Your Executive Assistant Uploaded a Confidential Contract to ChatGPT. How One Routine Task Could Put Your Company's Reputation at Risk

Imagine this scenario. A CEO asks their Executive Assistant to compare two contracts from prospective business partners and prepare a summary of the differences: pricing, deadlines, liability provisions and termination clauses. The request is urgent, the documents are lengthy, and the findings are needed before the next meeting.

The assistant decides to save time by using artificial intelligence. They upload both contracts to a publicly available AI tool and, within minutes, receive a neatly structured comparison. The CEO is pleased. The task has been completed quickly, the information is clearly presented, and valuable time has been saved.

But one detail has been overlooked.

The documents contain commercially sensitive terms, information about counterparties, personal data relating to signatories and confidentiality provisions.

This is precisely the kind of situation that is changing expectations of Executive Assistants.

Today, being efficient with documents, confident with AI tools and reliable under pressure is no longer enough. Someone with access to a CEO's information must understand which data can be processed using AI, which requires additional protection and when it is necessary to stop and question an instruction, even if the CEO needs an answer in ten minutes.

According to IBM's Cost of a Data Breach Report 2025, the average global cost of a data breach among the organisations studied was US$4.44 million. The report also found that 63% of the organisations surveyed lacked AI governance policies.

Verizon's 2025 Data Breach Investigations Report highlights another dimension of the problem: approximately 60% of confirmed breaches involved a human element. The report examined more than 22,000 security incidents, including 12,195 confirmed data breaches.

These figures do not suggest that every employee using ChatGPT creates a multimillion-dollar threat. Nor do the studies focus specifically on Executive Assistants. What they demonstrate is a broader challenge: technology is advancing faster than many organisations can establish effective rules for using it safely.

For business owners and senior executives, this has direct practical implications.

An Executive Assistant may have access to information that is not available to most employees: potential transactions, financial plans, correspondence with business partners, client information and details of the CEO's personal affairs.

At the same time, assistants are increasingly expected to use AI for tasks where it can genuinely add value: comparing proposals, preparing briefing notes, organising information, drafting correspondence and identifying key provisions in documents.

The risk does not arise simply because AI is being used. It arises when nobody has established what information may be shared, which tools are approved, under what conditions and who is accountable for the outcome.

A common mistake is to assume that because an employee has access to a document, they are free to process it using any convenient business tool.

In reality, having permission to access a document and having permission to disclose its contents to an external technology provider are two very different things.

Consider an agreement with a prospective investor. It may contain details of the proposed transaction, financial arrangements, contractual deadlines and the identities of those involved in negotiations.

Even where no personal data is involved, the terms may constitute commercially confidential information protected by contractual obligations or internal information-security policies.

Another agreement might contain passport details, residential addresses, telephone numbers, signatures or information about individuals representing the parties.

That introduces a separate set of data-protection considerations.

For UK organisations, the processing of personal data must be assessed against the requirements of the UK GDPR and the Data Protection Act 2018. Depending on the circumstances, sharing information with an external AI provider may raise questions about lawful processing, processor arrangements, international data transfers, security measures and contractual confidentiality.

For organisations operating in other jurisdictions, the applicable legal framework may differ.

A company having a legitimate reason to hold a client's contract does not automatically mean it has permission to upload that contract to a third-party AI platform.

Equally, there is no universal rule that every contract must be kept away from AI.

Whether a particular document can be processed depends on its contents, the legal basis for processing, the organisation's internal policies and the terms and configuration of the specific service.

A competent Executive Assistant understands that distinction rather than assuming that an accessible tool is automatically an authorised one.

1. Uploading Confidential Transaction Documents to an Unapproved AI Tool

The CEO asks the assistant to compare two draft agreements. To work faster, the assistant uploads both files using a personal account on a public AI platform.

The problem is not limited to the possibility of a data leak.

The company may lose control over how the information is processed, who can access it and whether its disclosure complies with obligations owed to the other party.

A professional approach: First, establish the classification of the information and whether the chosen tool is approved for that purpose. If there is no authorised method, compare the documents locally or request access to an approved corporate solution. Where appropriate, AI can be used to design a comparison framework without receiving the original agreements or their sensitive terms.

2. Drafting a Reply to a Business Partner Using Confidential Correspondence

An assistant wants AI to help write a diplomatic response to a difficult email. They copy the entire correspondence history into the chatbot.

The thread may include commercially sensitive concessions, internal negotiating positions and information that should remain within a restricted group.

A professional approach: Describe the communication challenge in neutral terms, omitting names, identifiers, financial details and confidential negotiating information unless disclosure is explicitly authorised. Then review the draft personally to ensure it accurately reflects the company's position.

