Patent AI Confidentiality Guide | USPTO Rules

The Confidentiality Challenge in Patent AI

Patent law operates on a fundamental tension that AI makes more acute: the patent system requires disclosure of inventions to the public, but the period between invention and patent grant is a window of extreme vulnerability. During this window, premature disclosure can destroy patentability, expose trade secrets, or enable competitors to design around pending applications before they issue.

Patent firms and corporate IP departments handle some of the most sensitive information their clients possess: unpublished invention disclosures, trade secret documentation, M&A target technology assessments, and litigation strategy documents. Every interaction with an AI system creates a potential disclosure event. When you type an invention description into a cloud AI tool, that text becomes part of the provider's data pipeline — and potentially part of their training data, their logs, or their subprocessor infrastructure.

The USPTO has not issued specific regulations governing AI use in patent practice, but the consequences of AI-related confidentiality breaches are well-established under existing law. Section 102 of the Patent Act (as revised by the America Invents Act) establishes that an invention is not novel if it was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date. Cloud AI interactions can trigger the "otherwise available to the public" clause even without intentional disclosure.

Specific Confidentiality Risks of Cloud AI in Patent Practice

Training data ingestion — Some AI providers use customer interactions to improve their models. An invention description entered into such a system could be incorporated into the model's weights, potentially enabling other users to elicit that information.
Log retention and access — Cloud AI providers retain request logs for debugging, security, and compliance. These logs may contain invention descriptions, claim language, or trade secret documentation accessible to the provider's personnel or subprocessors.
Subprocessor exposure — Cloud AI providers often use subprocessors for data storage, analytics, and customer support. Each subprocessor expands the attack surface and the number of entities with potential access to confidential information.
Legal process exposure — Cloud AI providers may be subject to legal process (subpoenas, court orders, national security letters) that could compel disclosure of customer data, including patent-related interactions.
Data breach exposure — Cloud AI providers are targets for cyberattacks. A breach could expose years of patent firm interactions, including unpublished invention disclosures.
International data transfers — If the AI provider stores data in multiple jurisdictions, invention disclosures may be subject to foreign data access laws (e.g., US CLOUD Act, China DSL, EU Schrems II implications).

USPTO Confidentiality Rules and AI Implications

While the USPTO has not issued specific AI regulations, existing confidentiality rules and ethical obligations create clear expectations for how patent practitioners handle confidential information — including when using AI tools.

Key USPTO and Legal Requirements

Rule / Requirement	What It Requires	AI Implication
37 CFR §1.14 — Confidentiality	USPTO will not make patent applications available for public inspection until 18 months from filing (or earlier under specific conditions).	AI systems must not create an earlier public disclosure. Cloud AI interactions that expose invention details before the 18-month window can violate this protection.
37 CFR §1.50 — Confidentiality of Applications	Applications containing certain types of subject matter (national security, atomic energy) may be kept in secrecy order.	AI systems processing national-security-related inventions must not transmit data outside controlled environments.
37 CFR §1.52 — Confidential Correspondence	Correspondence with the USPTO regarding pending applications is confidential.	AI systems used to draft or review USPTO correspondence must not expose that correspondence to third parties.
37 CFR §1.14 — Foreign Filing Licenses	US inventions may require a foreign filing license from the USPTO or a filing license from the CIA before filing abroad.	AI systems used for international patent strategy must ensure data does not cross borders in violation of foreign filing license conditions.
28 CFR §301.12 — Invention Secrecy Act	Inventions that may pose a risk to national security may be subject to secrecy orders.	AI systems processing classified or national-security-related inventions must operate within authorized security environments.
37 CFR §11.18 — Dutess of Practitioners	Patent practitioners have a duty to maintain confidentiality of client information under the Model Code of Professional Responsibility.	Using AI systems that expose confidential client information to third parties may violate ethical obligations.

