Your Copilot Licence Doesn't Cover Your Client's NDA

The short answer

Enterprise AI terms, such as ChatGPT Enterprise, Microsoft Copilot and Claude for Enterprise, are agreements between your firm and the AI provider. Your NDA is an agreement between your firm and your clients. There is never one contract in this story, there are two at the least. The provider's promise to you, where you hold a BAA and zero data retention is switched on, is that they will not train on your data. That is the right answer for publicly available data, or for your own data and your own secrets, and in that case you are relying on a trust-based architecture. But it says nothing about the permission a client would have to give before their confidential data is sent to that provider, and it gives no assurance whatsoever that confidentiality and privacy law are being followed. Only two things close the gap: the client's authorization to use a specific tool on pre-specified data, or an architecture where the model never receives the confidential values at all. The second is an architecture-based way to remove the risk of a leak, by not handing over the data, as opposed to a trust-based approach that hopes for the best without preparing for the worst.

A note on words, because they get used interchangeably and should not be. The provider is the company supplying the models, such as OpenAI, Anthropic or Mistral AI. The vendor is the software company or SaaS that acts as the middle-man.

What enterprise AI terms actually promise

Enterprise AI agreements are real security upgrades, the kind that are genuinely necessary to satisfy an NDA and the confidential-data protections and laws around it, but they are typically insufficient on their own. What follows is true for enterprise AI with a signed BAA, proper memory and retention management (zero data retention), minimal abuse monitoring, and in some cases a compliance-grade API. It is not true for individual plans or free AI, which offer none of it. With that caveat, here is what a genuine enterprise agreement delivers:

• No-training commitments. Your prompts and files are not used to train the provider's models.
• Retention and residency controls. Shorter or zero retention windows, and limited abuse monitoring, often 30 days and in some configurations including human review.
• Regional processing options. In some cases, Copilot among them, you can opt for regional processing. Regional capacity varies a great deal by country and by provider. It is relatively available in the US, with real limitations such as latency and the unavailability of data-zone standard capacity at peak, and it can be far more limited elsewhere.
• Admin and audit tooling. SSO, usage visibility, workspace controls. Regulated work, pharma and healthcare included, typically requires audit records retained for a period you can defend. Six years is the figure usually quoted, which is the HIPAA documentation-retention default (45 CFR 164.316(b)(2)(i)) rather than a universal audit-log rule. Standard enterprise-AI tooling does not provide that by default, so you have to add the retention and audit layer yourself, and most likely build the infrastructure that makes it defensible.
• Processor paperwork. DPAs are available in some cases, Copilot among them, while with other providers a large API commitment is required first. A DPA, and in healthcare contexts a BAA, is what makes the vendor or provider a lawful processor of the data you send it.

Every item on that list governs the same relationship: you and the provider. That is exactly why it cannot answer the confidentiality question, which lives in a different relationship entirely.

Two contracts, two questions

Put plainly: a promise made to you by the AI provider or vendor cannot substitute for a permission that only your client can give. A standard NDA forbids disclosure of confidential information to third parties without consent. An AI provider is certainly a third party. An enterprise agreement makes that third party better-behaved and contractually constrained to some degree, but the data was still disclosed to it, and the client never agreed to that.

Note as well that enterprise terms do not mean every law is being respected. That is most obviously the case with confidential data, private data, PII and PHI, where an enterprise licence does not come close to covering the full spectrum of what is needed. It is necessary, not sufficient. To be fully lawful, depending on the region, you would need to understand retention and abuse monitoring in detail, know the residency of the model and the risk of a silent fall back to a global standard zone, prepare risk assessments, prepare privacy impact assessments, and retain deep audit records for six years.

Why this matters more for consultants than for anyone else

For a company using AI on its own data, well-orchestrated and carefully managed enterprise terms settle the question in most cases, because the data owner and the AI customer are the same party. That is still a trust-based model, but both the trust and the contract sit between two knowledgeable parties who understand the risks and the limits. Consultants, HEOR teams, regulatory writers and biostatisticians are in the opposite position: nearly everything valuable they touch is someone else's confidential information, and their secrets, held under an NDA or engagement terms, and sometimes with a law to break if it is mismanaged. The firm's AI licence was negotiated by the firm, for the firm. The client was never at that table.

This is also why "our IT department approved Copilot" does not end the analysis. IT approval establishes that the tool meets your firm's security bar. The NDA question is asking about the transmission of the data and the risk that comes with it, so it has to be managed client by client and engagement by engagement.

When enterprise AI is enough

• Nothing confidential goes in. Public information, general knowledge, fully synthetic examples, or fully redacted documents with no trace of the client's information or secrets and with PII and PHI removed. No client permission needed. Even so, we strongly recommend a transparent posture and a plain disclosure, which we think is the least a client could expect.
• The client authorized it. Some clients will approve a named enterprise deployment, sometimes with conditions (region, retention, scope). Get it in writing and keep it with the engagement records. And even when it is authorized, if the data is not cloaked you should go as far as you can to protect it. A leak does not only breach laws and contractual agreements, it tarnishes your reputation and the client relationships your career is built on.
• The engagement terms already permit it. Modern MSAs sometimes allow processing in approved third-party systems meeting defined safeguards. If yours does, document that the AI deployment meets them, and keep audit records deep enough to satisfy HIPAA and the applicable privacy laws.

Outside those cases there are only two honest resolutions. Ask the client, and here is how to put it, which many firms avoid because the answer may be no, or slow, or conditional. Or change the architecture so the question disappears. An architecture-based protection is significantly stronger, and it answers the "all means necessary" standard for protecting confidential and private data, health data included. Cloak every confidential value, every secret and all private data on your own computer before the text is transmitted, so the model never receives the client's information at all. Then disclose your use of AI, under an architecture that does not turn on trust but on the removal of anything sensitive before it leaves the building.

If you work in pharma or another regulated industry and you are weighing whether to let AI run on your data with no protection for the secrets in it, consider asking for cloaks on that data instead. In a controlled benchmark, semantic cloaking retained 94 to 98% of baseline AI writing quality while the real values were never transmitted (Tremblay & Harricharan, 2026, and the method-by-method comparison is its own guide). A few points of quality is a small price for protecting your data and your secrets, and for keeping everyone legally compliant. This is the way.

In sum

"Enterprise AI terms protect the firm from the provider. They do not authorize the firm to disclose client-confidential information to that provider. That authorization can only come from the client, or be made unnecessary by never transmitting the confidential values."