{"course":{"slug":"ai-for-small-business","title":"AI for a Small Business","url":"https://addaly.com/learn/ai-for-small-business","level":"beginner","track":"work"},"lesson":{"slug":"what-you-warrant","title":"What you have already promised your clients","url":"https://addaly.com/learn/ai-for-small-business/what-you-warrant","position":85,"of":88,"minutes":8,"answer":"Your own contracts and professional rules may restrict AI use before any AI law does, and confidentiality clauses written years ago frequently forbid sending client material to a third-party service.","keyIdea":"Your own contracts and professional rules may restrict AI use before any AI law does, and confidentiality clauses written years ago frequently forbid sending client material to a third-party service."},"body":{"format":"markdown","text":"## The obligations that already bind you\n\nPeople watching for AI regulation often miss that they are already constrained by things they signed.\n\n**Client contracts.** Many contain a confidentiality clause forbidding disclosure of client material to third parties without consent. Pasting a client's document into a hosted AI service is a disclosure to a third party. Whether it is a breach depends on the wording, and the wording was written before anyone was thinking about this, which means it is broad rather than carefully carved out.\n\n**Non-disclosure agreements**, which are usually stricter and sometimes name permitted sub-processors explicitly. If a list exists, your AI vendor is not on it.\n\n**Professional bodies.** Accountancy, law, medicine, architecture, surveying, counselling. Several have issued guidance on AI use, and some of it is specific about client data and about work that must be performed personally. Your body's guidance binds you whatever the general law says, and it is usually free to read on their website.\n\n**Sector rules.** Health, financial advice, childcare and education carry data and record-keeping obligations that are stricter than the general regime and often predate it by decades.\n\n## The clause to look for\n\nIn the contracts you have with clients, find the confidentiality section and read it as though a lawyer on the other side were reading it.\n\nThe common shape is: the supplier shall not disclose confidential information to any third party except employees and sub-contractors who need it and are bound by equivalent obligations.\n\nTwo questions follow. Is a hosted AI service a third party: yes. Is it bound by equivalent obligations: that depends on its terms, and on a free consumer tier it almost certainly is not.\n\nThis is the mechanism by which a great deal of ordinary, well-intentioned AI use is technically a breach of contract. Not a dramatic one, and rarely discovered, and it is the sort of thing that surfaces in a dispute about something else entirely.\n\n## What to do about it\n\n**Ask.** For clients whose work you would want AI help on, raise it plainly: *we use AI tools for drafting and summarising, on a business plan that does not train on your data; are you comfortable with that?* Most say yes. Some say no, and knowing which is worth more than guessing.\n\n**Add a line when contracts renew.** A clause permitting the use of processing tools under confidentiality obligations no weaker than your own. Ordinary contract drafting; your solicitor will not blink.\n\n**Keep the strictest clients out of it entirely.** The ones with a signed NDA naming sub-processors, or a sector that forbids it. That is a decision you take once and write down.\n\n## The other direction: what your suppliers are doing with your material\n\nThe same clause you are worried about breaching, your own suppliers may be breaching with your material.\n\nYour bookkeeper, your marketing agency, your virtual assistant, your translator: several of them are using AI tools, and your documents are what they are pasting. Almost none will volunteer this.\n\nAsking is straightforward and reasonable: *do you use AI tools on our material, and on what terms?* You are not looking for a no. You are looking for an answer that shows they have thought about it, and for the chance to say which of your material is off limits.\n\nIf you are in a regulated trade, this is the same due diligence you already do on any sub-contractor, applied to a question that did not exist three years ago.\n\n## Insurance, briefly\n\nProfessional indemnity cover generally responds to negligent advice, and whether you used a tool to help produce it is usually not the question. Where it gets less certain is a claim arising specifically from AI output: an invented figure that reached a client report, a fabricated citation in a submission.\n\nThe practical step is an email to your broker asking two questions: does our cover respond to a claim arising from work produced with AI assistance, and do you require notification of tools we use. Ten minutes, and you will have the answer in writing, which is the point.\n\nSome insurers now ask about AI use at renewal. Answer accurately. An inaccurate answer on a proposal form is a much larger problem than any answer you could give.