Duty of Confidentiality Under Model Rules

Patent practitioners are typically licensed attorneys subject to state bar rules of professional conduct. Model Rule 1.6 requires lawyers to "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to information relating to the representation of a client." The ABA has issued formal opinions (21, 2017; 483, 2017) reinforcing that lawyers must understand the technology they use and take appropriate measures to protect client data.

For patent practitioners, this duty extends to:

Invention disclosures — Information provided by inventors before patent filing, often including details not yet disclosed to anyone
Trade secrets — Many patent applications include both patentable subject matter and trade secret information
Client strategy — Patent range of scenarios strategy, M&A-related IP assessments, and litigation positioning are all confidential client information
Prosecution strategy — Claim construction, argument strategy, and amendment approaches are protected by attorney-client privilege and work product doctrine

AI Confidentiality Risk Assessment for Patent Firms

Before deploying any AI tool in a patent practice, firms should conduct a structured risk assessment that evaluates the specific confidentiality risks of each use case.

AI Use Case	Confidentiality Risk	Mitigation Strategy
Prior art search	Medium — Input may include invention descriptions; output is public patent data	Use on-premise AI indexed to public patent databases. Never input full invention disclosures. Use anonymized search queries.
Patent drafting assistance	High — Input includes full invention disclosures, claim language, and specification drafts	On-premise deployment required. Data never leaves firm infrastructure. No training data ingestion. Full audit trail.
Claim analysis and comparison	High — Input includes pending claims and competitor patent claims	On-premise deployment required. Vector database indexed to client patent range of scenarios. No data transmission to third parties.
Portfolio analytics	Medium-High — Input includes range of scenarios data, technology maps, and licensing strategy	On-premise deployment. Aggregated analytics only. No raw range of scenarios data exposed to third parties.
Office action response drafting	High — Input includes examiner rejections, client strategy, and argument drafts	On-premise deployment required. Prosecution strategy is work product. No exposure to third parties.
Technology landscape analysis	Low-Medium — Input may include aggregated, anonymized data	Cloud AI may be acceptable if data is fully anonymized and aggregated. Verify provider data handling terms.

Risk Assessment Checklist

[ ] Data classification — Classify all information that will be processed by the AI system (public, confidential, highly confidential, privileged, trade secret)
[ ] Data flow mapping — Document exactly where data goes when entered into the AI system (provider servers, subprocessors, jurisdictions)
[ ] Training data policy — Verify whether the AI provider uses customer data for training. If yes, reject for confidential use cases.
[ ] Log retention policy — Understand how long the provider retains request logs, who can access them, and under what circumstances they may be disclosed.
[ ] Subprocessor inventory — Request the provider's list of subprocessors and their data handling practices.
[ ] Data processing agreement — Execute a DPA or equivalent contract that prohibits training data ingestion, limits data retention, and guarantees data deletion upon request.
[ ] Legal process protocol — Understand the provider's protocol for legal process requests and whether they will notify you before disclosing data.
[ ] International transfer assessment — Determine whether data is stored or processed outside your jurisdiction and assess the implications.

Safe Prior Art Search with AI

Prior art search is one of the most common AI use cases in patent practice, but it presents specific confidentiality challenges. The goal is to find relevant prior art without exposing the invention being searched to third-party systems.

Safe Prior Art Search Practices

Anonymized queries — Search using generic technical terms rather than specific invention descriptions. Replace key technical details with broader category terms.
On-premise search indexing — Deploy AI models on your infrastructure that index public patent databases (USPTO, EPO, WIPO, JPO, KIPO). The AI processes queries locally and retrieves results from public sources.
RAG-based retrieval — Use Retrieval-Augmented Generation with a local vector database indexed to public patent data. The AI retrieves relevant prior art without transmitting your invention details to external systems.
Separate search from disclosure — Use one AI system for prior art search (anonymized queries) and a separate, fully isolated system for drafting and prosecution (full invention details).
Output verification — Verify all AI-generated prior art citations against the original sources. AI can hallucinate patent numbers, dates, and technical details.

