Your Client Signed an NDA. Can You Still Use AI on Their Work?

Here is the short answer. Under a standard confidentiality clause, the question is not whether AI is allowed. It is whether pasting the client's material into a particular tool counts as disclosing it to a third party. On the consumer tiers of the major assistants, the provider's own documentation says your inputs may be used to train models and may be seen by human reviewers. That is a disclosure. On the business and API tiers, the same documentation says inputs are not used for training by default. Same prompt, same model, different answer to the NDA question.

There is a common detour worth skipping. Asking the client for permission to "use AI" is a conversation about reputation and quality. The clause you signed is about where the data goes. Those are separate problems, and the second one is settled by reading provider documentation rather than by asking.

This article sorts it out using only the providers' published privacy pages, quoted and linked, so you can check each line yourself.

The distinction that decides it

A confidentiality clause typically restricts disclosing the client's information to third parties and restricts using it for anything other than the engagement. Whether a tool triggers that restriction depends on two facts you can look up.

Does the provider use your inputs to improve its models? If yes, your client's material has become training input for a company that is not party to your contract.

Can a human at the provider read your inputs? Training is the headline risk, but human review is the one that reads most clearly as disclosure, because a person outside the engagement sees the content.

Both facts vary by plan, not by model. This is the part that surprises people. The same underlying model can be train-on-by-default or contractually no-training depending on which tier you are paying for.

What each provider actually says, by tier

Read this table as provider policy on the dates shown, not as legal advice about your specific contract.

Tool and tier	Trained on your inputs?	Human review possible?	Provider's own wording
ChatGPT Free, Go, Plus, Pro	Yes, unless you opt out	Not specified on the cited page	"When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models."[1]
ChatGPT Business, Enterprise, API	No, by default	Limited; abuse review described separately	"By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models."[1]
Claude Free, Pro, Max	Only if you turn it on	Safety-flagged conversations	Training applies if "you choose to allow us to use your chats and coding sessions to improve Claude"[3]
Claude for Work, Anthropic API	No, by default	Not described as routine	"By default, we will not use your inputs or outputs from our commercial products"[4]
Gemini Apps, Keep Activity on	Yes	Yes, explicitly	"Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services"[5]
Gemini Apps, temporary chat	No	Not for model improvement	"Temporary chats are not used to train Google's AI models."[5]

Three things in that table are worth pulling out, because they change what you should actually do.

Consumer ChatGPT and consumer Claude now sit on opposite defaults. OpenAI's help page states that content from the individual plans may be used for training unless you opt out, with the control at Settings, then Data controls.[1] Anthropic's consumer page frames training as something that happens if you choose to allow it.[3] If you assumed both were the same, one of your assumptions was wrong.

Google's wording is the most direct instruction any provider gives. The Gemini Apps Privacy Hub does not say confidential material is risky. It says do not enter it, because human reviewers read a subset of chats.[5] That is not a hedge you can interpret around.

Feedback buttons override your opt-out. OpenAI's page states that even after opting out of training, if you submit feedback on a response, "the entire conversation associated with that feedback may be used to train our models."[1] Anthropic describes the same mechanism, storing the full conversation behind a thumbs-up or thumbs-down for up to five years.[7] A thumbs-up on a response containing client material re-admits that conversation to the pipeline you just opted out of.

Opting out is not the same as deletion

A second gap sits between the two facts above and what most people assume they have bought by flipping a switch.

Anthropic's retention page states that if you have allowed training, data may be retained in de-identified form "for up to 5 years in our model training pipelines," and that turning the setting off later does not reach backwards: "Your data will still be included in model training runs that are already in progress, or in models that have been trained."[7]

Google's retention is similar in shape. Chats that human reviewers have seen "are retained for up to three years" and are not removed when you delete your activity.[5] Turning Keep Activity off reduces retention of new chats to 72 hours.[5]

The practical reading: an opt-out is forward-looking. It protects the next job, not the last one. If client material has already gone through a consumer tier with training enabled, flipping the setting does not undo it, and the honest move is to know that rather than to assume a clean slate.

Three questions before a specific job goes through a specific tool

Run these in order. A no at any step means use a different tool or a different input.

1. Does this material identify the client or contain their confidential substance?

Client name, logo, internal metrics, customer data, unreleased plans, credentials, proprietary code. If yes, continue. If the material is genuinely generic, such as asking how a protocol works in the abstract, the clause is probably not engaged and the rest of this does not apply.

2. Does the tier I am on train on inputs or allow human review?

Check the table, then check the live page, because these documents are revised. If yes to either, stop. Either move to a business or API tier, or remove what makes the material confidential.

