Your AI Never Signed the NDA

Ian Matejka · 9 Aug 2026

Guest editorial — on memory, custody, and compliance when the newest member of the asset team is a language model.

Every reader of this magazine has performed the ritual. Day one, before the badge photo: the confidentiality agreement, initialed page by page. Every year thereafter: the ethics recertification, the code-of-conduct attestation, the training module with the quiz you cannot fail twice. The apparatus is so familiar that we have stopped seeing what it is — a machine, refined over a century, for binding human memory to corporate interest.

Now conversational AI systems are arriving in asset teams, and the useful ones do something no tool before them did: they remember. Reservoirs, well histories, screening economics, the reasoning behind decisions taken and not taken. Let us be direct, because this editorial is not a warning against the technology: that memory is precisely what we should want. This industry has spent two decades living through the great crew change, watching careers' worth of tacit knowledge retire with a handover file and a farewell lunch to show for it. A system that remembers why the waterflood was patterned the way it was, which correlations the team trusted and which they quietly overrode, what was tried in 2014 and why it was abandoned — that is succession planning made concrete. Institutional memory that survives the org chart.

But the prize and the exposure are the same object. Precisely because this memory is worth building — because we intend to build it — it deserves harder questions than the pilot brief asked. What is it, legally? Where does it live? And who can vouch for the thing that holds it? You signed. It didn't. And nothing in the apparatus was designed for what it is.

A disclosure before the argument: Blauweiss builds such a system. CLARISSA — a conversational agent that generates and verifies reservoir simulation input decks, described in our SPE ATCE 2026 paper — was designed from the outset for local deployment on hardware the operator owns. This editorial is the reasoning behind that choice. We are engineers, not lawyers; what follows is not legal advice but an engineer's inspection of a structure that carries load, offered because these questions will land on every operator piloting these systems, whoever the vendor is.

A Perfect Memory Is a Record

The confidentiality apparatus was engineered around four properties of human memory, so ambient that no one thought to write them down. Memory is inalienable — it cannot be copied out of the head, only imperfectly retold. It is lossy — it summarizes, decays, and forgets, which is why the departed employee's recollection of a competitor's data room fades into harmlessness. It is non-discoverable — a recollection is testimony, elicited under procedure, not a document produced on demand. And it is attached to a legal person — someone who can be deposed, sued, and held to the agreement they signed.

An AI memory store inverts all four. It is copyable, verbatim, and permanent by default. And — this is the categorical shift — it is a record. There should be no mystery about the substrate: in current practice this memory is typically plain files — markdown notes written and retrieved through protocols like MCP. It is not exotic. It is a folder. And a folder is a document in the fullest legal sense: subject to discovery, to legal hold, to the corporate retention schedule. Nobody has ever subpoenaed a hippocampus. A memory directory gets subpoenaed like any other directory.

The retention schedule is where this bites first, because records management runs on two opposing mandates: mandatory deletion, to keep the discoverable corpus lean, and mandatory retention — well records typically for life of field plus a statutory tail. Human memory was exempt from the schedule. Markdown files are not. An AI memory that grows organically across use cases belongs to no retention class, sits in no records system, and satisfies neither mandate.

Imputed knowledge is where it bites hardest. What an employee knows is, under longstanding agency doctrine, largely what the corporation knows. If the system's memory contains an engineer's passing note about a well-integrity anomaly and no one acts, the discoverable record now proves corporate knowledge — with a timestamp. Memory accretion manufactures scienter. It cuts the other way too: a well-governed memory with clean provenance is also exculpatory evidence of what was known, and when, and what was done about it. The record is not inherently your enemy. An ungoverned record is.

And there is a cultural dimension that engineers already understand instinctively, which is why every functioning organization runs two channels: the written one, and the walk down the hall. The face-to-face conversation exists precisely because it leaves no record — not because its content is improper, but because written fragments are construable. A half-formed speculation, read years later and out of context, looks like knowledge. A devil's-advocate position looks like intent. "Could we get away with a two-well pilot" is a healthy sentence in a hallway and a plaintiff's exhibit in a transcript. Human forgetting kept the second channel safe; a memory-bearing interface abolishes it, and every brainstorm becomes a continuous deposition. To be fair: this cost follows from memory itself, not from where the memory sits. The remedy is governance of the record — curation, classification, deliberate retention. But governance presupposes something more basic. You cannot govern what you do not hold.