Trade Secret Protection in AI-Assisted Patent Practice

Many patent applications include both patentable subject matter (which will be published) and trade secret information (which should remain confidential). The Defend Trade Secrets Act (DTSA) and state trade secret laws provide protection for information that is subject to reasonable efforts to maintain its secrecy. AI systems that expose trade secret information can destroy that protection.

Trade Secret Classification and Handling

Trade secret inventory — Identify all trade secret information handled by the firm and classify by sensitivity level.
AI system segregation — Use different AI systems for patent-related work (where publication is expected) and trade secret work (where confidentiality is absolute).
Parameterized disclosure — When using AI for trade secret-adjacent work, parameterize or generalize the input to remove trade secret specifics while preserving analytical utility.
On-premise requirement — Any AI system processing trade secret information must operate on-premise with no data transmission outside the firm's infrastructure.
Access controls — Restrict access to trade secret AI systems to authorized personnel with appropriate security clearances.

International Filing Considerations for AI

Patent applications filed internationally introduce additional confidentiality considerations, as AI systems may process data across multiple jurisdictions with different data protection and national security laws.

Key International Considerations

US CLOUD Act — US law enforcement can compel US-based AI providers to produce data in their possession, custody, or control, regardless of where the data is stored. This includes data stored on servers in the EU, Japan, or other jurisdictions with strong data protection laws.
EU GDPR — If AI systems process personal data of EU residents (e.g., inventor information), GDPR requirements apply. Cross-border transfers require appropriate safeguards (SCCs, adequacy decisions).
China Data Security Law (DSL) — China restricts the transfer of "important data" outside China. If your AI provider operates in China, ensure compliance with DSL requirements.
Foreign filing licenses — Some inventions require a foreign filing license from the USPTO before filing abroad. AI systems used in international filing strategy must not create unauthorized disclosures in the destination country.
PCT applications — Patent Cooperation Treaty applications involve multiple jurisdictions. AI systems processing PCT applications must comply with the confidentiality requirements of all relevant jurisdictions.

The On-Premise AI Advantage for Patent Confidentiality

On-premise AI deployment is the only approach that fully addresses the confidentiality requirements of patent practice. When AI runs on your infrastructure, within your network perimeter, under your access controls, you maintain complete control over confidential information.

How On-Premise AI Protects Patent Confidentiality

Zero data transmission — Invention disclosures, claim language, specification drafts, and prosecution strategy never leave your infrastructure. No training data ingestion, no log retention by third parties, no subprocessor exposure.
Full privilege protection — Attorney-client privilege and work product protection are maintained because no confidential information is shared with third parties.
Trade secret preservation — Trade secret information processed by AI remains under your control. Reasonable efforts to maintain secrecy are satisfied because the data never leaves your environment.
USPTO compliance — Confidentiality requirements under 37 CFR are satisfied because patent applications remain confidential until the 18-month publication window.
International compliance — Data jurisdiction is fully controlled. No unexpected cross-border transfers. Compliance with CLOUD Act, GDPR, DSL, and other international data laws.
Client trust — Clients can be confident that their most sensitive information — unpublished inventions, trade secrets, and litigation strategy — is never exposed to third-party AI systems.

In patent practice, confidentiality is not optional. It is the foundation of the attorney-client relationship, the basis of trade secret protection, and a prerequisite for valid patent rights. On-premise AI deployment is the only approach that fully satisfies these requirements.

Next Steps

Use this guide to evaluate your current AI tools and practices against USPTO confidentiality requirements and ethical obligations. Identify risks, prioritize remediation, and build a confidentiality framework that protects ya clients' most sensitive information.

BPI helps patent firms and IP departments deploy AI that maintains full confidentiality. Our Privacy-First AI engagements are designed for environments where data confidentiality is paramount, with on-premise deployment that keeps all information under your control. Learn more about our IP AI services or book a consultation to discuss your specific confidentiality requirements.

Patent AI Confidentiality: Protecting Pending Inventions from Premature Disclosure