3. Screening Candidates Using a Personal AI Account

An assistant supports the CEO with recruitment and uploads CVs containing candidates' telephone numbers, email addresses, photographs and employment histories to an AI platform.

Even if the intention is simply to compare professional skills, this involves processing personal data.

A professional approach: Use approved recruitment systems and established data-handling procedures. If the task allows for anonymisation, remove both direct and indirect identifiers and assess whether an individual could still be identified from the remaining information.

Removing someone's name does not necessarily make the data anonymous.

4. Publishing Unverified Claims on Behalf of the CEO

An assistant prepares a conference speech, media comment or LinkedIn post for the CEO. AI produces persuasive statistics, quotations and examples, but nobody checks the original sources.

If the CEO publicly repeats fabricated figures or attributes statements to someone who never made them, the consequences can quickly become reputational.

A professional approach: Verify material claims against primary sources, distinguish established facts from interpretation, obtain approval for sensitive statements and avoid publishing information that cannot be substantiated.

5. Responding to a Convincing Message Apparently Sent by the CEO

An assistant receives a voice message or email that appears to come from the CEO, requesting an urgent transfer of client information, access to confidential files or a change to payment details.

Generative AI has made convincing voice impersonation and fraudulent business correspondence more accessible. Recognising a familiar tone or writing style is no longer a sufficient safeguard.

A professional approach: Verify unusual requests through a previously agreed, independent communication channel, particularly where payments, system access, personal data or confidential documents are involved.

Across all five situations, the value of a strong Executive Assistant lies not in avoiding AI altogether, but in recognising the boundary between legitimate automation and unnecessary exposure.

A blanket ban on AI is not always the most effective solution.

It may prevent employees from using genuinely useful technology while encouraging some to adopt unapproved services without the organisation's knowledge — a practice often referred to as shadow AI.

A more mature approach is to define permitted use cases and clear information-security requirements.

For Executive Assistants, a practical framework involves four checks.

Step 1. Identify the Type of Information Involved

Before using AI, establish whether the material consists of publicly available information, internal business information, confidential material or personal data.

For example, published market research and publicly advertised pricing can be handled differently from a company's confidential financial forecasts.

If the status of the information is unclear, the correct response is to seek clarification, not to assume it is public.

Step 2. Check Whether the Tool Is Approved and How It Processes Data

The assistant should understand whether the service has been authorised by the organisation, who may access the information submitted, and the applicable arrangements for data storage, use and deletion.

A corporate subscription does not automatically mean that every category of company information can be uploaded.

The relevant settings, contractual terms and internal permissions must support the intended use.

Step 3. Minimise the Information Shared

Where a task can be completed using anonymised or synthetic information, there is no reason to disclose more than is necessary.

For instance, AI can help create a contract-comparison template using categories such as price, deadlines, liability, termination and approval procedures without receiving the original documents.

There is, however, an important limitation.

Replacing a company name with “Company A” does not necessarily make the information safe to disclose.

Unique transaction values, dates, commercial circumstances and combinations of details may still identify the parties involved.

If identification remains possible or sensitive commercial terms are retained, the information still requires appropriate protection.

Step 4. Verify the Output Before It Reaches the CEO

AI may misinterpret contractual provisions, overlook exceptions or present a confident conclusion that is not supported by the source document.

An assistant must therefore check material findings against the original text, flag uncertainty and avoid presenting an AI-generated interpretation as legal advice.

Significant contractual decisions should be reviewed by appropriately qualified professionals, including legal advisers where necessary.

Professional use of AI is not simply about obtaining an answer faster. It is about ensuring that information is processed appropriately and that the resulting work can be trusted.

This is one of the clearest tests of professional judgement.

A CEO may genuinely believe the task is harmless or may simply be unfamiliar with the implications of using a particular service.

The assistant, however, still has a responsibility to follow the organisation's established rules for handling information.

A strong professional neither responds with a flat refusal nor automatically carries out the instruction.

Instead, they explain the specific concern and offer a workable alternative.

For example:

“This agreement contains confidential commercial terms and personal data. Before sharing it with an external platform, we need to confirm that the processing is authorised. I can prepare the comparison without uploading the full document, or use an approved corporate tool if one is available.”

This response demonstrates three important qualities: an understanding of risk, respect for the business objective and the ability to propose a solution.

If the CEO insists on proceeding, the assistant should follow the organisation's established approval and escalation procedures, involving legal or information-security specialists where appropriate.

Knowing when to challenge an instruction in order to protect the organisation is a sign of professional responsibility, not a lack of willingness to help.

The consequences of uncontrolled information sharing can extend far beyond the IT department.

Imagine that a prospective business partner discovers that the terms of an unsigned agreement were submitted to an external AI service without prior authorisation.

Even if no public data breach occurs, the partner may reasonably question how effectively the company protects commercially sensitive information.

