AI-assisted NDA mistakes: when *proving what the AI did* becomes the issue

What happened

Two lawyers in California were publicly reproved by the State Bar for professional misconduct after submitting non-disclosure agreements that contained mistakes. The agreements had missing confidentiality provisions, contradictory language about what could be disclosed, and other errors ^[1].

The lawyers had used generative AI to help draft the NDAs. They said they had reviewed the output before sending it to the clients, but the mistakes remained. One client later complained that the NDA didn't protect their confidential information as promised ^[1].

The bar found that the lawyers had failed to act with competence, diligence and attention. As part of the sanction, both were ordered to complete continuing legal education on the use of generative AI in legal practice ^[1].

Think of it like spell-check: the tool flags things, but if you send a letter with a glaring mistake the tool missed, it's still your mistake. AI that helps draft contracts works the same way. The lawyer is responsible for what goes out.

The evidence question

When something goes wrong with AI-assisted work, the question isn't just whether you reviewed it. It's whether you can show what the AI actually gave you.

In this case, the lawyers said they had reviewed the output. But once the client complained, the record of what the AI produced, and what the lawyers then changed, became the issue. Without that record, it's hard to show exactly where the process broke down, or that the review was thorough.

For a professional, that matters. When a client asks why an AI-assisted document didn't do what it was supposed to, your answer rests on being able to show what the AI produced and what you did with it.

What the AI Act requires

From 2 August 2026, professionals using general-purpose AI in their work must tell clients or affected persons when the output could significantly affect their legal rights or obligations. That duty sits in Article 50(5) of the AI Act ^[2].

For a lawyer drafting an NDA, that would mean telling the client that AI was used if the agreement itself affects their rights, which an NDA plainly does.

The rule doesn't say how to prove later that you told them, or what the AI produced. It just says you must inform them. But once the rule is in place, the question of proof will follow: if a client claims they were never told, can you show that they were?

Where a digital witness fits

This is a case where a digital witness offers a partial answer. It can seal a record of what the AI generated, when it was reviewed and what was sent to the client. That gives the professional their own record, independent of the AI provider, that nobody can quietly rewrite later.

Here's what you would seal: the AI's output when it's generated, the lawyer's edited version when it's finalised, and the version sent to the client. Each one gets a fingerprint at the time it exists. If it's questioned later, anyone you share the record with can check that it's the version that existed on that day.

Who can check? The client, another lawyer reviewing your work, or a disciplinary body. They calculate the fingerprint again and compare it with the sealed one. If it matches, nothing has changed.

What it doesn't do: it doesn't show that the AI's output was correct, or that your review was adequate. Those are questions of professional judgement. What it does is give you a record of what existed at each step, so the argument isn't about whether you kept the output or rewrote it afterwards.

You seal through WitniumChain, using the REST API, the SDK or the MCP server. The AI output itself stays in your systems; only the fingerprint is sent. The first 2,000 witnesses a month are free. Read the docs for how to get started.

How it would work

1. You generate an NDA with AI assistance and seal a record of the output.
2. You review it, make changes and seal the final version you send.
3. If the client later says the NDA didn't protect them, you can show exactly what the AI produced and what you sent, unchanged since those moments.

What this means for you

If you use AI to help draft contracts, ask yourself:

• Do you keep a record of what the AI produced, before you edited it?
• If a client disputes the final document, can you show what changed between generation and delivery?
• When the transparency rule in Article 50(5) applies from August, how will you show you informed the client?

The sanctions in this case weren't about using AI. They were about mistakes that made it through, and the failure to catch them. The lesson is that AI-assisted work is still your work, and if something goes wrong the record of what happened at each step becomes part of your defence.

What to watch

From 2 August 2026, professionals using general-purpose AI must inform affected persons when the output could significantly affect their rights ^[2]. For lawyers, that deadline is worth marking now.

Bar associations in several countries are developing guidance on AI use in legal practice. The California case will likely be cited as courts and regulators consider what diligence looks like when AI is in the workflow.

Sources

1. State Bar of California, Notice of Public Reproval, case nos. 23-O-13687 and 23-O-13688, October 2024. Reported by Jeff Latov on LinkedIn, 9 January 2025. https://www.linkedin.com/posts/jeff-latov-828b0b25_unreasonablereliance-activity-7520566383596838912-OtA7
2. Regulation (EU) 2024/1689 (AI Act), Article 50(5), on the European Commission's AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
3. Rättegångsbalken 35 kap. 1 § (Swedish Code of Judicial Procedure), on the free assessment of evidence. https://data.riksdagen.se/dokument/sfs-1942-740.html