Someone Pasted the Other Side's Draft Into an AI Tool. What Does the NDA You Signed Say About That?

Your company signed a nondisclosure agreement with a prospective customer, a partner or a company you might buy. Then the other side sent its draft agreement, a term sheet or a folder of financials, and someone on your team put it into an AI tool to summarize it, compare it with your template, or draft a response. It was a sensible shortcut. It may also have been a disclosure.

This post is about the NDA between two companies and the other side's material. It is not about your own employees and your own secrets, which our posts on employee NDAs and ChatGPT and employee NDAs and AI tools cover. It explains how to read the NDA you signed against what the tool does, what to check before anyone uploads counterparty material, and what AI terms belong in the NDAs you send and sign. It is general information about contract practice, not an assessment of any particular agreement, and it does not say whether any particular upload breached any particular agreement.

Why the question is harder than it looks

An NDA need not mention AI to restrict an upload. It may limit who may receive confidential information, how it may be used and whether it may be copied. A third-party AI tool is operated by a provider that may retain submitted material or use it to improve the service, depending on the applicable terms and settings. Whether an upload fits within the NDA depends on the agreement, the applicable tool terms and what actually happened.

Read the NDA for five things

Pull the signed agreement, not the template you usually send. Then look for:

1. What counts as confidential information. Is it anything the other side marks, anything disclosed in connection with the deal, or a defined list? Does it reach drafts of the agreement itself, or only business information? Many NDAs treat the existence and terms of the negotiation as confidential.
2. The permitted purpose. Information is usually disclosed for a stated purpose, such as evaluating a transaction. Summarizing a draft may serve that purpose, but that does not by itself permit uploading it to a third-party tool. The disclosure restrictions and any other limits on use or copying still need to be checked, along with what the provider may do with the upload.
3. The permitted recipients. An NDA may allow disclosure to "representatives" or "advisors" who need to know and are bound by comparable obligations, and some allow "service providers" on conditions. Whether an AI tool's provider fits any of those words, and whether its terms satisfy the required obligations and any other conditions, is the question at the center of this post.
4. The standard of care and the specific prohibitions. A duty to protect information "with the same care as your own, and no less than reasonable care" is read against what you actually did. Some NDAs also prohibit copying, reverse engineering, or entering information into third-party systems.
5. Notice, return and destruction. Many NDAs require prompt notice of any unauthorized disclosure and the return or destruction of materials on request or at the end of the deal. If the material now sits in a tool, can it be deleted, and can you show that it was?

Our guide to diligence-grade contracts explains why those definitions matter later, when a buyer reads your contracts.

Read the tool's terms for four things

The second half of the question is what happened to the material after the upload. Our post on contract questions to ask before connecting an AI tool covers the full set; for an NDA problem, four matter most:

• Which tier was used. A personal account on a consumer product and a company account on an enterprise plan often carry different terms on retention, training and access. The same product can be two different tools for NDA purposes.
• Whether inputs are used to train or improve models, and whether that can be switched off.
• How long inputs are retained, who at the provider can see them, and whether a deletion request is honored.
• Whether the provider is itself bound by confidentiality toward your company, and on what terms. Our guide to enterprise SaaS contracts and DPAs covers how those commitments are usually documented.

Those answers help assess whether disclosure to the provider satisfies the NDA's recipient restrictions and conditions. A provider's confidentiality commitment does not by itself make the upload permissible.

What was uploaded matters

Do not assume sensitivity or contractual protection from the document type alone:

• The other side's draft agreement. Check whether the NDA covers the draft, its terms or the negotiation itself. A draft can contain sensitive commercial information.
• A term sheet or commercial terms. Check whether these fall within the NDA's definition of confidential information and whether any exclusions apply.
• Financials, customer lists, code or product plans from a data room. Check the NDA and any applicable data-room terms or additional access restrictions. Our posts on technology M&A due diligence and trade secrets versus patents explain why the other side will care how it was handled.

If it already happened

The practical steps are about facts, not conclusions:

1. Establish what was uploaded, to which tool, on which account and tier, by whom and when.
2. Preserve relevant records securely and promptly involve counsel in coordinating containment with any applicable preservation obligations. Check the tool terms and settings that applied when the upload occurred, as well as the controls available now. Use appropriate deletion or opt-out controls as part of that response, and record what was done and what the provider confirms. Do not assume that deleting a chat removes every retained copy or reverses any prior use.
3. Read the NDA's notice clause promptly, including its triggers, deadlines and required method of notice. Assess with counsel whether notice is required and what it must say, without missing any applicable deadline. This post does not resolve those questions.
4. Decide what changes before the next upload.

Our post on whether AI chats are discoverable explains why the record of what was entered can matter if the relationship later turns into a dispute.

Before anyone uploads counterparty material

Three measures can reduce the risk:

• A written policy that says which tools and which tiers may be used with other companies' confidential information, and which may not. Our post on a workplace AI use policy covers how to write one, and our AI legal checklist for startups places it among the other controls.
• A check against the NDA before counterparty material goes into any tool, by someone who has read the permitted-recipient clause.
• A record of which tool, which account and which material, kept where it can be found. Our post on AI-written contracts lists the questions to ask before pasting confidential terms into a tool at all.

AI terms for the NDAs you send and sign

If your company sends NDAs, or signs them often, the cleanest fix is to say what the agreement means. Our post on NDA mistakes that make an agreement hard to enforce covers the drafting basics; these are the AI-specific additions:

• Define it. State whether entering information into a third-party AI tool is a disclosure, whether it is permitted and, if so, on what conditions. Conditions could address approved tools and account types, restrictions on training and other uses, retention and access limits, and provider confidentiality obligations. An "enterprise" label alone does not establish that those conditions are met.
• Consider reciprocity. Where both sides exchange confidential information, consider applying the AI-use restrictions to both sides. A one-way NDA need not become mutual solely to address AI use.
• Tie it to return and destruction. If uploads are permitted, say what deletion means for material held by a tool provider.
• Keep it consistent with the AI terms in your other agreements, so the NDA does not promise one thing and your customer contract another. Our post on AI subprocessors and customer contracts covers the downstream version of the same promise.

Questions to settle

These are questions to take to your agreements, not conclusions about any particular one:

1. Does our signed NDA say who may receive the other side's information, and does an AI tool's provider fit that description?
2. Which tools and tiers does our team actually use with other companies' material, and what do those terms say about retention and training?
3. Does the NDA require notice of an unauthorized disclosure, and who decides whether one happened?
4. Can we delete counterparty material from the tools we use, and show that we did?
5. Do the NDAs we send say anything about AI tools, and should they?
6. Does our internal policy match what our NDAs permit?
7. Who answers the question before the next upload?

What this post does not cover

This post does not say whether any upload breached any NDA; that depends on the agreement's text and the tool's terms. It does not cover personal information and privacy law, which our post on privacy policies for California-facing SaaS touches on, or the employee side, which the two employee-NDA posts cover. It does not cover trade-secret claims or litigation.

How we can help

Accord & Shield Legal drafts and reviews nondisclosure agreements, customer and partner contract terms and AI-use policies for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

---

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. Whether an upload is permitted depends on the agreement you signed and the tool's terms; consult an attorney about your situation.