Check the exact service and account someone would use. Terms for a personal subscription may differ from a business plan, and a connected feature may send information to another provider. A general statement that a supplier is secure cannot answer those questions.
Start with one task and the material it needs. A contract, a public product page and a set of staff health notes raise different questions.
Record the arrangement
Question | Where to look or whom to ask |
|---|---|
Which product, plan and account will be used? | Account administrator and supplier agreement |
What information will it receive? | The person doing the task, including attachments and connected folders |
Where is information processed and stored? | Current supplier documentation for the relevant features and region |
Who can access it? | Workspace settings, supplier terms and details of other processors |
Is submitted content used for model training? | The plan’s terms and the settings that control this |
How long are files, conversations and logs kept? | Retention terms for each data type |
What happens when work or an account is deleted? | Deletion, export and account-removal documentation |
Record when the answers were checked. If documentation is unclear, ask the provider a precise question tied to the intended feature. Keep an unresolved answer visible rather than treating it as approval.
Keep different questions separate
Training, access and retention describe different things. A statement that content is not used for training does not tell you how long a conversation is stored or which administrators can see it.
A locally run model also needs checking. Its files, logs and permissions matter, and some features may still call an outside service. Confirm the actual setup with whoever manages it.
Check the business’s obligations
Read relevant customer confidentiality and supplier terms. If personal information is involved, ask whoever handles data protection to assess the proposed use, including contracts and any international transfers or impact assessment that may be needed. The ICO’s AI and data-protection guidance is a starting point for that assessment.
The outcome may be approval for a limited task, a different account or product, a narrower set of information, or a decision to keep the work manual. Write the decision in terms staff can follow: which tool, which account, which material and which task.
Review it when those things change. The AI policy guide shows how to turn the decisions into usable staff guidance.
About Jay
I’m Jay Janes, a Practical AI Advisor and founder of Reformat Labs. I write about choosing useful work for AI, checking the results and supporting the people using it.