\n\n## The summary\n\nYour existing promises are more likely to constrain you this year than any AI statute is.\n\nRead your own client contract. Check your professional body's guidance. Send one email to your broker. That is an afternoon, it costs nothing, and it is more practical risk management than most small businesses will do about AI in the next two years."},"check":{"question":"A bookkeeper signed an NDA with a client that permits disclosure only to named sub-contractors. She summarises the client's management accounts using a paid business AI tier that does not train on inputs. What is the position?","options":[{"text":"She is compliant, because the paid tier's terms bind the vendor to confidentiality obligations equivalent to her own, which is what the clause is designed to secure.","correct":false,"tempting":"Describes the standard in a typical confidentiality clause, not the stricter named-list wording this NDA actually uses."},{"text":"She is compliant provided she removes identifying details before pasting, since anonymised figures are no longer the client's confidential information.","correct":false,"tempting":"Minimisation reduces the exposure and is good practice, and management accounts remain identifiable to the client in context."},{"text":"The vendor is not on the named list, so the training terms do not cure the disclosure.","correct":true},{"text":"She is in breach, and the remedy is to notify the client immediately, since an unauthorised disclosure of confidential information triggers a reporting obligation under most NDAs.","correct":false,"tempting":"Correct that there is a problem, then asserts a notification duty that most NDAs do not contain and that would be for her solicitor to assess."}]},"prev":{"slug":"telling-customers","title":"Saying where the machine is, in one sentence","url":"https://addaly.com/learn/ai-for-small-business/telling-customers"},"next":{"slug":"the-vendor-disappears","title":"When the tool goes away","url":"https://addaly.com/learn/ai-for-small-business/the-vendor-disappears"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What you have already promised your clients', in AI for a Small Business. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-for-small-business/what-you-warrant (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What you have already promised your clients","courseTitle":"AI for a Small Business","module":{"index":9,"slug":"cost-risk-and-the-long-run","title":"What it costs, what it risks, and what happens in a year"},"answer":null,"keyIdea":"Your own contracts and professional rules may restrict AI use before any AI law does, and confidentiality clauses written years ago frequently forbid sending client material to a third-party service.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-obligations-that-already-bind-you","runs":[{"text":"The obligations that already bind you"}]},{"t":"p","runs":[{"text":"People watching for AI regulation often miss that they are already constrained by things they signed."}]},{"t":"p","runs":[{"text":"Client contracts.","b":true},{"text":" Many contain a confidentiality clause forbidding disclosure of client material to third parties without consent. Pasting a client’s document into a hosted AI service is a disclosure to a third party. Whether it is a breach depends on the wording, and the wording was written before anyone was thinking about this, which means it is broad rather than carefully carved out."}]},{"t":"p","runs":[{"text":"Non-disclosure agreements","b":true},{"text":", which are usually stricter and sometimes name permitted sub-processors explicitly. If a list exists, your AI vendor is not on it."}]},{"t":"p","runs":[{"text":"Professional bodies.","b":true},{"text":" Accountancy, law, medicine, architecture, surveying, counselling. Several have issued guidance on AI use, and some of it is specific about client data and about work that must be performed personally. Your body’s guidance binds you whatever the general law says, and it is usually free to read on their website."}]},{"t":"p","runs":[{"text":"Sector rules.","b":true},{"text":" Health, financial advice, childcare and education carry data and record-keeping obligations that are stricter than the general regime and often predate it by decades."}]},{"t":"h2","id":"the-clause-to-look-for","runs":[{"text":"The clause to look for"}]},{"t":"p","runs":[{"text":"In the contracts you have with clients, find the confidentiality section and read it as though a lawyer on the other side were reading it."}]},{"t":"p","runs":[{"text":"The common shape is: the supplier shall not disclose confidential information to any third party except employees and sub-contractors who need it and are bound by equivalent obligations."}]},{"t":"p","runs":[{"text":"Two questions follow. Is a hosted AI service a third party: yes. Is it bound by equivalent obligations: that depends on its terms, and on a free consumer tier it almost certainly is not."}]},{"t":"p","runs":[{"text":"This is the mechanism by which a great deal of ordinary, well-intentioned AI use is technically a breach of contract. Not a dramatic one, and rarely discovered, and it is the sort of thing that surfaces in a dispute about something else entirely."