03 · What You Need to Know
Why Reviewer Comments Can Raise Confidentiality Risks When Processed by AI
Reviewer Comments Are Part of a Confidential Editorial Process
Peer review ordinarily involves confidential communications among authors, reviewers, and editors.
Reviewers receive access to unpublished manuscripts under obligations established by the journal. Editors manage the resulting reports and decide which comments are communicated to authors.
Authors who receive reviewer reports may use them for the legitimate purpose of revising their manuscripts. However, this does not automatically establish that the reports may be transferred to every external AI provider.
The applicable conditions depend on journal policies, the contents of the reports, and the proposed processing arrangement.
Not Every Reviewer Comment Contains the Same Type of Information
Some comments concern general writing clarity or routine formatting. Others discuss unpublished data, methodological weaknesses, intellectual contributions, or confidential editorial judgments.
These differences affect the risks associated with AI processing.
| Information in Reviewer Comments |
Potential Risk |
Relevant Consideration |
| General writing suggestions |
May be relatively low sensitivity |
Journal AI-use policy still applies |
| Unpublished research findings |
Disclosure of nonpublic scientific information |
Confidentiality and permitted processing |
| Detailed methodological descriptions |
Exposure of unpublished research procedures |
Potential intellectual property or confidentiality concerns |
| Confidential editor comments |
Disclosure of restricted editorial deliberations |
Journal authorization and access restrictions |
| Reviewer identities or identifying details |
Exposure of personal or confidential information |
Privacy and peer-review anonymity |
| Participant-level information |
Potential privacy or research ethics concerns |
Data protection and consent restrictions |
| Potentially patentable discoveries |
Possible confidentiality and intellectual property implications |
Institutional and legal safeguards |
The presence of these materials does not mean that every AI processing arrangement is prohibited. It means that the authorization and safeguards must match the information being processed.
Authors and Reviewers Have Different Confidentiality Positions
An author using AI to prepare a revision is not in exactly the same position as an invited reviewer evaluating someone else's unpublished manuscript.
Authors generally control their own drafting process, subject to coauthor agreements, journal policies, institutional obligations, and other applicable restrictions.
Reviewers, by contrast, receive access to manuscripts specifically for confidential editorial evaluation and are ordinarily subject to stricter restrictions on sharing that material.
Nevertheless, an author may still receive reviewer reports containing confidential editorial information that should not be disclosed without authorization.
These distinctions matter when interpreting publisher policies that specifically prohibit reviewers from uploading manuscripts to generative AI systems.
Such restrictions should not automatically be presented as identical rules for authors processing their own materials, although authors may face separate limitations.
Why Removing Reviewer Names May Not Be Enough
Removing reviewer names or manuscript identifiers can reduce some identification risks.
However, confidentiality concerns may remain because the comments describe unpublished research or reveal distinctive details about the manuscript.
For example, a comment discussing a novel experimental apparatus, unpublished algorithm, or confidential dataset may remain sensitive without any personal identifiers.
Similarly, a reviewer may reveal identifiable professional information through references to their own work or specialized expertise.
Anonymization should therefore be evaluated in relation to the actual information, not assumed to be complete because names were removed.
What Happens When Comments Are Submitted to an External AI Service?
Depending on the service, submitted content may be transmitted to remote infrastructure, processed by external providers, retained for specified periods, or made available under particular administrative and contractual arrangements.
Different AI services offer different settings and protections. Some provide enterprise agreements, restricted retention, or commitments concerning model training.
These conditions should be verified using current provider documentation and applicable institutional agreements.
Authors should not assume that a paid subscription, private conversation interface, or deletion option guarantees that confidential content is never retained or processed outside their control.
The relevant question is whether the actual processing arrangement satisfies the requirements governing the material.
Does a No-Training Policy Make Uploading Safe?
Not automatically.
A provider's commitment not to use submitted content for model training may reduce one category of risk, but it does not necessarily eliminate retention, access, security, or contractual concerns.
For example, content may still be processed to provide the service or retained for operational and security purposes under the applicable terms.
The specific arrangements vary and should be examined directly.
Moreover, a journal may restrict external processing regardless of whether the provider uses the material for training.
Authorization and technical safeguards are separate considerations.
Can Authors Upload Only Selected Reviewer Comments?
Sharing selected comments rather than an entire report may reduce the amount of information disclosed.
However, data minimization does not automatically make the processing permissible.
A short excerpt may still reveal unpublished findings, confidential editorial assessments, or identifying details.
Authors should determine whether the selected information is permitted for processing and whether the task can be completed without exposing sensitive content.
For example, a general request for advice on organizing revision tasks may not require uploading the original reviewer reports.
Can Authors Paraphrase Reviewer Comments Before Using AI?
Paraphrasing may reduce direct disclosure of the original report, but it does not necessarily remove confidential information.
