Short answer
Shadow AI means employees using AI tools that the firm has not approved. When shadow AI client drawings end up in a public AI tool, the firm may have shared confidential project information without realizing it. Many client contracts include confidentiality terms, so the first step is to read what yours say. Whether a policy responds to this kind of event depends on the policy wording and the facts, so review it before assuming anything.
What is shadow AI, and how common is it?
Verizon’s 2026 Data Breach Investigations Report found that frequent employee use of AI tools rose from 15 percent to 45 percent in one year. The same report shows unapproved shadow AI is now the third most common non-malicious data leakage activity, according to Verizon’s release.
Non-malicious means nobody intended harm. An employee who pastes a drawing into a chatbot to summarize notes is usually trying to save time. The risk comes from where the file goes and who can access it.
Why shadow AI client drawings raise confidentiality questions
Architects and engineers handle drawings, specifications and site data that clients consider confidential. Many project agreements limit how that information can be shared and with whom.
When an employee uploads a drawing to an AI tool, the file leaves your systems. What happens next depends on the tool’s terms, its settings and whether the account is personal or managed by the firm. Some tools store inputs, and some offer controls that limit use of the data. Check the terms of each tool before you decide it is safe.
A contract may or may not treat an AI upload as a disclosure to a third party. Read the confidentiality language closely, and ask the client if the wording is unclear.
Which client contract terms should firms read?
Look for language on confidentiality, data security, use of third-party tools and return or destruction of project information. Some owners and government clients now add language on AI use, so check newer agreements in particular.
Also check whether the contract requires you to notify the client after an unauthorized disclosure. A notification duty can start a clock, and it is better to know about it before an incident happens.
If a contract is silent on AI, that does not settle the question. Ask whether the clause on confidential information is broad enough to include uploads to external tools.
Example: an engineer pastes a drawing into a chatbot
A junior engineer at a hypothetical civil engineering firm uploads a client’s site plan to a free AI tool to draft a summary. The firm never approved the tool. The client’s contract requires the firm to keep project information confidential.
Later, the project manager notices the upload in a chat history. The firm now has to figure out what the tool’s terms allow, what the contract requires and whether the client needs to know. The firm also needs to check its policies, including any cyber coverage, to see how they treat the situation. The answer depends on the wording of each document.
What to check before staff upload files to AI tools
- Does the firm have a written policy on which AI tools are approved?
- Do staff know not to upload client drawings or project data to unapproved tools?
- What do your client contracts say about confidentiality and third-party tools?
- Are the approved tools set up with business accounts and appropriate data settings?
- What does your cyber policy say about data you are responsible for, and what does it exclude?
Our Cyber Liability page describes the main coverage areas. When you apply for coverage, the cyber application shows the controls carriers ask about.
Related questions
Is it a data breach if an employee uploads a drawing to an AI tool?
It depends on the facts, the tool and the contract or legal definitions that apply. Some firms treat an unauthorized upload as an incident worth documenting and reviewing.
Can a firm ban AI tools entirely?
Some do. Others approve specific tools with business settings and limit what staff can upload. Either way, a written policy helps staff know what to do.
Does cyber insurance cover confidentiality breaches caused by AI tools?
That depends on the policy wording, exclusions and the circumstances of the event. Review the policy language, and ask your broker how it applies.