Depending on the circumstances, the consequences could include renegotiated terms, additional due diligence, contractual disputes or a loss of trust.

For senior executives, this risk is particularly significant because Executive Assistants frequently act on their behalf.

They manage correspondence, coordinate meetings, communicate with business partners and handle information that is inaccessible to most other employees.

Reputational protection therefore involves more than securing files. It also requires accurate communication, reliable public statements, respect for confidentiality obligations and the ability to recognise suspicious requests.

An Executive Assistant may not make the company's strategic decisions, but their actions can influence whether others regard the business as a trustworthy partner.

Many candidates list “ChatGPT proficiency”, “digital literacy” and “experience handling confidential information” on their CVs.

None of these statements, on its own, demonstrates an understanding of real-world risk.

During recruitment, it is therefore more useful to assess a candidate's decision-making in realistic situations than to ask which AI tools they have used.

Consider the following interview exercise:

“The CEO needs a comparison of two confidential agreements within 20 minutes. Both documents contain personal data and commercially sensitive terms relating to a forthcoming transaction. You know that AI could help you complete the task more quickly. What would you do?”

Evaluate not only the answer, but also the candidate's reasoning.

A strong candidate should demonstrate:

✅ The ability to recognise confidential information and personal data.

✅ An understanding that access to a document does not automatically authorise disclosure to an external service.

✅ The ability to check corporate policies governing AI use.

✅ A willingness to propose an alternative way of completing the task.

✅ An understanding of data minimisation without assuming that superficial anonymisation removes all risk.

✅ The ability to verify AI-generated conclusions against original sources.

✅ The confidence to explain concerns to the CEO and recommend practical solutions.

The candidate should be able to describe the actual steps they would take, rather than simply repeat the terminology of data protection.

A second scenario could involve an apparently urgent email from the CEO requesting a change to supplier bank details.

This would test the candidate's ability to recognise suspicious instructions, verify authority and follow payment-approval procedures.

Exercises like these help distinguish someone who is comfortable using digital tools from someone who can apply them responsibly in a senior executive environment.

A non-disclosure agreement is an important element of protecting confidential information.

But signing an NDA does not demonstrate that an employee can recognise risks associated with emerging technologies.

Similarly, previous experience supporting a founder or CEO does not guarantee a sound understanding of personal data protection, safe AI use or suspicious communications.

Recruitment should assess three distinct levels of competence.

The first is knowledge. Does the candidate understand confidential information, personal data, access restrictions and approved technology?

The second is practical application. Can they choose an appropriate way to complete a task under time pressure and with incomplete information?

The third is professional judgement. Can they recognise when a process needs to be paused, an instruction clarified or a specialist consulted?

It is often this third level that matters most when supporting a CEO.

The objective is not to hire someone who automatically follows every instruction. It is to appoint a professional who can deliver the required outcome without creating avoidable risks for the business.

Even a highly capable assistant cannot protect information effectively if the organisation has no clear rules.

Before providing access to confidential documents, executive correspondence and corporate systems, companies should establish the relevant boundaries.

Consider whether the following are clearly defined:

✅ Which categories of information the assistant needs access to in order to perform their role.

✅ Which documents must not be shared with external services without specific approval.

✅ Which AI tools are authorised and for what purposes.

✅ Who approves unusual data-processing requests.

✅ What rules apply to personal devices and accounts.

✅ How unusual requests involving payments, access permissions or confidential documents must be verified.

✅ Who should be notified of a suspected information-security incident and how.

✅ How access rights are withdrawn when responsibilities change or employment ends.

These procedures must also be practical.

A policy document is of limited value if employees do not know whom to contact, how to escalate a concern or which approved alternative they can use.

For organisations, the priority should be to integrate information-security requirements into everyday operations rather than treating them as a separate administrative exercise.

Recruiting an Executive Assistant requires more than assessing administrative experience, familiarity with digital tools and the ability to work under pressure.

Professional judgement, responsibility for sensitive information, an understanding of delegated authority and awareness of reputational consequences are equally important.

That is why a well-defined Executive Assistant role should reflect the CEO's actual working requirements, the level of access involved and the situations in which the assistant will be expected to make independent decisions.

At SMART AND TALENTED, we recommend beginning with a complimentary consultation to clarify your requirements. This helps establish which responsibilities should be delegated, the level of professional required and the competencies that should be assessed during recruitment.

If your future Executive Assistant will handle confidential documents, sensitive correspondence, business relationships and AI-powered tools, these expectations should be built into the recruitment process from the outset.

A strong Executive Assistant does more than help a CEO get things done faster. They recognise when an action could compromise sensitive information, damage a business relationship or undermine the company's reputation — and know how to achieve the objective without exposing the organisation to unnecessary risk.