Custody You Cannot Verify

Which brings us to where the memory lives, and here our industry has a constraint most AI commentary has never heard of: in several major petroleum jurisdictions, subsurface data is not fully the operator's to relocate. Norway, the United Kingdom, Brazil, and Nigeria, among others, operate national data repositories and licensing regimes that treat seismic and well data as sovereign patrimony, with export subject to regulator consent. A reservoir simulation deck — and the conversational memory of building one — is a distillation of exactly that data. Where the AI's memory resides is not merely an NDA question. It can be a license-terms question.

Now consider what remote hosting actually offers in response: assurances. A region selection, a compliance certificate, a data processing addendum. What it cannot offer is verification. Inference logs, retention windows, and subprocessor chains are invisible from outside the vendor's walls, and jurisdiction follows the provider rather than the data center — under the US CLOUD Act, a US-headquartered vendor can be compelled to produce data regardless of where the disks physically spin, which is precisely why "hosted in-region" satisfies so few sovereignty-minded regulators. None of this requires assuming bad faith. The structural fact is enough: custody is unverifiable, and unverifiable custody sits uneasily against the "reasonable measures" that trade secret protection legally depends on. A secret you cannot demonstrate you controlled is a secret the law may decline to recognize.

If that sounds theoretical, it recently stopped being. In ongoing copyright litigation, a US federal court ordered a major AI provider to preserve user conversations — including conversations users believed they had deleted. Somebody else's lawsuit overrode every customer's deletion decision, worldwide, in one order. Every operator whose engineers had pasted anything into that service learned, retroactively, what their custody position actually was.

The joint-venture dimension makes it worse, and it is distinctly ours. Under a typical JOA, an operator holds partner data under confidentiality obligations owed to each partner separately; a farm-out data room comes with return-or-destroy obligations when the deal dies. An AI memory that accretes across use cases is a commingling machine — the equivalent of one employee sitting on both sides of an information barrier, with perfect recall. From vendor infrastructure, you can request deletion and receive a ticket number. On your own infrastructure, per-asset instance isolation is an architecture decision, and deletion is an act you perform and can attest to. The same logic reaches disclosure law: for a listed operator, a reserves revision under discussion is market-moving information, and routing that discussion through a third party's inference endpoint arguably discloses it to an entity that appears on no insider list. These are not hypothetical harms awaiting case law. They are existing obligations that nobody has mapped onto the new plumbing.

You Cannot Certify a Moving Target

The third leg concerns the compliance apparatus itself, and it helps to be honest about what that apparatus is for. Ethics training, certifications, background checks, and attestations are evidence-generating machinery. When something goes wrong, their function is to demonstrate that the corporation exercised diligence — the logic of every "adequate procedures" defense: you do not prove that no employee ever misbehaved; you prove that a functioning system of training, testing, and oversight existed. Every instrument in that system presupposes two things. An agent you can interrogate. And a fixed subject you are certifying.

A closed, remotely hosted model provides neither. You cannot inspect it. And it is a moving target: versions update silently, so the model your team evaluated last quarter is, in general, not the model answering today. Certification requires a frozen artifact. An API endpoint is never frozen.

Worse, the trigger for recertification is undefined. A switch from one model family to another is obviously a new subject — nobody would carry an evaluation across that boundary. But what about a point release, a 4.5 to a 4.7? What about a change applied upstream with no version bump and no notification — a revised system prompt, a new quantization, a rebalanced routing layer quietly serving your requests from a different variant? What, exactly, constitutes a new model? Employees drift too, which is why attestation is annual. But calendar-based recertification of a subject that can change silently, tomorrow, certifies only the past; the attestation is stale before the ink dries. On an endpoint you do not control, the question has no answer because the change itself is undetectable. On hardware you own, it has a one-line answer: the model is a file, the file has a hash, and a changed hash is the recertification trigger.

