Confidentiality and AI: the customer’s design data

As of 28 Sep 2026 · compiled from public sources, not legal advice. Your contract with the customer and the customer’s rules are binding.

In vehicle development, service providers often work directly on the customer’s computers, with the customer’s CATIA installation and models – up to complete vehicle designs. An AI assistant such as CadPilot reads names, dimensions and structures from them and sends them to a language model. Whether that is allowed is not decided by the service provider but by the customer – and it differs from customer to customer.

In short

The customer decides, in writing, per job and per data class. That the customer expects more efficiency through AI from its service providers is not yet a release for its data.
Without release no customer data goes to an external AI service – then only a local model or the customer’s own AI environment remains.
The AI rarely needs the whole model. It needs the task and the interface dimensions. Keeping the context small makes the release easier.

What CadPilot transmits – and what not

CadPilot itself opens no network connection. The AI client (e.g. VS Code with Copilot) sends the chat history to its language model – and it contains the tool results: document, feature and parameter names, parameter values, measurements, part numbers, bills of materials and file paths. CAD files and geometry as a whole are not transmitted; screenshots only if the switch for it is explicitly turned on. Safe mode prevents overwriting originals and keeps paths and values out of the log file – it hides nothing from the AI service, because the results are the purpose of the tools. Details are in the guide for the IT approval.

Which rules apply

Contract and confidentiality: purchasing conditions, non-disclosure agreement, the customer’s information security rules. They take precedence over everything else.
Trade secrets: under the German Trade Secrets Act, information is only protected as long as its owner takes “appropriate confidentiality measures” [Q5]. Uncontrolled input into an AI service endangers this protection – for the customer and for the service provider who breaches it.
TISAX / VDA ISA: the automotive information security standard; CAD models of unpublished vehicles fall under prototype protection [Q10]. Cloud services and subcontractors are assessed too.
Data protection (GDPR): only for personal data – in design data e.g. names in the title block, initials in properties or user names in paths. Then a data processing agreement is needed, and for third countries a legal basis: USA via the EU-US Data Privacy Framework (certified providers only) or standard contractual clauses; Mexico has no adequacy decision, so standard contractual clauses [Q7].
CLOUD Act: US authorities can request data from US providers even from EU data centres – this concerns trade secrets, not only personal data [Q9].
Export control: uploading controlled technology into a cloud that can be accessed from third countries can be an export requiring a licence [Q8, Q16]. Vehicle parts are usually not listed, but this has to be checked per job.
AI Act: since 2 Feb 2025, companies using AI have to ensure sufficient AI competence of their staff (Art. 4) [Q6].
Copyright in the result: what an AI creates without human creation is not protected by copyright [Q13]; the customer, however, expects transferable rights (see VW8).

Example: the public rules of the Volkswagen Group

How Volkswagen handles the AI use of its development service providers internally, we do not know; project contracts are not public. The rules on the supplier portal are public, though. They show the line: passing on only with written release, ask for the classification, software on group computers only with approval, AI only when agreed explicitly. The right column is our reading.

	Rule	Content	Meaning for AI use
VW1	IS rule 02.06, 3.2 [Q1]	Passing data or information on to further third parties is only permitted with the written release of the information owner.	An AI service that receives tool results is a further third party. Without written release, no customer data to an external AI service.
VW2	IS rule 02.06, 3.1 [Q1]	All information has to be classified by confidentiality (public, internal, confidential, secret); for documents one creates, the classification has to be asked from the contact person.	Ask for the classification before using AI; the answer decides the operating mode (section “Operating modes”).
VW3	IS rule 02.06, 4.2 [Q1]	Anyone working in the group infrastructure: use programs only with the approval of the responsible contact; private software is not allowed; non-public data only on approved storage, including cloud storage services.	CadPilot on a customer computer needs the customer’s approval, usually through software distribution. The AI service must be released by the customer.
VW4	IS rule 02.06, 4.3 [Q1]	No public internet translation services may be used for documents containing information of the Volkswagen Group.	Our reading: the same applies all the more to public AI chats. The rule does not mention AI explicitly.
VW5	Purchasing conditions for engineering services, 2.6 [Q2]	Services are to be provided in-house by the contractor’s own employees; transfer to third parties (e.g. subcontractors) only with prior written consent.	Also applies to outsourcing to a company in another country, unless the contract says otherwise.
VW6	Purchasing conditions for production material 05/2026, clause 5 [Q3]	Drawings, models and similar items must not be made accessible to unauthorised third parties; sub-suppliers have to be bound accordingly; trade secrets have to be secured according to the state of the art (met with VDA ISA, basic level); TISAX assessment on request.	Formally applies to supply contracts for production material, but shows the line: CAD models are covered explicitly. Everyone who sees them – including an AI service or a site abroad – must be authorised and bound.
VW7	Purchasing conditions for accompanying IT services 08/2026, clauses 6.1, 6.3 [Q4]	Services may only be or contain AI “insofar as this is expressly agreed in the contract”; persons involved need AI competence, with evidence on request, also for subcontractors.	Applies to IT services, but shows the line: AI use is agreed explicitly, not tolerated silently.
VW8	BITL-EKB, clauses 6.7, 7.12 [Q4]	What was created by AI without sufficient human involvement and is therefore not protectable has to be replaced by protectable work; data is processed only at contractually agreed locations.	Document the human design work; fix the processing location of the AI service in the contract.

