The AI Learning Hub Journal

Confidentiality and What You Paste

Nothing in the interface marks the boundarya paste is a disclosure to a third party the institution has not assessed and cannot instruct to delete WHAT ACTUALLY LEAVES THE BUILDING text pasted into a tool with no institutional agreementa disclosureit runs to a party you have not assessed· processed under its terms, in its jurisdiction· possibly retained, reviewed by humans, or used to improve a model· subject to another country’s disclosure laws· no contract, no assessment, and no instruction to deletenothing marks this line at the time, so the failure does not feel like a breach when it happens CLIENT AND CUSTOMER DATAcontractual confidentiality and duties ofconfidence, plus data protection whereindividuals are identifiable — GDPR in theEU, UK GDPR with the Data Protection Act2018 in the UK, or the local statutethe institution loses the ability to establishwho else saw the material PRICE-SENSITIVE INFORMATIONengages insider dealing and market abuseregimes, not confidentiality alone — US“material non-public information” and theEU Market Abuse Regulation’s “insideinformation” are not interchangeabledeal codenames, draft announcements andpipeline material stay price-sensitive PERSONAL FINANCIAL DATAof customers or of staff — the exposurehere is a data protection question, not aprocurement one, and the material isoften pasted precisely because it is theawkward part of the taskeach of the three needs a rule applicablewithout judgement in the moment APPROVED-TOOL TIERS — NAME THEM, AND STATE FOR EACH WHICH CLASS OF MATERIAL MAY ENTER a consumer tool, no agreement public information only — and nothing about the firm’s business, its clients or its pipeline an enterprise deployment internal and client material within stated limits, under contracted retention and training restrictions inside your own boundary anything sensitive or regulated, where the material never leaves the institution’s controla prohibition with no permitted alternative produces quiet unapproved use — exception requests are the health signaland somebody has to maintain the list, because AI features keep arriving inside software the institution already licenses THE EXPOSURE IS A MARKET ABUSE OR DATA PROTECTION QUESTION, NOT A PROCUREMENT ONE publish the tiers where people will actually look, and give every prohibition a permitted alternative
Nothing marks the boundary at the time, so the rule has to be applicable without judgement in the moment.

What Actually Leaves the Building

When somebody pastes text into a consumer AI tool, it leaves the institution's control and is processed under a third party's terms — possibly retained, reviewed by humans, or used to improve a model, and subject to another country's disclosure laws. AI for Legal works through what those terms say and how consumer and enterprise tiers differ; the point to carry into a bank is narrower. The disclosure runs to a party the institution has not assessed, has no contract with, and cannot instruct to delete. That matters most where the material is not merely confidential but regulated — client data, price-sensitive information, personal financial data — because the exposure is then a market abuse or data protection question, not a procurement one. Nothing in the interface marks the boundary.

  • Pasting is a disclosure to a third party operating under its own terms and its own jurisdiction
  • Tier and contract terms are covered in AI for Legal; the finance-specific part is which regimes the material engages
  • The institution loses the ability to instruct deletion or to establish who else saw the material
  • Nothing marks the boundary at the time, so the failure does not feel like a breach when it happens

The Three Categories to Get Right

Three kinds of material carry consequences beyond ordinary confidentiality. First, client and customer data, protected by contract, by duties of confidence and — where individuals are identifiable — by data protection law: GDPR in the EU, UK GDPR with the Data Protection Act 2018 in the UK, and comprehensive statutes in a large and growing number of other jurisdictions. Second, price-sensitive non-public information, which engages insider dealing and market abuse regimes, not confidentiality alone; the vocabulary is not interchangeable, since "material non-public information" is US usage while the EU Market Abuse Regulation defines "inside information" on its own terms. Third, personal financial data of customers or staff. Each needs a rule applicable without judgement in the moment.

  • Client data: contractual confidentiality plus data protection — GDPR, UK GDPR with the Data Protection Act 2018, or the local statute
  • US "material non-public information" and MAR "inside information" belong to different regimes — check which one binds you
  • Deal codenames, draft announcements and pipeline material stay price-sensitive even when names are stripped
  • Rules have to be applicable without judgement in the moment, or they will be applied inconsistently

Approved-Tool Tiers

The control that works is a small number of named tiers, each with an explicit statement of what may go into it, published where people will actually look. A common shape: a consumer tool with no institutional agreement, permitted for public information and general drafting with nothing about the firm's business; an enterprise deployment under contract with retention and training restrictions, permitted for internal and client material within stated limits; and an environment inside the institution's own boundary for anything sensitive or regulated. Two details decide whether it works. A prohibition with no permitted alternative produces quiet unapproved use. And somebody has to maintain the list, because AI features arrive inside software you already own.

  • Name the tiers, and state for each exactly which class of material may enter it
  • Consumer tools: public information only, and nothing about the firm's business, clients or pipeline
  • Exception requests are the health signal: if nobody ever asks for one, the tiers are being routed around
  • Maintain the list actively: AI features keep arriving inside software the institution already licenses

Prefer slides, quizzes, and saved progress? Read this lesson in the library — free, no sign-up.