Businesses are increasingly integrating Artificial Intelligence (AI) tools into all aspects of their operations. But what implications do these developments have when confidential information is shared with other organizations? For example, partners in a joint venture may be bound by terms requiring project details to be maintained confidentially, but what additional considerations arise when one or both partners use AI tools on aspects of the project? While AI offers undeniable benefits, there are heightened risks when proprietary business information intersects new, unknown or developing technology. Parties contemplating sharing such information under a non-disclosure agreement would be well advised to include terms that take the potential use of AI into account.
This article discusses a selection of AI-related issues that businesses should consider when negotiating confidentiality provisions in a non-disclosure agreement or other agreement that addresses confidentiality.
Use of AI tools
Parties should first consider the degree to which reliance on AI will be permitted under the contract. Different AI tools handle uploaded information differently and may or may not use uploaded information for model training. Some services allow users to opt out of such uses, and “enterprise” versions may offer increased security.
With this in mind, at one end of the spectrum, certain businesses may prohibit any use of AI tools with disclosed confidential information. This may be an attractive solution where clear-cut and unambiguous confidentiality provisions are desirable or where the information is so sensitive or valuable that disclosure risks outweigh any benefits of using AI. Alternatively, parties may consider prohibiting the use of AI tools except upon consent on a case-by-case basis. In such situations, the parties may further specify that the disclosing party may withhold consent in its sole discretion.
Parties should also consider requiring due diligence into any proposed AI tool as part of the consent process and including terms and conditions specifying the permitted tools, versions and settings.
If the parties agree to use AI tools in relation to their confidential information, data protection and security standards should still be carefully considered. By way of example, parties should consider including the following requirements and measures for handling confidential information:
- requiring that data is encrypted and isolated from third-party users;
- ensuring that data is subject to suitable privacy measures;
- ensuring that data is not used to train AI models;
- ensuring that all inputs and outputs of an AI tool, including any interim work product, are treated as confidential information;
- ensuring that appropriate retention and deletion protocols are in place;
- restricting access to confidential information to designated personnel; and
- requiring the disclosing party to be notified of any inadvertent disclosure or breach.
In addition to language addressing the issues described above, parties may want to consider further measures to safeguard their confidential information, such as allowing the disclosing party to monitor how AI tools are used in relation to their confidential information. Parties may also want to include indemnification obligations in relation to prohibited disclosures resulting from the receiving party’s use of AI.
Ultimately, there is no default when it comes to the treatment of confidential information in an AI-integrated business environment. When confidential information is at stake, it is therefore critical for parties to ensure that the use of AI tools is thoroughly understood and canvassed during negotiations and reflected in the language of the resulting agreement.
The preceding is intended as a timely update on Canadian intellectual property and technology law. The content is informational only and does not constitute legal or professional advice. To obtain such advice, please communicate with our offices directly.