3. Does my contract restrict subprocessors or require disclosure of tools?

Some agreements require written approval before client data goes to any new third-party processor, regardless of that processor's training policy. A no-training tier satisfies question two and still fails question three. Read the clause, because this question is about your paperwork rather than the vendor's, and no tool comparison can answer it for you.

Two routes when the answer is no

The two options are not "pay more" and "give up."

Route one: change the tool. Business and API tiers are documented as no-training by default. OpenAI states it can execute a Data Processing Addendum for ChatGPT Business, Enterprise, and the API,[2] which is what a client's procurement or legal contact will usually ask for. ChatGPT Business is priced per user per month with plans "available starting at 2 users,"[6] so a solo freelancer operating as a business can buy it. API usage is documented as retained up to 30 days for abuse monitoring, then removed.[2] That retention window is not zero, and a strict clause may still require naming the provider.

Route two: change the input. This is the underused one, and it is free.

Most prompts do not need the confidential part. If you are debugging a client's failing integration, the model needs the error, the schema shape, and the sequence of calls. It does not need the company name, the production endpoint, the real customer records, or the API key. Replace identifiers with placeholders, swap real data for structurally identical fake data, and you have a prompt that answers question one with a no. The clause is no longer engaged, and you can use whatever tier you already pay for.

Do this consistently and it becomes a habit rather than a judgment call made while tired.

A worked example

The following is a hypothetical scenario written to show the three questions running. It is not a real client or a real engagement.

A freelancer is hired by a dental clinic to fix a broken appointment-reminder automation. The client signed a mutual NDA that restricts disclosure to third parties and says nothing about AI. The freelancer wants to paste the failing workflow export and a sample of the reminder log into an assistant to find the bug. They pay for a consumer Plus plan.

Question one. The workflow export contains the clinic's name, its scheduling platform account ID, and a webhook URL. The log sample contains patient first names and appointment times. Yes, this is confidential, and the patient data raises obligations beyond the NDA.

Question two. Consumer tier, training on by default unless opted out, and the opt-out does not change retention of anything already sent.[1][7] Stop here.

Question three. Not reached, but worth noting that a clinic handling patient data is likely to have subprocessor language that a general assistant would fail regardless of tier.

What they do instead. They take route two. They replace the clinic name with Clinic A, the account ID and webhook with placeholders, and the patient log with six fabricated rows that have the same field structure, the same timestamp format, and the same malformed entry that appears to cause the failure. The prompt is now about a timestamp parsing bug in a generic automation. The model has everything it needs. Question one is a no.

The fix they ship is identical. What never left their machine is the part the clause was about.

What this does not settle

It is not legal advice, and your clause is the authority. Some contracts prohibit AI assistance outright, some require disclosure, some are silent. Silence is not permission to disclose to third parties, and it is not a prohibition either. Read the words you signed.

Provider documentation changes. Every policy quoted here was read on October 14, 2026, and the pages carry their own update dates: OpenAI's model-training help page, Anthropic's consumer page dated March 16, 2026, its commercial page dated August 18, 2026, and Google's privacy hub dated October 13, 2026. Before relying on any row of that table for a real engagement, open the link and confirm the wording still says what it says above.

No-training is not no-risk. A business tier is a contractual commitment about model training, not a guarantee against breaches, legal process, or subprocessor exposure. It changes the probability and the paperwork, not the physics.

Regulated data is a separate regime. Health records, payment data, and personal data under GDPR or similar laws carry obligations that exist independently of your NDA and are not resolved by picking a better tier.

This covers inputs, not outputs. Whether AI-assisted deliverables raise ownership, warranty, or disclosure questions in your contract is a different analysis.

---

The useful reframe: the NDA question is a plumbing question, not an ethics question. You are asking where the bytes go and who can read them, and both answers are published. Once you know the answer for the tier you use, the decision takes ten seconds instead of a vague unease you resolve by guessing.

If you want the same treatment applied to platform rules rather than contracts, Is your Upwork tool allowed? runs a four-question test against Upwork's published automation policy.

Sources

1. How your data is used to improve model performance — OpenAI Help Center
2. Enterprise privacy at OpenAI — OpenAI, updated January 8, 2026
3. Is my data used for model training? (consumer products) — Anthropic Privacy Center, March 16, 2026
4. Is my data used for model training? (commercial products) — Anthropic Privacy Center, August 18, 2026
5. Gemini Apps Privacy Hub — Google, updated October 13, 2026
6. ChatGPT Plans and Pricing — OpenAI
7. How long do you store my data? — Anthropic Privacy Center, July 1, 2026

This article summarizes published provider policies as of October 14, 2026. It is independent educational content, not legal advice, and is not affiliated with or endorsed by OpenAI, Anthropic, or Google. Verify current terms and consult a lawyer about your specific agreement.