AI NDA Writing Guide 2026: Confidential Scope, Exceptions, and Liability That Holds Up in Court

An NDA is not a "both parties agree to keep things confidential" form — it's a legal weapon that, when a leak happens, decides who you can sue, for what, and how much you can claim. Most NDAs fail not because they're too loose but because the confidential scope is too broad: "all business information" and "all technical data" are hard to prove in court. The biggest AI mistake is asking for a "standard NDA template" — standard templates don't cover your specific confidentiality scenario. Fill in your actual information types, timeframes, and exceptions.

1. The Five-Element NDA Structure

An enforceable NDA has five elements: Confidential Information Definition (what counts — specific types and carriers), Confidentiality Obligations (what the recipient cannot do — no copying / no sharing / no off-purpose use), Exception Clauses (what doesn't count — already public / independently developed / legally compelled), Confidentiality Period (how long — information type determines duration), Breach Liability (what happens on leak — actual damages / liquidated damages / injunctive relief). Missing any element is a dealbreaker — no exceptions clause means unlimited scope; no liability clause means no teeth.

"I'm writing an NDA for [collaboration scenario]. Here's the information types to protect and the collaboration background: [paste]. Structure into five elements: 1. Confidential information definition (types: technical/commercial/financial/customer/source code/data; carriers: documents/code/database/verbal) 2. Obligations (no copying / no third-party sharing / no off-purpose use / reasonable protective measures) 3. Exceptions (already public / independently developed / third-party lawful source / legally compelled disclosure) 4. Period (collaboration term + X years post; different types = different periods) 5. Liability (injunctive relief / actual damages / liquidated damages amount / attorney fees). Terms must be specific and provable."

2. Confidential Information: Never Write "All Business Information"

The most fatal mistake is writing "all business information and technical data" — such broad phrasing faces proof difficulty in court: you must prove the defendant knew a particular piece was confidential. Correct definition is categorized listing with carrier forms: Technical (source code / algorithms / architecture docs / API docs; carriers: Git repo / Confluence / UML), Commercial (pricing / client lists / contract terms; carriers: Excel / PPT / email), Financial (cost structure / margins / funding plans; carriers: finance system / PDF reports).

"Here's the confidential information description: [paste]. Categorize: 1. Technical (source code / algorithms / architecture / API / test data, each with carrier form and labeling method like [Confidential] tag) 2. Commercial (client list / pricing / contracts / market plans, with carriers) 3. Financial (costs / profits / budget / funding, with carriers) 4. Other (personnel / strategy / unreleased products, with carriers). Each: how to identify as confidential + whether [Confidential] label is required."

3. Exception Clauses: No Exceptions = Unfair = Potentially Invalid

Exceptions are the NDA's balance — an NDA without exceptions may be ruled too broad and invalid in court. Four standard exceptions: Already Public (entered public domain before recipient learned), Independent Development (recipient developed same thing without using discloser's info), Third-Party Lawful Source (obtained lawfully from a third party with no confidentiality obligation), Legally Compelled Disclosure (court/government requires disclosure, but recipient must notify discloser). Each exception: burden of proof on the recipient.

"Here's the exception clause draft (if none, write 'none'): [paste]. Complete four exceptions: 1. Already public (define: when does it count as 'public'/proof: public channel and date) 2. Independent development (define: no use of confidential info/proof: development records/timeline/personnel) 3. Third-party lawful source (define: third party has no confidentiality obligation/proof: source and acquisition method) 4. Legally compelled (define: required by law/condition: prior notice to discloser + only minimum scope required by law). Each: who bears burden of proof."

4. Confidentiality Period: Different Types, Different Durations

One-size-fits-all periods are wrong — trade secrets may need permanent protection, but client lists might expire in 2 years (high churn). Correct approach: by information type: general commercial info 2-3 years, technical info 3-5 years, core algorithms/source code 5-10 years or term+5, trade secrets (formulas/processes) permanent.

"Here's the confidentiality period clause: [paste]. Set by type: 1. General commercial (pricing/plans/client lists: 2-3 years) 2. Technical (architecture/API/test data: 3-5 years) 3. Core algorithms/source code (5-10 years or term+5) 4. Trade secrets (formulas/processes/core data: permanent) 5. Post-collaboration return/destruction (within X days: return or destroy + written confirmation). Generate period table: Type | Period | Post-expiry treatment."

5. Common Mistakes Checklist

• Scope says "all business information": Hard to prove in court. Fix: categorize + carrier forms
• No exception clause: Scope too broad, may be invalid. Fix: four standard exceptions + burden of proof
• One-size period: All info = 5 years. Fix: by type
• Liability says "compensate losses": Actual damages hard to prove. Fix: add liquidated damages + injunctive relief
• No return/destruction clause: Info stays with recipient after collaboration. Fix: X days to return/destroy + written confirmation
• No governing law: Cross-jurisdiction disputes. Fix: specify applicable law and jurisdiction

6. Worked Example

Scenario: Company A discloses SaaS source code and client list to Company B for integration evaluation.
Confidential info: ①Technical: source code (Git, [Confidential] tag), architecture docs (Confluence, [Confidential]), API docs (PDF, watermark [Confidential]) ②Commercial: client list (Excel, contacts + contract value), pricing strategy (PPT) ③Financial: cost structure (finance system screenshot).
Exceptions: ①Already public (product features published on website/press release before B learned) ②Independent development (B has development records proving no use of A's info) ③Third-party lawful (obtained from A's supplier who has no confidentiality obligation) ④Legal compulsion (court requires, but B must notify A 7 days in advance).
Period: Source code + architecture: 5 years. Client list: 3 years. Pricing: 2 years. Core algorithm: permanent. Within 30 days post-collaboration: return or destroy all confidential info with written confirmation.
Liability: Injunctive relief (A may seek injunction to prevent further disclosure) + actual damages + liquidated damages $75K + attorney fees borne by breaching party.

FAQ

Q1: Does an NDA need both parties to sign to be valid?

A one-way NDA (only recipient signs) is valid, but mutual NDAs (both sign) are more common — both parties may disclose confidential info in collaboration. One-way suits consulting/evaluation (only one side discloses), mutual suits joint development/deep collaboration.

Q2: How to protect orally disclosed confidential info?

Include: oral confidential info must be confirmed in writing (email/meeting minutes) within 30 days and labeled [Confidential]; unconfirmed oral disclosures are not treated as confidential. This protects oral disclosure while avoiding the proof difficulty of "they said something, is it confidential?"

Q3: How to set a reasonable liquidated damages amount?

Not too high (court may reduce) nor too low (no deterrence). Principle: cover estimated actual damages, or set a mutually acceptable amount ($50K-$150K range). Retain actual damages right — if actual exceeds liquidated, claim actual. The combination of liquidated damages + injunctive relief + attorney fees is the most binding.

Author: UseAIWriter Editorial Team | Updated: 2026-10-20 | Written by UseAIWriter Editorial Team. Please cite the source when reposting.