5 confidentiality & data protection risks that businesses face when using public AI tools

Most businesses would never allow a competitor — or a complete stranger — to walk into their office, sit at a spare desk and start reading confidential contracts, pricing models or client files.

Every day, however, well‑meaning employees are doing something surprisingly similar by uploading contracts, internal emails, commercial terms and other sensitive documents into publicly available artificial intelligence (AI) tools like ChatGPT, Claude, Perplexity and Gemini. This is often done without fully appreciating what happens to that information next.

Here Paddy Fearnon, Matt Brown and Eleanore Beard explain why uncontrolled use of public AI tools creates real confidentiality and data protection risks and outline how businesses can apply familiar governance principles to manage them safely.

What do we mean by ‘public AI tools’ & ‘enterprise AI tools’?

Not all AI tools operate in the same way — and this distinction matters.

• Public AI tools are consumer facing platforms that operate outside your organisation’s IT and security environment. Information uploaded into these tools is processed on external systems, subject to the provider’s terms of use and outside your direct control.
• Enterprise AI tools, by contrast, are designed to operate within an organisation’s secure environment, applying existing access controls, confidentiality protections and data handling rules.

Many AI related risks arise when businesses fail to distinguish between the two and treat all AI tools as interchangeable.

Why uncontrolled use of public AI tools creates risk

1. They remove your ability to control where confidential data goes

Public AI tools don’t recognise confidentiality labels, NDAs or contractual restrictions. They treat anything provided by a user as input data.

Many providers make clear that content may be stored, reviewed or used to improve their systems. Once confidential material leaves your environment and is uploaded into a public AI platform, you lose meaningful control over how long it’s retained, where it’s stored or how it may be reused.

For businesses that rely on confidentiality as a competitive advantage, this creates an obvious risk.

If you wouldn’t show a document to a competitor, you shouldn’t upload it into a public AI tool.

2. They can unintentionally undermine patentability & novelty

Confidentiality isn’t just a contractual or data protection issue — it also underpins how businesses protect and monetise their intellectual property (IP), particularly where businesses are developing new products, processes or technical solutions.

For an invention to be patentable, it must be novel. In broad terms, that means it must not have been made available to the public before a patent application is filed. Uploading technical concepts, design details or development discussions into a public AI tool can amount to an uncontrolled disclosure, even where there’s no intention to publish or share that information more widely.

Once information has been shared outside the organisation’s secure environment, it may be difficult to evidence that it remained confidential. This can create a real risk that novelty is lost, potentially preventing patent protection altogether or weakening a business’s position in later patent disputes.

This risk is easy to overlook where AI tools are used informally to sense‑check ideas, refine technical descriptions or brainstorm improvements during early‑stage development. However, those early discussions are often the most sensitive from a patentability standpoint.

3. They expose sensitive information even when AI use is passive

Importantly, these risks aren’t limited to deliberate uploads of documents or typed prompts.

AI is increasingly embedded into day‑to‑day tools and devices in ways that can capture, process or transmit information automatically, sometimes without users giving much thought to where that information is going. 

Examples include:

• Free AI transcription or note‑taking tools used to record or summarise meetings outside approved systems.
• Wearable technology or smart devices using always‑on AI that may capture confidential conversations.

If confidential discussions, legal advice or strategic conversations are processed using public AI services in this way, organisations may inadvertently waive legal professional privilege, breach confidentiality obligations or lose control over commercially sensitive information — even where no one intended to share anything externally.

From a governance perspective, this highlights that AI risk isn’t just about which tools employees actively choose to use but also about understanding where AI is operating in the background, what data it’s exposed to and whether that processing takes place inside or outside the organisation’s controlled environment.

4. They bypass existing governance, training & security safeguards

Most organisations already have policies covering:

• Confidential information
• Acceptable use of systems.
• Information security.

What’s changed is how easy it is for individuals to bypass those controls unintentionally. AI systems such as ChatGPT feel informal, helpful and low‑risk. That lowers the level of caution people would normally apply to emails or file sharing.

As a result, AI risk is less about malicious behaviour and more about:

• Staff awareness.
• Training.
• Clear internal guidance.
• Governance around approved tools and permitted use cases.

5. They create legal & regulatory exposure under confidentiality & data protection laws

Uploading confidential material into public AI tools can have legal consequences.

From a UK perspective, this can cut across:

• Confidentiality obligations owed to clients, partners or counterparties.
• Contractual restrictions on use and disclosure of information.
• UK GDPR obligations, which require organisations to process personal data securely and using appropriate technical and organisational measures.

If sensitive personal data or client information is uploaded into a public AI tool without proper safeguards, it may be difficult to demonstrate compliance with these obligations if challenged by regulators or counterparties.

How confidentiality can be lost 

In practice, businesses have faced situations where employees — seeking help to summarise or ‘sanity check’ documents — uploaded draft commercial agreements into public AI tools.

Those agreements included:

• Pricing structures.
• Negotiation positions.
• Commercially sensitive clauses.

No cyber-attack occurred and no system was breached. However, control over that information was lost the moment it left the organisation’s secure environment.

This type of risk is difficult to detect, almost impossible to reverse and easy to overlook until it becomes a serious problem.

How to decide what’s safe to share with AI tools

A simple sense‑check can help to guide AI use:

• Would you be comfortable emailing this information to a competitor?
• Would you be comfortable publishing it publicly?
• Would you be comfortable losing control over where it's stored or reused?

If the answer is no, it shouldn’t be uploaded into a public AI tool.

Three practical steps to reduce AI confidentiality risk

Most businesses don’t need to ban AI outright. 

Sensible mitigation steps include:

1. Developing a clear AI use policy: set out what types of information must never be uploaded into public AI tools.
2. Training staff on safe AI use: help teams to understand the difference between public and enterprise AI tools and the risks involved.
3. Using approved enterprise AI solutions where appropriate: where AI is used for business purposes, ensure that it operates within your organisation’s security and data protection framework.

These steps mirror existing approaches to data security and confidentiality. AI doesn’t require an entirely new rulebook, just careful application of existing principles.

What this means for your business

AI can be a powerful productivity tool. Used properly, it can save time and support better decision making across a business.

However, treating public AI systems as a safe place for confidential information is the digital equivalent of leaving your filing cabinets unlocked in reception.

The organisations that manage AI risk successfully won’t be those that ban AI altogether but those that apply the same confidentiality and governance standards to AI that they already apply everywhere else.

Talk to us

If your business is using — or considering using — AI tools and you’re unsure whether your current policies, training and controls are fit for purpose, our cybersecurity and data protection team can help.

We advise organisations on AI governance, confidentiality risk and information security, helping you to adopt new technology without undermining existing safeguards.

To discuss how this applies to your organisation, talk to us by giving us a call on 0333 004 4488, sending us an email at hello@brabners.com or completing our contact form below.