--- id: CP-516 slug: ai-machine-translation-confidential-contracts lang: en title: AI machine translation and confidential contracts description: Pasting a contract into an online AI translator exposes its content. What CNIL, OWASP and NIST say, and what employees do. canonical_url: https://startbrain.io/cyberpedia/en/articles/ai-machine-translation-confidential-contracts/ markdown_url: https://startbrain.io/cyberpedia/en/articles/ai-machine-translation-confidential-contracts.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "AI machine translation and confidential contracts", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ai-machine-translation-confidential-contracts/ (CC BY 4.0) wing: 4 theme: protect_data reflex: air-025 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/ai-machine-translation-confidential-contracts/ fr: https://startbrain.io/cyberpedia/fr/articles/traduction-automatique-ia-contrats-confidentiels/ de: https://startbrain.io/cyberpedia/de/articles/maschinelle-ubersetzung-ki-vertrauliche-vertrage/ es: https://startbrain.io/cyberpedia/es/articles/traduccion-automatica-ia-contratos-confidenciales/ sources: - "n": 1 title: LLM02:2025 Sensitive Information Disclosure publisher: OWASP url: https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/ accessed: "2026-11-03" - "n": 2 title: "IA et RGPD : la CNIL publie ses nouvelles recommandations pour accompagner une innovation responsable" publisher: CNIL url: https://www.cnil.fr/fr/ia-et-rgpd-la-cnil-publie-ses-nouvelles-recommandations-pour-accompagner-une-innovation-responsable published: "2025-02-07" accessed: "2026-11-03" - "n": 3 title: "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" publisher: NIST url: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf accessed: "2026-11-03" - "n": 4 title: Le règlement général sur la protection des données - RGPD publisher: CNIL url: https://www.cnil.fr/fr/reglement-europeen-protection-donnees accessed: "2026-11-03" --- # AI machine translation and confidential contracts Translating a contract in a few seconds with an online AI tool is tempting, especially when the document arrives in a language you do not read well. The action is simple: copy the text, paste it into a web page, get the translated version back. What happens next to the text that was sent is beyond the employee's control. The sources consulted for this article do not deal with translation tools in particular. They describe the risks of applications built on large language models (LLMs) [1][3], which includes an AI translator when it relies on such a model. The article applies these findings to a common case: a confidential document pasted into an online service. ## In 30 seconds - Where it happens: in an online AI translator, a free version or a browser extension, when an employee pastes in a contract, an offer or a customer email. - What the attacker wants: there is not necessarily an attacker. The risk comes from a confidential text leaving the company and possibly reappearing later in the model's answers [1]. - The reflex: use only the translation tool approved by the company, and never paste sensitive clauses, names or figures into a free service. - If it is already done: tell the security officer or the data protection officer without delay, stating the service used and the text sent. ## Straight answers ### Why should a contract not be pasted into a free translator? OWASP counts personal data, financial data, confidential business data, security credentials and legal documents as sensitive information [1]. A confidential contract often combines several of these categories. OWASP warns that users must understand the risk of unintentionally providing sensitive data, which may later appear in the model's answers [1]. ### What happens to the text once it is sent? The sources cited here do not describe how a specific service works. OWASP states that LLM-based applications must sanitize data to prevent user data from entering the training model, and that they must offer clear terms of use allowing users to opt out of this reuse [1]. In other words, the reuse of entered text is a risk that providers must address [1]. What a given free service does can be read in its terms of use, not in this article. ### Can a model really give back data it has received? NIST describes a phenomenon called data memorization: in attacks, LLMs have revealed sensitive information present in their training data [3]. NIST notes that the privacy risk can be heightened even for data present in a small number of training examples [3]. CNIL writes for its part that some models, such as LLMs, may contain personal data [2]. ### Does the GDPR apply to a translation? If the text contains personal data (names, contact details of signatories), the GDPR comes into play. CNIL specifies that, where it applies, people's data must be protected in training databases, in models that may have memorized them, and in the use of models through prompts [2]. The text of the regulation includes an article on the processor, one on the security of processing and a chapter on transfers of data to third countries [4]. ### Can the translation be wrong? Yes. NIST defines confabulation as the production of false or erroneous content, stated with confidence, that can mislead the user [3]. In a contract, a clause rendered incorrectly is not visible when reading a fluent text. ## How it works An online AI translation tool receives the text the user pastes into its window. A language model processes it, and the text leaves the employee's computer as soon as it is sent. The point to check is what happens to the text after translation. OWASP asks providers to maintain clear policies on data retention, use and deletion, and to let users opt out of having their data used for training [1]. OWASP adds that restrictions placed in a model's internal instructions are not always followed and can be bypassed through prompt injection or other methods [1]. A provider's promise therefore does not replace a company contract. CNIL points out that the rights of access, rectification, objection and erasure exist, but that they can be hard to exercise with regard to an AI model, whether it is a matter of identifying the people in the model or of modifying it [2]. ## What you do Before translating, the employee checks whether the company provides an approved tool. If so, the employee uses it, and only it, for any work document. Without an approved tool, a confidential document is not pasted into a free service. The employee asks the security officer or the legal counsel for advice, or has the document translated by a provider bound to the company by a contract. For a non-sensitive passage, some preparation limits exposure. OWASP cites tokenization and redaction among the techniques used to clean sensitive information before processing [1]. By hand, this amounts to replacing names, amounts and references with neutral placeholders, for example "[Company A]" and "[Amount]", then putting them back into the translation. This method does not suit a text whose very structure is confidential. After translation, the employee reads the result over. NIST describes the risk of erroneous content stated with confidence [3]: in a contract, a lawyer or a person who reads the original language checks the legal terms, durations and amounts. If a confidential text has already been pasted into an unapproved service, the employee reports it immediately, without waiting to find out whether any harm has occurred. ## Pitfalls - Free versions: their terms of use decide what becomes of the text. OWASP recommends that applications offer a way to opt out of data reuse [1], but nothing guarantees that a free service offers it. - Browser extensions: the sources cited here do not detail how they work. The employee therefore cannot assume that they handle the text with more care than an online site, and approves them like any other tool. - Fluent but wrong translation: a well-written text is not an accurate text [3]. - Incomplete anonymization: removing a name is not enough if the context makes it possible to recognize the parties. CNIL notes that some models are anonymous and others are not, which shows that anonymity is not a given by default [2]. - Trust in displayed notices: a rule such as "this service keeps nothing" has value only if it appears in a written commitment from the provider to the company. - Forgetting the confidentiality obligation: a contract may forbid disclosing its content to a third party. The sources cited here do not detail these clauses, which are read in the contract itself. ## What the company expects OWASP recommends providing guidelines to avoid entering sensitive information and offering training on good practices for safe interaction with LLMs [1]. For an employee, this translates into a clear team rule: which tool, for which documents, with what review. ## Sources 1. OWASP, "LLM02:2025 Sensitive Information Disclosure". https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/ (accessed 3 November 2026) 2. CNIL, "IA et RGPD : la CNIL publie ses nouvelles recommandations pour accompagner une innovation responsable", 7 February 2025. https://www.cnil.fr/fr/ia-et-rgpd-la-cnil-publie-ses-nouvelles-recommandations-pour-accompagner-une-innovation-responsable (accessed 3 November 2026) 3. NIST, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile". https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf (accessed 3 November 2026) 4. CNIL, "Le règlement général sur la protection des données - RGPD". https://www.cnil.fr/fr/reglement-europeen-protection-donnees (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/ai-machine-translation-confidential-contracts/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.