}]},{"t":"h2","id":"what-to-do-about-it","runs":[{"text":"What to do about it"}]},{"t":"p","runs":[{"text":"Ask.","b":true},{"text":" For clients whose work you would want AI help on, raise it plainly: "},{"text":"we use AI tools for drafting and summarising, on a business plan that does not train on your data; are you comfortable with that?","i":true},{"text":" Most say yes. Some say no, and knowing which is worth more than guessing."}]},{"t":"p","runs":[{"text":"Add a line when contracts renew.","b":true},{"text":" A clause permitting the use of processing tools under confidentiality obligations no weaker than your own. Ordinary contract drafting; your solicitor will not blink."}]},{"t":"p","runs":[{"text":"Keep the strictest clients out of it entirely.","b":true},{"text":" The ones with a signed NDA naming sub-processors, or a sector that forbids it. That is a decision you take once and write down."}]},{"t":"h2","id":"the-other-direction-what-your-suppliers-are-doing-with-your-","runs":[{"text":"The other direction: what your suppliers are doing with your material"}]},{"t":"p","runs":[{"text":"The same clause you are worried about breaching, your own suppliers may be breaching with your material."}]},{"t":"p","runs":[{"text":"Your bookkeeper, your marketing agency, your virtual assistant, your translator: several of them are using AI tools, and your documents are what they are pasting. Almost none will volunteer this."}]},{"t":"p","runs":[{"text":"Asking is straightforward and reasonable: "},{"text":"do you use AI tools on our material, and on what terms?","i":true},{"text":" You are not looking for a no. You are looking for an answer that shows they have thought about it, and for the chance to say which of your material is off limits."}]},{"t":"p","runs":[{"text":"If you are in a regulated trade, this is the same due diligence you already do on any sub-contractor, applied to a question that did not exist three years ago."}]},{"t":"h2","id":"insurance-briefly","runs":[{"text":"Insurance, briefly"}]},{"t":"p","runs":[{"text":"Professional indemnity cover generally responds to negligent advice, and whether you used a tool to help produce it is usually not the question. Where it gets less certain is a claim arising specifically from AI output: an invented figure that reached a client report, a fabricated citation in a submission."}]},{"t":"p","runs":[{"text":"The practical step is an email to your broker asking two questions: does our cover respond to a claim arising from work produced with AI assistance, and do you require notification of tools we use. Ten minutes, and you will have the answer in writing, which is the point."}]},{"t":"p","runs":[{"text":"Some insurers now ask about AI use at renewal. Answer accurately. An inaccurate answer on a proposal form is a much larger problem than any answer you could give."}]},{"t":"h2","id":"the-summary","runs":[{"text":"The summary"}]},{"t":"p","runs":[{"text":"Your existing promises are more likely to constrain you this year than any AI statute is."}]},{"t":"p","runs":[{"text":"Read your own client contract. Check your professional body’s guidance. Send one email to your broker. That is an afternoon, it costs nothing, and it is more practical risk management than most small businesses will do about AI in the next two years."}]}],"check":{"question":[{"text":"A bookkeeper signed an NDA with a client that permits disclosure only to named sub-contractors. She summarises the client’s management accounts using a paid business AI tier that does not train on inputs. What is the position?"}],"options":[{"text":[{"text":"She is compliant, because the paid tier’s terms bind the vendor to confidentiality obligations equivalent to her own, which is what the clause is designed to secure."}],"correct":false,"tempting":[{"text":"Describes the standard in a typical confidentiality clause, not the stricter named-list wording this NDA actually uses."}]},{"text":[{"text":"She is compliant provided she removes identifying details before pasting, since anonymised figures are no longer the client’s confidential information."}],"correct":false,"tempting":[{"text":"Minimisation reduces the exposure and is good practice, and management accounts remain identifiable to the client in context."}]},{"text":[{"text":"The vendor is not on the named list, so the training terms do not cure the disclosure."}],"correct":true,"tempting":null},{"text":[{"text":"She is in breach, and the remedy is to notify the client immediately, since an unauthorised disclosure of confidential information triggers a reporting obligation under most NDAs."}],"correct":false,"tempting":[{"text":"Correct that there is a problem, then asserts a notification duty that most NDAs do not contain and that would be for her solicitor to assess."}]}],"order":[1,2,3,0],"why":null},"prev":{"slug":"telling-customers","title":"Saying where the machine is, in one sentence","minutes":9},"next":{"slug":"the-vendor-disappears","title":"When the tool goes away","minutes":8}}}