is the gap that no contract closes. “Do not put confidential information into AI tools” delegates the hardest judgment in the sentence to the person with the least context. Faced with a draft deliverable containing a client’s internal figures, most people genuinely cannot say whether that counts.

Give them a test they can run in five seconds, before pasting, every time.

1. Whose material is this? If it came from a client, a candidate, a patient or a counterparty, assume it is covered until someone tells you otherwise.
2. Which account am I in? The managed workspace you pay for, or a personal login. If you cannot tell by looking, that is the finding.
3. Is this client on the short list? The restrictive names from step four above. If yes, no assistant, no exceptions, ask the account lead.

Two of the three are answerable without legal knowledge. That is deliberate. A control a non-lawyer can apply under time pressure beats a definition that is technically complete.

Then teach it the way judgment is actually taught: an hour with the team’s own documents, people trying the thing, getting corrected in the moment. Not a slide on a compliance platform. The distance between a signed acknowledgment and a changed habit is the subject of the safe AI use playbook, and it is the same distance between buying licenses and building capability that runs through the case against treating a license rollout as enablement.

If you want a second opinion on where your obligations and your actual tool use diverge, the free AI-readiness call runs the first two steps of that audit with you in half an hour. A facilitated session on your own documents sits in a $2,000 to $15,000 market range, which is small against the value of the agreements it protects.

Three mistakes that look like caution

Banning AI internally and calling it compliance. A ban without a licensed alternative moves the activity onto phones and personal laptops, where you see nothing and can certify nothing. You have traded a manageable risk for an invisible one.

Signing an approved-tools clause you cannot honor. Agreeing that covered material will only pass through approved tools, when you have no inventory of what your team uses, converts an operational gap into a contractual one. Build the inventory first, then sign.

Treating redrafting as the fix. New language binds future counterparties. It does nothing about the 60 agreements already signed, and nothing about the behavior those agreements govern. The contract is the cheap half of this problem. Making 180 people reliably recognize covered material is the half that takes real work, and it is the half that governance training actually has to deliver.

Frequently asked questions

Does pasting client material into an AI tool breach our NDA?

Sometimes, and the agreement decides. Where permitted recipients are limited to people with a need to know who are bound by equivalent obligations, an unvetted consumer tool is likely outside that set. Where you use a managed tier under a processing agreement with no-training terms, the position is far stronger. Read the clause before assuming either answer.

Our NDAs do not mention AI at all. Are we safe?

No, and that is the central point. Silence does not mean permission. The permitted-recipients, permitted-purpose and return-or-destroy clauses apply to any channel through which information leaves your control, and an AI provider is a channel the drafters simply did not picture.

Does a paid enterprise account solve this?

It solves the contractual half. A business or enterprise tier gives you a no-training commitment, administrator-controlled retention and a processing agreement, which plausibly places the provider inside a permitted-recipients clause. It does nothing about which account your team opens at 4pm on a deadline.

What if a client’s NDA bans AI entirely?

Raise it before signing. Generative features are embedded in mainstream document, mail and collaboration platforms, so a literal blanket ban makes routine work a breach. Propose the conditional version: no training on their information, approved tools only, with specified data-handling conditions. Most counterparties accept it because it is what they meant.

Can we certify destruction of material that went into an AI tool?

Only on infrastructure you administer. In a managed workspace you can set a retention window and execute deletion. In a personal account you cannot see the history, cannot delete it, and cannot attest to it. If your agreements require certification, covered work has to run in a workspace you control.

Does this put our trade secrets at risk, not just our contracts?

Yes, and that exposure is harder to recover from. The Defend Trade Secrets Act protects information only where the owner took reasonable measures to keep it secret. Routing a pricing model or client list through a consumer account with training enabled undercuts that argument, and lost trade-secret status does not return.

Is there case law on any of this?

On privilege, yes. In United States v. Heppner (S.D.N.Y., 10 February 2026) the court held that 31 documents a defendant created using a consumer AI assistant were neither privileged nor work product, reasoning that the platform is not an attorney and the exchange was not confidential. No court has yet set a general rule for NDAs, but the premise transfers.

How many NDAs now include AI clauses?

Few, rising quickly. Ontra’s review of over 645,000 negotiated NDAs found AI-use restrictions in 6.12% of agreements in the second quarter of 2026, against 0.65% in the first quarter of 2025. More telling: 82% arrive in the counterparty’s first draft, so expect to be reading these rather than writing them.

What should we do first if we have done nothing?

Spend an afternoon on your top 20 client agreements, note how the three clauses read, and hand the account leads a short list of clients whose material stays out of every assistant. Then license or block the tools your team genuinely uses. Policy drafting comes after both, not before.

Key takeaways

• An NDA does not have to say “artificial intelligence” to govern it. Permitted recipients, permitted purpose, and return-or-destroy already answer the question, and the answer varies by agreement.
• Return-or-destroy is the clause most companies silently breach. You cannot certify destruction of a conversation history inside an employee’s personal account.
• Account tier is what moves a provider from unapproved recipient to contracted processor. No-training and no-retention are separate promises; get both in writing.
• United States v. Heppner (S.D.N.Y., 10 February 2026) held AI-assisted documents unprivileged on reasoning that applies squarely to confidentiality: material routed through a commercial third party has left your control.
• Explicit restrictions reached 6.12% of negotiated NDAs by mid-2026 and 82% arrive in the counterparty’s first draft. Learn to read the three variants; push back only on blanket bans.
• Audit 20 agreements, hand account leads a short restrictive list, and teach a three-question test people can run before pasting. The contract is the cheap half of this.