AI and Confidential Tender Documents

Classify the material first

Tender packs may contain client-restricted material, personal details, unpublished prices, technical methods or commercially sensitive plans. Check the client’s instructions, confidentiality commitments and your organisation’s classification rules before sharing any of it with an AI service.

Separate public opportunity information from restricted attachments. A tool being convenient—or available to an individual user—does not mean it is approved for every document.

Check the environment and its terms

A personal or consumer AI account is not the same as an organisation-approved business or enterprise environment; neither is every paid plan automatically suitable. Check current vendor documentation and terms for retention, training or model use, data location where relevant, access and admin controls, and who can view prompts and outputs. Terms change, so verify the specific tool, account and plan rather than relying on old claims.

‘Not used for training’ alone does not satisfy all confidentiality obligations. Check sharing links, deletion settings, chat history and audit logs; restrict access to those working on the tender and follow agreed retention practices.

Minimise what goes in

Where the task allows it, use only the relevant extract rather than the full tender. Remove unnecessary names, contact details, identifiers or pricing; generalise or anonymise examples when suitable. Then recheck whether the remaining text can still identify a client, person or commercially sensitive matter.

Anonymising data does not create permission to share restricted material. If the client or your organisation forbids the use, do not upload it—even after names are removed.

In practice: To test a drafting structure, a team might use a generic, approved example of a question instead of the client’s actual response, price or confidential specification.

Decide before uploading—and verify afterward

Use a short sequence: check client restrictions and internal policy; classify the material; confirm the specific tool and account are approved; minimise or redact where permitted; set access and retention; only then upload. If any permission or control is uncertain, stop and ask the responsible person or work manually.

Record what was used, where it was processed and who approved the workflow where your organisation requires that record. Check the AI output against the issued sources for leaked details, invented claims and unsupported conclusions before circulation. Security, confidentiality and final interpretation remain with the people accountable for the bid.