AI and Nondisclosure Agreements: Is Your NDA Ready for AI?
Your company signed an NDA five years ago. Today, someone on the other side uploads your confidential information into an AI tool to summarize it. Did the NDA prohibit that?
Nondisclosure agreements (“NDAs”) are routine in many business and legal activities, from interactions with suppliers and customers to mergers and acquisitions. While critical to preserving confidential information, many companies have not updated their form NDAs to account for artificial intelligence (“AI”) tools that have become part of everyday business operations.
As a result, many NDAs are silent on whether a recipient may run confidential information through an AI tool, what kind of AI tool may be used, or whether the information may be used to train an AI model. Counsel should review both currently effective NDAs and form NDAs in light of the rapidly growing use of AI.
An NDA does not need to use the words “artificial intelligence” for AI use to create a contractual problem.
Currently Effective NDAs
For currently effective NDAs that do not expressly address AI, whether a recipient may use AI tools with the disclosing party’s confidential information will generally turn on the following provisions:
Permitted Use
NDAs typically restrict the purpose for which a recipient may use confidential information. A broad provision allowing use to evaluate a potential transaction may not be narrow enough to prevent AI-assisted evaluation because the tool arguably is another means of conducting the permitted evaluation.
A narrower use restriction may support a stronger argument that AI use falls outside the permitted purpose. Even where AI-assisted analysis arguably is permitted, using confidential information to train or improve a model presents a materially different question and may fall outside the agreed purpose.
Permitted Recipients
If an NDA permits disclosure only to individuals with a need to know, an argument can be made that an AI tool—and potentially the provider operating it—is not such an individual. Broader language covering agents, contractors, advisors, or representatives may make the analysis less clear. The answer should turn on the actual agreement and service used.
Return or Destruction
Most NDAs require confidential information to be returned or destroyed. Information uploaded to an AI tool may persist in prompt histories, logs, stored conversations, or provider systems. If information is used for model training or improvement, deletion may present additional technical and contractual issues.
Certain AI uses therefore may make compliance with a traditional return-or-destruction obligation difficult or impossible.
Residuals
Some recipient-friendly NDAs permit use of information retained in the unaided memory of personnel. A recipient might attempt to extend broadly drafted residuals language to information retained by a technological system. Disclosing parties should consider expressly limiting residuals to the unaided memory of natural persons.
Using confidential information to evaluate a transaction and using that information to train an AI model are not necessarily the same permitted use.
Public, Consumer, and Enterprise AI Tools
Before confidential information is entered into a third-party AI service, counsel should determine what contractual commitments the provider makes concerning confidentiality, retention, human review, model training or improvement, security, and deletion.
Consumer and enterprise offerings can provide materially different protections, but labels should not substitute for diligence. The relevant inquiry is the actual product, account configuration, contractual terms, data practices, available controls, and sensitivity of the information involved.
What About AI Meeting Transcription and Summarization Tools?
AI use may occur without anyone consciously deciding to upload a confidential document. Deal teams, business-development personnel, lawyers, and employees increasingly use meeting transcription, note-taking, and summarization tools.
Before such a tool processes a confidential discussion, counsel should consider who operates the service, where transcripts and recordings are stored, who can access them, whether inputs may be used for model improvement, what deletion rights exist, and whether the NDA permits disclosure to the provider.
Form NDAs
Counsel should update form NDAs to address AI use expressly. At a minimum, the form should consider permitted AI tools, required confidentiality and security protections, model training or improvement, and return-or-destruction obligations.
One possible starting point, which should be tailored to the transaction and the company’s approved AI environment, is:
Recipient shall not input, upload, share, copy, or otherwise transfer any Information into any artificial intelligence or machine learning (“AI”) tool, platform, or service, including generative AI models, AI agents, meeting transcription tools, AI summarization tools, and chatbots, unless the applicable AI Tool is approved for use with the Information and is subject to confidentiality, data security, retention, and data-use terms that are at least as protective as those required by this Agreement.
Notwithstanding anything to the contrary in this Agreement, Recipient shall not use any Information, in whole or in part, to train, fine-tune, or otherwise develop or improve any AI or machine learning model, whether proprietary or third-party, nor permit any third party to do so, except as expressly authorized in writing by the Disclosing Party.
Recipient’s obligation to return or destroy Information shall include deletion, to the extent technically feasible and within Recipient’s control, of Information input into or stored by any permitted AI Tool, including prompts, outputs, and chat or conversation histories.
Other Ways to Limit AI Use
Disclosing parties may consider adding AI-use language to confidentiality legends or document footers. A legend generally will not expand contractual obligations under an existing NDA, but it can put the recipient on notice of the disclosing party’s expectations and may support an argument about contemplated uses.
What Should Companies Do Now?
Review currently effective NDAs, prioritizing highly sensitive M&A, product-development, supplier, and customer agreements.
Update form NDAs to address permitted AI tools, confidentiality protections, model training, and return or destruction.
Adopt or update an AI acceptable-use policy addressing third-party confidential information.
Confirm approved AI tools are configured and contracted to provide the protections the company expects.
Update confidentiality legends and document footers where appropriate.
Train deal teams, business-development personnel, and others who regularly receive third-party confidential information.
Takeaways
Existing NDAs may already restrict some AI uses even when they never mention AI.
Using AI to analyze information for a permitted purpose and using the information to train a model are different questions.
Return-or-destruction obligations should be evaluated against the technical realities of permitted AI systems.
Contract language, approved-tool configurations, internal policies, legends, and employee training should work together.
Thought-Provoking Questions
Does an Existing NDA Already Prohibit AI Use?
The answer may depend on permitted purpose, permitted recipients, confidentiality obligations, return/destruction requirements, and residuals language rather than whether the contract expressly says “AI.”
Is Using AI to Analyze Confidential Information Different From Using It to Train a Model?
A broad permitted purpose may arguably allow AI-assisted analysis while providing much less support for model training or improvement.
Is an Enterprise AI Tool Really Different From a Public AI Tool?
The relevant question is what the applicable contract, configuration, retention, confidentiality, training, security, and deletion terms actually provide.
Can the Company Comply With Its Return-or-Destruction Obligations After Information Enters an AI System?
Contract drafting should account for the technical reality of the systems the parties are permitted to use.
related reading and resources
About the Firm
Klemchuk is a litigation-led, full-service intellectual property firm serving sophisticated businesses, entrepreneurs, and investors.
This article is provided for informational purposes only and does not constitute legal advice. The appropriate contractual approach depends on the agreement, technology, provider terms, facts, and applicable law.
© 2026 Klemchuk PLLC | Explore Our Services