Operating modes

CadPilot is not tied to any AI provider. Which operating mode is possible depends on the customer’s release:

	Operating mode	Where the tool results go	Suitable for
A	Local model in the customer’s network	nowhere – the language model runs on own hardware	also confidential and secret data if the customer releases the operation; result quality lower depending on the model; not yet tested with CadPilot
B	The customer’s AI environment	into the customer’s tenant (e.g. its Azure OpenAI environment); the customer’s contracts apply	the best solution with large customers: the customer decides and is responsible for its environment. Large manufacturers already run such environments [Q14]; whether service providers may use them has to be asked
C	The service provider’s EU tenant	to a cloud service in the EU, without training on the data (e.g. Azure OpenAI with EU Data Zone [Q11])	internal and, after release, confidential data; written consent required (VW1); residual CLOUD Act risk with US providers [Q9]
D	Business service of a US provider	to a service in the USA or worldwide, without training (e.g. GitHub Copilot Business [Q12])	only if the customer explicitly releases exactly this service; not for prototype or secret data
E	Public AI chat (private account, free tier)	to a service with consumer terms, often with training	never for customer data

Case: a new design based on a predecessor model

A new part is to be derived from the model of the predecessor vehicle. The AI does not have to “receive” the vehicle for that: CadPilot opens a copy in the working folder, and through the tools the AI reads only what it queries for the task – e.g. the parameters of a bracket and the dimensions of its attachment points. Exactly these values then go to the language model.

Clarify before starting: how is the predecessor model classified (D1)? Which operating mode is allowed (D3)? Which kinds of data may leave (D4)? With confidential or secret data and no release for a cloud service, modes A or B remain. Often an abstraction is enough too: interface dimensions, package space and load cases as a table or skeleton instead of the whole model – just as a design engineer sends a colleague a sketch with the key data.

Outsourcing to best-cost countries

Many development service providers pass partial jobs to their own sites in countries such as Mexico, India or Eastern Europe; often a rough sketch with key data is enough. Legally this is passing information to a further party – with the same questions as for the AI service:

Consent: transfer to third parties only with prior written consent (VW5); a subsidiary abroad is a separate company unless the framework contract includes it.
Pass on confidentiality: the site has to be bound accordingly (VW6) and needs a TISAX label with the required assessment objective. Mexico and India are among the ten countries with the most TISAX sites [Q15].
Personal data: Mexico has no EU adequacy decision – standard contractual clauses [Q7].
Export control to be checked per job [Q8, Q16].
AI at the site abroad: if the site uses AI itself, that is the next transfer and needs the same release.

The sketch with key data is a model here: it passes on only what the task needs. The same principle makes AI use approvable.

Checklist for the talk with the customer

Before CadPilot is used on a customer’s data for the first time, these points should be settled in writing:

	Topic	Question to the customer
D1	Classification	How is the data of this job classified (internal, confidential, secret)? Does prototype protection apply?
D2	AI use allowed?	May AI be used for this job – in writing, naming the service, model and region?
D3	Operating mode	Which operating mode (A–D) is allowed? Is there a customer AI environment we should use?
D4	Which data	Which data may go to the AI service: feature and parameter names, dimensions, part numbers, bills of materials, screenshots? What is excluded?
D5	Training and retention	Is it excluded by contract that the provider uses the data for training? How long does it keep inputs and outputs?
D6	Processing location	Where is the data processed (region, subprocessors)? Is a US provider with an EU data centre accepted (CLOUD Act)?
D7	Installation at the customer	May CadPilot be installed on the customer’s computer, and may that computer reach the AI service (proxy, firewall)?
D8	Personal data	Do models contain names, initials or user IDs (title block, properties, paths)? Then a data processing agreement and, for third countries, standard contractual clauses.
D9	Subcontracting and abroad	Is passing work to subsidiaries or sites abroad released? Do they have a matching TISAX label?
D10	Export control	Is any of the data export-controlled? An upload into a cloud accessible from third countries can be an export.
D11	Rights to the result	How is the human share of the design documented, so that the rights of use can be transferred?
D12	AI competence	Which evidence of the training of the people involved is expected (AI Act Art. 4)?
D13	Incidents and deletion	Who receives a report of a suspected data leak? What is deleted at the end of the project, and how is it proven?

What CadPilot brings for this – and what is still missing

Available: no network connection of its own; free choice of the AI service including local models; safe mode with working folder and released read folders; screenshots by default only as a file path; log without paths and values; installation without administrator rights and offline; since version 0.9.0 a data filter that passes part numbers and person names to the AI service only as pseudonyms (SNR#1, NAME#1) and translates them back in the next calls – it masks what has been learned or matches the customer’s numbering scheme; descriptions, dimensions and feature names stay readable; since version 0.10.0 a session report that records what CadPilot returned to the AI client – as an overview without model data for IT and the customer and as a complete log file with a hash chain.
Still missing: a test with a local model. This is an idea for the roadmap, not built.

Sources

Retrieved on 28 Sep 2026. Quotations from the Volkswagen documents are abridged (English versions are our translation); the currently valid wording is authoritative.