Protecting Your Ideas and Services in the Age of AI

Sharing knowledge is part of doing business. You explain a concept to a potential partner, give an engineer access to a design, or deliver results to a client.

But that information may now enter an environment where AI assistants read documents, search repositories, retain conversations and generate implementations.

The risk is not simply that someone shares your information. They may use it to recreate what you do.

Your NDA—and the agreements governing your services—should reflect that difference.

Your client may not need your underlying method

Consider a client who provides information to your service and receives results. Over time, they collect examples of what they submitted and what you returned.

They could use those pairs to ask an AI system to reproduce your service, generate a replacement implementation or learn to imitate its responses. The replacement might be for their own use, not something they sell.

They may never see your source code or internal process. The examples could still help them build an alternative. Research has demonstrated this kind of extraction for certain AI services; it does not mean every service can be reproduced this way. Research on learning from service responses (opens in a new tab)

That makes the permitted use of results important alongside access to your confidential materials.

An NDA may not be enough

The client's inputs may belong to them. Your outputs may not be confidential, and your contract may give the client ownership or broad rights to use them.

You cannot assume that a confidentiality clause automatically prevents replication.

Address this in the service agreement and any output licence as well as the NDA. Make clear what clients can do with the results they purchase, and where separately agreed permission is needed.

For example, distinguish ordinary business use from using outputs, input-output pairs or repeated queries to:

Reconstruct the service's underlying method.
Train an AI system to imitate it.
Generate or test a substitute service, including an internal replacement.

These are restrictions to negotiate, not automatic rights. They must fit the ownership terms and applicable law. Reverse-engineering restrictions are not equally enforceable everywhere. Guidance on contractual protection (opens in a new tab)

Define why information is being shared

For an idea or concept, distinguish understanding it from implementing it.

“Assess the technical feasibility of this concept” gives clearer direction than “explore a business relationship”. A precise permitted purpose is an established part of NDA drafting. Guidance on defining the purpose (opens in a new tab)

Specify whether permission includes human review, technical testing or AI-assisted analysis. Do not leave commercial implementation implied.

Protect derived material where it contains or reveals confidential information: summaries, prompts, generated code and datasets, for example. This should not become a claim over everything the recipient creates.

Agree which systems may receive it

AI use should be an explicit decision.

Ask which tools will process the material, who can access it, where processing happens and what is retained. Include public and enterprise services, private or offline models, coding assistants, agents and connected knowledge bases.

Automatic ingestion matters too. Saving a document in a shared folder may make it available to an assistant without anyone deliberately uploading it.

“Private” and “not used for training” describe safeguards. They do not establish permission.

Approve a defined setup covering the provider, system, materials, users, activities, locations, retention and safeguards. Revisit approval when something material changes.

Plan for the end of the relationship

Deleting the original document may leave copies in logs, caches, conversation histories, search indexes, persistent memory, backups and service-provider systems.

Agree what must be returned or deleted, when, and who confirms completion. Keep lawful retention exceptions narrow, with restricted access and no ordinary reuse.

Do not assume deleting a training dataset reverses what a model learned. Consider whether a proposed use can realistically be undone before approving it.

Also decide which protections continue after the engagement, particularly while information remains confidential.

Keep evidence and practical controls

Keep records of what you shared, with whom, under which terms and with which AI permissions. For services, retain proportionate, lawful usage records and the contract version accepted by the client.

Limit unnecessary disclosure. Consider staged access, sensible query limits and review of unusual extraction patterns. None guarantees prevention.

Require prompt incident reporting and cooperation. If misuse is suspected, preserve evidence before demanding deletion.

Discuss responsibility for careless handling as well as deliberate replication, and whether liability limits would undermine the intended protection. Contractual remedies do not guarantee recovery. Guidance on protecting and enforcing trade secrets (opens in a new tab)

Protect the value without blocking legitimate work

Clients must remain able to use what they buy. Reviewers need room to validate claims. Genuinely independent development should remain possible; a similar service alone does not prove misuse.

Confirm your right to disclose third-party materials and address personal-data obligations separately.

The objective is a clear boundary: permission to evaluate an idea or use a service should specify whether it also permits using the supplied material and results to build a replacement.

AI makes that boundary more important. Make it explicit before access begins.

These are drafting considerations, not universal legal requirements. Have a qualified legal adviser adapt them to your contracts and jurisdiction.

This article was created by people. We have used artificial intelligence (AI) to help articulate our message and refine the text. AI was employed as a tool to assist with structuring, identifying grammatical and spelling errors, and improving readability. The final document has been carefully reviewed and approved by our team.