Does putting client work into AI breach your NDA — and what it costs even when it does not

Two questions get collapsed into one here, and they have different answers, different remedies and different half-lives. Separating them is most of the work.

Breaching the NDA is the recoverable half

A breach of an NDA is a contract claim. The counterparty identifies the term, the breach and a loss, and gets what the agreement gave them — damages, an injunction, an indemnity, sometimes costs. It is unpleasant, negotiable, and it concludes.

The other half does not conclude. Trade secret protection is a status, not a grant, and it holds only while three conditions hold together. Under 18 U.S.C. § 1839(3) the information must derive independent economic value from not being generally known or readily ascertainable by proper means, and the owner must have taken reasonable measures to keep it secret. The USPTO states the consequence in one line: if any one element ceases to exist, the trade secret ceases to exist.

So the exposure is lopsided. Your breach costs you money. The client's loss of status costs them the asset — against competitors, against former staff, against everyone who had nothing to do with the paste.

Most NDAs already cover this without using the word AI

People search an old agreement for "artificial intelligence", find nothing, and conclude it is silent. It rarely is. Four ordinary clauses do the work between them.

• Disclosure to third parties. A vendor is a third party. Pasting sends the client's text to a company the client never chose.
• The purpose limitation. Use is permitted only for the defined Purpose. Improving somebody else's product is not the Purpose.
• Permitted recipients. Share with employees, advisers and sometimes subcontractors, if they are bound by equivalent written obligations. This clause decides the answer.
• The standard of care. Many NDAs require the care you use for your own confidential material. A personal chat account rarely clears that floor.

Read the permitted-recipients clause twice. Where it extends to service providers bound by obligations no less protective, a business-tier tool under no-training terms may already sit inside the fence. Where it names only employees and advisers, it does not, and care about the tool will not fix that. What else changes with the direction of flow is in the guide to mutual and one-way NDAs.

The plan tier is the fact that flips the answer

The same assistant, under the same brand name, is two different contracts depending on how you signed in. The vendors publish the split themselves, and it is consistent enough to build a rule around.

• Anthropic's consumer terms cover Free, Pro and Max: chats may be used for training unless the user opts out, with five-year retention for those who do not. The commercial terms — Claude for Work, Government and Education, and API use including through Bedrock and Vertex AI — are expressly excluded.
• OpenAI's developer documentation states that API data is not used for training unless the customer opts in, and that abuse-monitoring logs are held for a limited window unless longer retention is required by law. Approved customers can obtain zero data retention.
• Google's Gemini Apps privacy hub says a subset of consumer chats are read by human reviewers, and that chats already selected for review are held separately for up to three years, surviving deletion of the conversation.

Reasonable measures is a question about the owner, not about you

This is the prong that decides whether the information is still a trade secret, and it asks what the owner did. Courts treat it as a fact question. In Samuel Sherbrooke Corporate, LTD v. Mayer (No. 24-2173, 4th Cir., 18 November 2025) the Fourth Circuit held that at the pleading stage, an allegation that the person signed a confidentiality provision is on its own enough to plead reasonable measures.

Read the good news in that. Disclosure made under an obligation of confidence is not disclosure to the world. Where material moves from you to a vendor under commercial terms that forbid training and bind the vendor to confidentiality, the chain of confidence is unbroken and the secret survives the trip. Trade secret law does not punish disclosure; it punishes disclosure that leaves the information unprotected.

The reverse does the damage. Information handed over on terms permitting it to improve a product, retained for years and read by reviewers has left the owner's control by a route the owner never sanctioned. Whether a court calls that a failure of reasonable measures or a loss of secrecy hardly matters — trade secret status is a condition, not a certificate, and it does not come back.

Deleting the conversation does not undo it

Three things govern how long the text survives, and only the first is yours: the delete button, the vendor's retention schedule, and any legal hold above both. Vendor documentation is candid that its own windows yield to law — OpenAI holds abuse-monitoring logs unless longer retention is legally required.

That caveat is not theoretical. In The New York Times Company v. Microsoft Corporation (No. 1:23-cv-11195, S.D.N.Y.), the magistrate judge on 13 May 2025 directed OpenAI to preserve and segregate output log data that would otherwise have been deleted, setting aside its concerns about user deletion requests. The order was later narrowed by stipulation, but the mechanism is permanent: a vendor in litigation cannot honour its own deletion promise.

What an AI clause in a mutual NDA should actually say

Two ways to draft this badly. A blanket ban is unworkable — search, spelling, mail and meeting notes all contain models now, so a clause forbidding all machine-learning processing is breached by both sides on day one. A clause asking the parties to use AI responsibly decides nothing.

That last line is genuinely contested. Some courts have treated the expiry of an NDA's confidentiality obligation as the moment the owner stopped taking reasonable measures, ending trade secret protection with it; more recent decisions treat expiry as one fact for a jury. Splitting the term is cheap insurance, and belongs in the confidentiality clause of your service agreement too.

One more clause applies where the agreement is with a worker. 18 U.S.C. § 1833(b)(3) requires notice of the whistleblower immunity in any agreement governing trade secrets, and an employer who omits it may not be awarded exemplary damages or attorney fees against that person. Contractors count as employees here, so the notice belongs in an independent contractor agreement too — and the vendor terms behind all of it read like any other SaaS agreement: training, retention, sub-processors.

If it has already happened

The order matters here, because the obvious first move destroys the evidence you need for the second.

1. 1

   Record it before you delete it

   Write down what was pasted, into which account and tier, on what date. Deleting first destroys the only description of the exposure, and what left is the first thing the client asks.

2. 2

   Close the training route

   Turn off model training in the account settings, then delete the conversation. That generally stops future use, but anything already pulled for human review sits on a schedule you cannot reach.

3. 3

   Read the notification clause before drafting the email

   Most NDAs name who must be told, in what form and within how many days. A report made outside the contractual route is sometimes treated as no report at all.

4. 4

   Tell them what you know, not what you hope

   The client needs the tier, the published terms, the retention position and the steps taken. "It was not used for training" is only useful if you can point at the paragraph saying so.

5. 5

   Fix the clause, not only the incident

   The same paste happens again unless something changes. An approved-tools rule and a permitted-recipients carve-out cost less than the second apology — the internal version is in the guide to an AI use policy.

The honest answer is narrower than either confident one

Using AI on confidential work is not inherently a breach, and not inherently safe. It is a disclosure, and disclosure is what NDAs and trade secret law were built to regulate. What decides the outcome is whether the recipient is bound to keep it — a question about the plan you signed into and the clause you signed up to, both knowable in the ninety seconds before the paste rather than the six months after.