How Does AI Handle Sensitive or Confidential Information?

Updated August 2026 · 6 min read · Deal Room Intelligence Series

The four questions

Most procurement covers the first and third loosely, the second with a policy page rather than a term, and the fourth not at all — which is unfortunate, because the fourth is where incidents most often occur.

Training: the answer that hides a setting

Ask whether your content is used for training and you will hear “no, not by default.” The operative word is default, and a default is a setting that changes without your signature.

What to require instead:

• A contractual prohibition, not a policy statement.
• Flow-down to the model provider. Most tools in this category are built on a third-party foundation model. The vendor's own promise is worthless if their upstream terms permit it.
• No carve-outs for telemetry, evaluation sets, or human review of outputs. These are frequently excluded from a training prohibition and are precisely where content escapes.

This is not only commercial hygiene. ABA Formal Opinion 512 (29 July 2024) names confidentiality among the duties engaged when lawyers use generative AI.^[1] Feeding client material into a system whose terms permit training is a professional conduct problem before it is a security one.

Subprocessors: more parties than you think

When a document reaches an AI diligence tool, the parties that typically see it are: the vendor, the foundation model provider, a cloud host, an observability or logging platform, possibly an OCR service, and the vendor's own support tooling.

Each is a party your NDA never contemplated. Ask for the named list and for notice before it changes. A vendor who cannot produce one has not mapped their own data flow — which is a more serious finding than any individual name on the list would have been.

Retention: where “we keep it for you” becomes a liability

Deal documents stop being needed the moment a transaction closes or dies. Every day after that is exposure with no offsetting value — still discoverable, still breachable, still subject to whatever the NDA said about return or destruction.

Vendors often frame indefinite retention as a feature. For deal material it is not. Require a stated retention period, a deletion mechanism you can trigger, and a clear answer about backups.

There is a genuine tension here with audit needs, and the resolution is to split the two:

• Delete the documents after close.
• Retain the metadata record — scores, thresholds, versions, overrides, and the quoted source sentences. A fraction of the volume, far less sensitive, and it is what reconstruction actually requires.

Specify that split contractually rather than accepting a single blanket retention setting.

The exposure firms consistently under-manage: their own people

External controls get the attention. The more common incident is internal — and it is a direct consequence of what makes these tools useful.

A system that indexes a whole data room and answers questions across it can quietly become the most effective way for someone inside your firm to read material they were walled off from. Clean-team arrangements are the obvious case, but the same applies to information barriers between engagements.

Three controls:

1. Per-deal-room isolation — a query cannot reach across engagements.
2. Role-based access enforced server-side, not by hiding a button in the interface.
3. Read-level audit logging. Most systems log writes — uploads, edits, deletions — and not reads. That is backwards for deal work, where the sensitive event is someone seeing a document. Without read logs, you cannot demonstrate that a wall held, or that it did not.

Privilege, briefly and honestly

Whether disclosing privileged material to a vendor waives privilege is jurisdiction-specific and not settled uniformly. We are not in a position to advise on it and neither is any vendor — treat a vendor's reassurance on this point as marketing, not as an opinion you can rely on.

What we can say is practical: the narrower the disclosure and the tighter the contractual confidentiality, the better the position. This is a question to resolve with your own counsel before the first deal, not after a dispute.

What the regulatory floor now requires

The governance surface hardened on a documented timeline: the NIST AI Risk Management Framework 1.0 (26 January 2023),^[2] ISO/IEC 42001 (2023), ABA Formal Opinion 512 (29 July 2024),^[1] and the EU AI Act applying from 2 August 2025 with fines under Article 99 reaching €35,000,000 or 7% of total worldwide annual turnover for prohibited practices.^[3]

Whether the AI Act reaches a specific deployment is a classification question for counsel. The direction is not in question — confidentiality handling is now something you may be asked to evidence, not merely to assert.

A procurement checklist

1. Contractual training prohibition, flowing down to subprocessors and the model provider, no telemetry carve-out
2. Named subprocessor list with change notification
3. Stated retention, client-triggered deletion, clear answer on backups
4. Document deletion decoupled from metadata retention
5. Encryption at rest and in transit — ask specifically whether document text is encrypted in the database, not merely on disk
6. Region pinning where NDAs or data-protection obligations require it
7. Per-room isolation, server-side role enforcement, clean-team support
8. Read-level access logging, exportable
9. SOC 2 Type II if available — noting it does not cover items 1, 2 or 3
10. Signed DPA where personal data is in scope
11. Breach notification timelines compatible with your own obligations to clients

Bottom line

AI systems have no inherent confidentiality property. What protects deal documents is a contractual training prohibition that flows down, a subprocessor list you have actually read, a retention period that ends, and access controls enforced server-side with read logging.

Get those and the answer to “how does it handle confidential information?” becomes something you can evidence rather than something you hope. And check the last one especially — the person most likely to see something they should not is already inside your firm.

Review how we handle deal documents →