03 · What You Need to Know
How Generative AI Can Compromise Confidentiality in Grant Peer Review
Confidentiality Protects More Than the Proposal Document
Research grant confidentiality is not limited to preventing unauthorized distribution of a complete application.
Depending on the funder's rules, protected information may include unpublished hypotheses, preliminary findings, experimental procedures, research strategies, proposed collaborations, budgets, and information obtained during panel deliberations.
Reviewer critiques, evaluation scores, and internal discussions may also be subject to confidentiality obligations.
These protections help preserve the integrity of competitive research funding and respect the conditions under which applicants disclose their work for evaluation.
Consequently, copying only a methodology paragraph or paraphrasing an unpublished research idea may still involve confidential information.
Risk 1: Unauthorized Disclosure to an External AI Provider
The most immediate risk occurs when a reviewer submits confidential proposal information to an AI service without authorization.
Even when the material is transmitted through an encrypted connection, it is being processed by a system outside the reviewer's direct control. Whether this constitutes a prohibited disclosure depends on the applicable review agreement and authorization arrangements.
For example, NIH Notice NOT-OD-23-149 prohibits generative AI use for analyzing applications and formulating peer review critiques. The notice also identifies sharing application content or original concepts with online generative AI tools as a violation of NIH peer review confidentiality and integrity requirements.
NSF likewise prohibits reviewers from uploading proposal content and related review information to non-approved generative AI tools.
These policies illustrate that a reviewer cannot independently authorize third-party processing merely because it appears useful or technically secure.
Risk 2: Retention of Confidential Information
AI services may retain submitted content for different purposes, depending on the product, contractual terms, settings, and operational requirements.
Retention may involve conversation histories, operational logs, uploaded files, or other records associated with service delivery.
A reviewer who deletes a visible conversation should not automatically assume that all associated records have immediately disappeared from every relevant system.
Data retention becomes particularly consequential when the funding organization's confidentiality arrangements restrict where review materials may be stored and for how long.
The relevant questions include what is retained, who can access it, the retention period, available deletion mechanisms, and whether those arrangements have been authorized.
Risk 3: Confusing No-Training Commitments With Confidentiality
Some AI providers offer commitments that particular customer content will not be used to train their models.
Such commitments may reduce one category of risk, but they do not establish that confidential grant applications may be processed through the service.
Training use, operational processing, retention, access controls, and contractual authorization are separate matters.
For example, a service might exclude submitted content from model training while retaining limited records for operational or security purposes under its terms.
Researchers should therefore avoid treating a no-training statement as equivalent to permission from the funding organization.
Risk 4: Access by Unauthorized Individuals or Systems
Confidentiality also depends on who can access the information during processing and storage.
Potential concerns include inappropriate account permissions, shared workspaces, third-party integrations, accidental sharing links, compromised credentials, and processing arrangements that permit access beyond the authorized review participants.
These risks are not unique to generative AI. However, AI-assisted workflows can introduce additional services and data transfers that would not otherwise be part of the grant review process.
Where processing is authorized, access should be limited according to the funder's requirements and the principle that individuals or systems should receive only the information necessary for the permitted task.
Risk 5: Disclosure Through AI-Generated Outputs
Confidential information may be exposed not only through the original input but also through the output generated from it.
For example, a reviewer might use an authorized system to produce a summary containing unpublished technical details. If that summary is subsequently copied into an unapproved service, shared with unauthorized colleagues, or included in an inappropriate document, confidentiality may be compromised.
Generated summaries and critiques should therefore be treated according to the sensitivity of the information they contain.
Rewriting confidential information does not necessarily make it nonconfidential.
Risk 6: Unintended Disclosure Through Prompts and Follow-Up Questions
A reviewer may avoid uploading a complete proposal but still reveal confidential information through individual prompts.
For instance, asking an external AI system to assess a distinctive unpublished experimental design may disclose the central research idea even without mentioning the applicant's identity.
Follow-up questions can gradually reveal additional details about the proposal, its methodology, or the reviewer's evaluation.
Confidentiality should therefore be assessed across the entire interaction, not merely by checking whether a PDF was uploaded.
Risk 7: Exposure of Intellectual Property and Unpublished Discoveries
Some grant applications describe inventions, algorithms, experimental techniques, or commercially valuable research plans that have not been publicly disclosed.
Unauthorized processing may raise concerns about contractual confidentiality, protection of trade secrets, and intellectual property strategy.
However, uploading material to an AI service does not automatically constitute public disclosure for patent-law purposes. The legal consequences depend on the circumstances, contractual protections, and applicable jurisdiction.
The immediate reviewer obligation is to preserve confidentiality according to the funder's rules, rather than independently determine whether a disclosure would ultimately affect patentability.
Risk 8: Processing Personal or Restricted Research Data
Grant proposals may contain identifiable information about investigators, collaborators, research participants, or institutional personnel.
Some applications may also include sensitive preliminary data or descriptions that permit individuals or organizations to be identified indirectly.
Processing personal information through an AI service may engage applicable data protection requirements in addition to the funder's confidentiality rules.
Removing names may reduce some risks, but it does not necessarily eliminate identifiability or the confidentiality of the underlying research.
How Do These Risks Differ?
| Risk |
How It Arises |
Relevant Safeguard |
| Unauthorized disclosure |
Proposal information is submitted to a service without funder permission |
Explicit authorization before processing |
| Data retention |
Confidential information remains stored beyond the expected interaction |
Approved retention and deletion arrangements |
| Third-party access |
Information becomes accessible outside authorized review participants |
Contractual safeguards and access controls |
| Output disclosure |
Generated summaries or critiques reveal restricted information |
Appropriate handling of derived materials |
| Intellectual property exposure |
Unpublished technical details are processed without authorization |
Confidentiality controls and relevant institutional advice |
| Personal data exposure |
Identifiable or restricted information is processed inappropriately |
Compliance with applicable data protection requirements |
Does Anonymizing the Proposal Eliminate Confidentiality Risks?
No. Anonymization addresses identifiability, but confidentiality may protect information independently of personal identity.
A proposal describing an unpublished research method may remain confidential even after the names of all investigators and institutions have been removed.
Furthermore, distinctive combinations of project characteristics may make the applicant or research team recognizable.
Reviewers should not assume that anonymized material can be uploaded when the funder's policy prohibits sharing proposal content with unauthorized systems.
Can an Institutionally Approved AI Tool Still Be Inappropriate?
Yes. A university may approve an AI system for internal document preparation while a funding organization imposes separate restrictions on confidential peer review.
Approval for one purpose does not automatically authorize another.
Even where an AI service offers strong contractual and technical protections, the reviewer must determine whether the funding organization permits the intended activity.
This distinction is particularly important when considering uploading confidential grant proposals to AI tools.
What If Confidential Information Has Already Been Uploaded?
An accidental or unauthorized upload should be handled according to the funding organization's incident reporting procedures.
The reviewer should promptly notify the designated official or security contact where required and provide accurate information about the disclosure.
Relevant details may include the type of material uploaded, the service involved, the time of the incident, and any subsequent actions.
Deletion or containment measures should follow authorized instructions. Reviewers should not assume that removing a conversation from the interface retroactively resolves the disclosure.
Watch Out
Confidentiality is not established solely by encryption, private conversations, enterprise subscriptions, or no-training settings. The decisive requirement is that the funding organization authorizes the processing and that the applicable safeguards are satisfied.
