What you have already promised your clients

The obligations that already bind you

People watching for AI regulation often miss that they are already constrained by things they signed.

Client contracts. Many contain a confidentiality clause forbidding disclosure of client material to third parties without consent. Pasting a client’s document into a hosted AI service is a disclosure to a third party. Whether it is a breach depends on the wording, and the wording was written before anyone was thinking about this, which means it is broad rather than carefully carved out.

Non-disclosure agreements, which are usually stricter and sometimes name permitted sub-processors explicitly. If a list exists, your AI vendor is not on it.

Professional bodies. Accountancy, law, medicine, architecture, surveying, counselling. Several have issued guidance on AI use, and some of it is specific about client data and about work that must be performed personally. Your body’s guidance binds you whatever the general law says, and it is usually free to read on their website.

Sector rules. Health, financial advice, childcare and education carry data and record-keeping obligations that are stricter than the general regime and often predate it by decades.

The clause to look for

In the contracts you have with clients, find the confidentiality section and read it as though a lawyer on the other side were reading it.

The common shape is: the supplier shall not disclose confidential information to any third party except employees and sub-contractors who need it and are bound by equivalent obligations.

Two questions follow. Is a hosted AI service a third party: yes. Is it bound by equivalent obligations: that depends on its terms, and on a free consumer tier it almost certainly is not.

This is the mechanism by which a great deal of ordinary, well-intentioned AI use is technically a breach of contract. Not a dramatic one, and rarely discovered, and it is the sort of thing that surfaces in a dispute about something else entirely.

What to do about it

Ask. For clients whose work you would want AI help on, raise it plainly: we use AI tools for drafting and summarising, on a business plan that does not train on your data; are you comfortable with that? Most say yes. Some say no, and knowing which is worth more than guessing.

Add a line when contracts renew. A clause permitting the use of processing tools under confidentiality obligations no weaker than your own. Ordinary contract drafting; your solicitor will not blink.

Keep the strictest clients out of it entirely. The ones with a signed NDA naming sub-processors, or a sector that forbids it. That is a decision you take once and write down.

The other direction: what your suppliers are doing with your material

The same clause you are worried about breaching, your own suppliers may be breaching with your material.

Your bookkeeper, your marketing agency, your virtual assistant, your translator: several of them are using AI tools, and your documents are what they are pasting. Almost none will volunteer this.

Asking is straightforward and reasonable: do you use AI tools on our material, and on what terms? You are not looking for a no. You are looking for an answer that shows they have thought about it, and for the chance to say which of your material is off limits.

If you are in a regulated trade, this is the same due diligence you already do on any sub-contractor, applied to a question that did not exist three years ago.

Insurance, briefly

Professional indemnity cover generally responds to negligent advice, and whether you used a tool to help produce it is usually not the question. Where it gets less certain is a claim arising specifically from AI output: an invented figure that reached a client report, a fabricated citation in a submission.

The practical step is an email to your broker asking two questions: does our cover respond to a claim arising from work produced with AI assistance, and do you require notification of tools we use. Ten minutes, and you will have the answer in writing, which is the point.

Some insurers now ask about AI use at renewal. Answer accurately. An inaccurate answer on a proposal form is a much larger problem than any answer you could give.

The summary

Your existing promises are more likely to constrain you this year than any AI statute is.

Read your own client contract. Check your professional body’s guidance. Send one email to your broker. That is an afternoon, it costs nothing, and it is more practical risk management than most small businesses will do about AI in the next two years.