Here is the uncomfortable illustration, offered as deliberate hyperbole with a non-hyperbolic core. Suppose the model carries a subtle bias that scores a development project in Nigeria more pessimistically than an otherwise identical project in Norway. No malice is required — name- and nationality-conditioned differences in model output are documented in the evaluation literature, and ambient training-data associations would suffice. The point is not that this is happening in your deployment. The point is that, for a closed model, you cannot rule it out, and can never generate the evidence to show you tried: no fixed artifact to test, no systematic evaluation to run, no documentation to produce. The liability, meanwhile, remains entirely yours — vendor terms do not meaningfully indemnify discriminatory output. That is the compliance officer's nightmare stated plainly: liability without control.

Honesty requires the concession. Local deployment does not remove the risk — open-weight models carry their training data's associations too. What it transforms is the evidentiary position. A pinned local model is a frozen artifact. It can be tested against your own evaluation battery, on your own cases; the results filed; the version hash recorded; remediation applied and the battery re-run. Suddenly each compliance instrument has a real analog, adjusted for the nature of the employee: certification becomes a documented evaluation against a specific checkpoint, recertification becomes re-running the battery per version — per hash — and the disciplinary process becomes fine-tuning or rollback. Local deployment converts an unownable risk into an ownable one, which is all the compliance apparatus ever asked of anyone.

And local deployment opens one further door that remote hosting keeps shut: the choice of what kind of memory to build. Everything argued in the first section applies to memory kept as files — legible, searchable, discoverable, and governable precisely because it is a record. But knowledge can also be absorbed the other way: fine-tuned into the model's weights and certified, through the same evaluation battery, as capability. Weights remain electronically stored information — no one should imagine them beyond a subpoena — but what they surrender is different in kind. You cannot grep a weight file. Extracting its knowledge requires asking it questions, and what comes back is a probabilistic reconstruction, not a filing-cabinet document. Its legal character sits closer to a witness than to a record — which is to say, closer to the employee the confidentiality apparatus was built around all along. Human institutions have always maintained exactly this distinction: some knowledge lives in documents, governed by the retention schedule, and some lives in people, governed by training and certification. A locally deployed system preserves that boundary as a deliberate design decision — records where the record serves you, capability where it does not, with counsel rather than engineers drawing the line. A remotely hosted system collapses both into somebody else's logs.

One last mirror to look into: conversational memory accumulates records about the users — who asked what, who misunderstood which concept, who needed three attempts. That is a performance record in everything but name, and in Germany a technical system capable of monitoring employee performance walks directly into co-determination territory; Norway's working-environment regime raises cousins of the same questions. Note the overlap: the jurisdictions with the strongest data-sovereignty postures are substantially the ones with the strongest employee-data protections. The compliance apparatus points inward as well as outward, and it wants the same answer to the same question: who holds the record?

The Detour Ends

None of this is an argument against conversational AI in the asset team — the opening of this piece argued the opposite. It is an argument about architecture, and our industry has run this exact calculation before. We built in-house seismic processing and some of the largest private computing installations on Earth for one reason: the data could not leave. The move to cloud was an economic detour, not a philosophical conversion — the duty of care never lapsed; the hardware budget did. That constraint has now collapsed. A unified-memory workstation capable of running capable open-weight models sits on a desk and costs a rounding error against a day of rig time.

The remaining objection is capability: local models trail the frontier. Today that is true, and shrinking. But it is also, we would argue, the wrong load path. If the correctness of an engineering answer depends on the raw scale of the language model producing it, then no deployment — local or remote — deserves your trust. The systems worth deploying are built the other way around: deterministic scaffolding carries the correctness burden — parsers, conservation identities, schema-enforced state, machine-checkable provenance — so that the neural components are never load-bearing for correctness, and the conversational layer needs to be competent rather than frontier. That is an architecture decision, and it is precisely the decision that makes local deployment viable now instead of someday.

So before the next pilot, ask the vendor three questions. Where, exactly, does the memory live, and who else can be compelled to produce it? Which frozen model version answers my engineers, and what evidence exists that it was tested? And what would this system hand opposing counsel in discovery? Any vendor who cannot answer crisply has answered anyway.

The old ritual worked because the signature bound a rememberer you could name, question, and hold to account. The new rememberer never signed — and it is worth binding, because it may remember your field longer than anyone on the payroll. Put it somewhere you can hold it to account.