A paraphrase describing a distinctive unpublished result or research invention may still reveal sensitive content.
Where journal policies permit generic AI assistance, authors may formulate abstract methodological or writing questions that do not disclose manuscript-specific information.
However, such abstraction should be genuine. Replacing a manuscript title with "Study A" while preserving detailed unpublished findings may provide little confidentiality protection.
What About Uploading the Revised Manuscript Alongside Reviewer Comments?
This may increase the amount and sensitivity of information disclosed.
The revised manuscript may contain unpublished analyses, additional data, intellectual property, and information about research participants.
Uploading both documents may also expose the relationship between confidential reviewer concerns and the authors' revision decisions.
Authors should verify that the journal and any relevant institutional arrangements permit the proposed processing.
Where authorized, the system should be used within appropriate access, retention, and security controls.
Can a Journal-Approved AI System Be Used?
Potentially, within the scope of its authorization.
A publisher may provide or approve an AI-assisted manuscript preparation or editorial system with defined processing conditions.
Such an arrangement may address risks that arise when material is transferred to an unrelated general-purpose service.
However, approval for one activity does not automatically authorize every other activity.
For example, permission to use a tool for language editing does not necessarily include permission to upload confidential editor-only correspondence or participant-level data.
Authors should verify both the approved tool and the permitted purpose.
How Do Journal AI Policies Affect Authors?
Publisher policies differ in their treatment of AI-assisted writing, manuscript preparation, peer review, and editorial processing.
Some permit limited language assistance under specified conditions, while others require disclosure of particular generative AI uses.
Policies concerning reviewers' handling of confidential manuscripts may be stricter than those governing authors' use of AI in preparing their own submissions.
Authors should consult the current instructions for their journal and avoid assuming that a policy written for one role applies identically to another.
The International Committee of Medical Journal Editors provides relevant recommendations concerning AI use in scholarly publishing, including author responsibility and peer-review confidentiality.
Could Uploading Reviewer Comments Affect Intellectual Property?
Potentially, when the comments contain information about unpublished inventions, patentable methods, proprietary datasets, or confidential collaborations.
Whether disclosure to an AI service affects legal rights depends on the applicable jurisdiction, contractual terms, confidentiality arrangements, and circumstances of the disclosure.
It should not be assumed that every upload destroys patentability or that every private AI service guarantees legal confidentiality.
Where potentially valuable intellectual property is involved, authors should consult their institution's technology transfer office or qualified legal adviser before external disclosure.
What If Reviewer Comments Contain Personal or Sensitive Data?
Some reports may refer to research participants, identifiable individuals, confidential institutional information, or sensitive datasets.
Such material may be subject to research ethics approvals, consent conditions, institutional policies, or applicable data protection laws.
Authors should avoid submitting identifiable or restricted information to an AI system unless the processing is specifically authorized and appropriately safeguarded.
Removing direct identifiers may reduce risk, but the possibility of reidentification or disclosure through contextual details should also be considered.
What If the Journal's Policy Is Silent?
Silence should not automatically be interpreted as permission to upload confidential editorial material.
Authors may seek clarification from the editorial office about whether reviewer comments can be processed through a particular AI service for revision planning or response drafting.
The inquiry should describe the intended use and, where relevant, the provider's data-handling arrangements.
If the proposed processing involves clearly confidential or restricted material and authorization remains uncertain, authors should avoid uploading it until the issue is resolved.
Can AI Still Help Without Access to the Original Comments?
Yes, for certain general tasks.
Authors may use AI, where permitted, to develop a generic response-letter structure, learn how to organize revision tasks, or improve nonconfidential writing.
For example, an author might ask for a general framework distinguishing comments that require clarification from those that may require additional analysis.
The resulting guidance can then be applied manually to the confidential reviewer reports.
This approach may provide some organizational benefit without transmitting the original editorial communications.
What Should Authors Do After an Unauthorized Upload?
If authors discover that confidential reviewer comments were uploaded to an AI service contrary to applicable restrictions, they should stop further disclosure and examine the relevant incident-response procedures.
Depending on the circumstances, they may need to contact the journal, institutional research office, information security team, or data protection officer.
They should preserve an accurate record of what information was submitted, when it occurred, and which service was involved.
Deleting a conversation may reduce continued access in some circumstances, but it should not be assumed to reverse all processing or retention.
The appropriate response depends on the sensitivity of the material and the governing obligations.
Who Is Responsible for Protecting Reviewer Comments?
Authors remain responsible for their handling of materials received during the revision process, subject to applicable journal, institutional, and legal requirements.
AI providers have responsibilities under their contracts and applicable laws, but those arrangements do not eliminate the author's obligation to determine whether disclosure is permitted.
Similarly, disclosure of AI assistance in a revised manuscript does not retrospectively authorize an inappropriate transfer of confidential information.
The safest approach is to establish authorization and safeguards before processing the material.
