Aipedia: Translators and interpreters

Client confidentiality and AI translation tools

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Pasting confidential, medical or privileged client text into a public machine translation or AI tool may disclose it to a third party, breaching contracts, NDAs or data protection law. CIOL warns linguists to know where their data goes.

Part of: AI in Translators and interpreters

In short

Client texts often contain personal, medical, privileged or commercially sensitive information. Public MT and LLM tools may store, review or reuse what you enter, depending on their terms. A translator working for a law firm, NHS body or business is usually a data processor under UK GDPR and needs Article 28 terms, which limit what can be done with the data. CIOL warns users to know what data they give AI tools and where it goes. A breach can lead to contract claims, complaints and regulatory attention. PI may cover breach of confidence claims, and cyber cover may handle breach response costs, depending on the wordings.

Why this is the most common AI risk for linguists

Pasting a paragraph into a free online translator or a generative AI chatbot takes seconds and feels harmless. But the text may be stored, reviewed or used to improve the service, depending on the tool's terms and settings. For a translator, almost every document is someone else's confidential information: a contract, a medical report, a witness statement, a product launch, a personal letter.

CIOL's AI Voices white paper says users should know what data they give AI tools and where it goes. NRPSI's 2026 article calls for data protection safeguards in public service settings.

The difficulty is that many linguists do not know the terms of the tools they use day to day. Free and paid versions of the same service may treat data differently, settings can change after an update, and AI features may be built into software that was not previously connected to an external provider. Checking once is not enough.

The duties that apply

Several overlapping duties apply to client texts:

Contract and NDAs: most client and agency terms restrict disclosure and some ban specific tools.
UK GDPR: when you translate personal data for a client, you are usually a processor and need Article 28 terms; you may act only on the client's documented instructions and must keep the data secure.
Privilege: legal material may be privileged, and disclosure can cause problems for the law firm and its client.
Professional codes: CIOL, ITI and NRPSI codes of conduct include confidentiality, though no AI-specific clause was verified.
Buyer rules: Ministry of Justice guidance stresses confidentiality in court and tribunal interpreting.

The ICO's guidance on AI and data protection applies to tools that process personal data.

What can go wrong

Illustrative scenario: a translator working for an agency on an employment tribunal bundle pastes several witness statements into a public generative AI chatbot to speed up a difficult section. The agency's contract with the law firm prohibits public AI tools. The law firm finds out when the translator mentions it in a query, treats it as a data breach, and has to assess whether to notify its client and the ICO. It looks to the agency, and the agency to the translator, for its costs.

Other ways confidentiality goes wrong with AI tools include:

browser extensions or built-in tools sending text to a provider without the user realising;
recordings of interpreted sessions processed by an unvetted transcription service;
health data from patient documents entered into consumer apps;
a subcontractor using a tool the main contractor promised not to use.

What PI covers for confidentiality breaches

Many translators' PI policies include claims for breach of confidence or breach of privacy arising from professional work, subject to the wording. Costs of responding to a data breach, such as forensic investigation, notifying people and handling regulator contact, are more usually covered by a cyber policy. Regulatory fines are often not insurable. Where the claim rests on breach of a specific contract term rather than negligence, cover may be narrower. Our articles on cyber insurance and AI risks and cyber exclusions in PI wordings explain the overlap.

Practical controls

A short set of rules covers most of the risk:

Do not paste client text into public tools unless the client has agreed in writing.
Use tools whose terms you have read on storage, retention and training, with settings checked.
Keep a simple record of which tools you use for which clients.
Make sure subcontractors follow the same rules.
Report any accidental disclosure to the client promptly and notify insurers under the policy conditions.

How Apex helps

Apex arranges PI and cyber cover for translators and language agencies. A broker checks how the two policies fit together for AI-related confidentiality claims. Return to the AI in translation and interpreting hub.

Sources

Frequently asked

Is it a data breach to paste client text into a public AI tool?

It may be. If the text contains personal data and you disclose it to a third party outside your client's instructions, that can be a personal data breach under UK GDPR. Whether it must be reported depends on the risk to the people concerned.

Do I need my client's permission to use machine translation?

No general rule requires it, but your contract, NDA or data processing terms may. Where you process personal data as a processor, you act on the client's instructions, so using a new tool that sees the data should be agreed.

Will PI or cyber insurance pay for a confidentiality breach?

Possibly both, for different parts. PI often covers a client's claim for breach of confidence; cyber cover often pays breach response costs. Fines are often not insurable. Check both wordings, and notify promptly.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.