[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuBynXQ66cS0G1JhZwdqTLF13QTa2SVq3-ctT5o0NdHU":3},{"item":4},{"id":5,"idKnowledge":6,"idDomain":7,"idCluster":7,"kindOverride":8,"slug":9,"title":10,"description":11,"bodyMarkdown":12,"bodyHtml":13,"author":14,"date":15,"createdAt":16,"topics":17,"image":23,"hasDownload":24,"fileName":7,"youtubeId":23},"517","55F44B77-8F12-B843-B716-91A1019C216A","","article","how-do-you-check-what-an-ai-vendor-does-with-your-data-before-you-sign","How do you check what an AI vendor does with your data before you sign?","Learn which questions to ask an AI vendor about data retention, training use, location, access, and incidents, how to read the answers, and how to record your decision before you commit.","When a business adopts an AI tool, it usually sends the tool some of its information: customer messages, documents, spreadsheets, or internal notes. What happens to that information afterwards is decided by the vendor's terms and settings, not by the tool's friendly interface. A short, structured check before you sign can prevent expensive surprises.\n\nThis guide explains a proposed approach for non-lawyers. The examples are fictional, and no measured business results are claimed. It is general information, not legal advice. For contracts that involve personal data, regulated information, or large sums, ask a qualified adviser to review the terms.\n\n## Why check before you sign?\n\nOnce data has been shared with a provider, you may not be able to take it back. Terms can allow the provider to keep it, use it to improve models, or share it with other companies that help run the service. Checking first is cheaper than renegotiating, or explaining a problem to a customer, later.\n\nIt also gives you a written record of what you were told, which helps if the vendor's practices or terms change.\n\n## Step 1: Decide what data you plan to send\n\nStart with your own side. List the types of information the tool will handle, and sort them into groups such as public, internal, personal, and confidential. Note any customer contracts or rules that limit where data may go.\n\nA tool that only sees public text needs a lighter check than one that sees customer records.\n\n## Step 2: Find the vendor's documents\n\nCollect the documents that actually govern your use:\n\n- Terms of service or master agreement.\n- Privacy policy.\n- Any data processing terms or addendum.\n- Security or trust pages.\n- Pricing and plan details, because terms often differ between free, business, and enterprise plans.\n\nNote the date of each document, and confirm that they apply to the plan you would buy.\n\n## Step 3: Ask the core questions\n\nUse the same list for every vendor so answers can be compared.\n\n**Training use**\n- Is our data used to train or improve the provider's models?\n- Is that the default, and can it be switched off? Is it off for our plan?\n\n**Retention and deletion**\n- How long are inputs, outputs, and logs kept?\n- Can we delete them, and how long does deletion take?\n- What happens to our data when we cancel?\n\n**Location and sharing**\n- Where is data processed and stored?\n- Which other companies (sub-processors) receive it?\n- Is data shared for advertising or analytics?\n\n**Access**\n- Who at the vendor can see our data, and under what conditions?\n- Can we control which of our staff can use the tool and what it can access?\n\n**Security and incidents**\n- What security practices and independent assessments does the vendor describe?\n- How and how quickly will the vendor tell us about an incident that affects our data?\n\n**Continuity**\n- Can we export our data?\n- How much notice is given before terms or features change?\n\n## Step 4: Read the answers critically\n\nLook for clear, specific, dated statements. Be cautious about:\n\n- Vague phrases such as \"may use data to improve our services\" without detail.\n- Answers that apply to a different plan from the one you would buy.\n- Promises made in marketing materials but absent from the contract.\n- Terms that allow the vendor to change conditions without notice.\n\nIf a point matters to you, get it in writing in the contract or an official document, not only in a sales call.\n\n## Step 5: Test the settings, not just the documents\n\nWhere possible, run a trial with fictional or public data and check the real settings. Look for options to turn off training use, set retention periods, restrict who can use the tool, and export or delete data. Confirm that the settings behave as described.\n\n## Step 6: Compare the risk with the benefit\n\nMatch the vendor's answers against the data you listed in Step 1. For each type of data, decide whether the tool is approved, approved with limits, or not approved. For example, a tool might be fine for drafting public announcements but not for customer records.\n\n## Step 7: Record the decision and set a review date\n\nWrite a short note covering the tool, the plan, the date, the documents you reviewed, the answers you received, and your decision with any limits. Store it with your AI tool list. Set a review date, because terms, features, and data practices change over time.\n\n## Vendor check checklist\n\n- Data types and any contractual limits listed.\n- Governing documents collected, dated, and matched to your plan.\n- Training use, retention, location, access, and incident questions asked.\n- Answers confirmed in official documents, not only by sales staff.\n- Settings tested with fictional or public data.\n- Approval decision made for each data type.\n- Decision and evidence recorded, with a review date.\n- Legal review requested where personal or regulated data is involved.\n\n## Frequently asked questions\n\n**Is a free plan treated differently from a paid one?**\n\nOften yes. Free and consumer plans may allow broader use of your data than business plans, so check the plan you will actually use.\n\n**Do I need a lawyer for every tool?**\n\nNo. Use the checklist for routine tools, and bring in an adviser when personal data, regulated information, or significant spending is involved.\n\n**What if the vendor will not answer?**\n\nTreat unanswered questions as risks. Limit the tool to low-risk data or choose another vendor.\n\n**How often should we repeat the check?**\n\nAt least once a year, and whenever the vendor changes its terms, adds major features, or changes how it handles data.\n\n## The practical next step\n\nChoose one AI tool your team already uses and run it through the core questions this week. Write down the answers and the decision, and add them to your AI tool list.\n\nFor wider context, read *AI and Organizational Intelligence*. Related reading: *How do you build an AI tool inventory in one afternoon?* and *How do you tell a real AI product launch from an announcement before you buy?*\n\n## Sources and review\n\nThis article contains editorial guidance and does not rely on external statistics, product claims, or legal claims.\n\nFactual review: 5 November 2026. Implementation steps are editorial recommendations. This article is not legal advice.","\u003Cp>When a business adopts an AI tool, it usually sends the tool some of its information: customer messages, documents, spreadsheets, or internal notes. What happens to that information afterwards is decided by the vendor's terms and settings, not by the tool's friendly interface. A short, structured check before you sign can prevent expensive surprises.\u003C\u002Fp>\n\u003Cp>This guide explains a proposed approach for non-lawyers. The examples are fictional, and no measured business results are claimed. It is general information, not legal advice. For contracts that involve personal data, regulated information, or large sums, ask a qualified adviser to review the terms.\u003C\u002Fp>\n\u003Ch2>Why check before you sign?\u003C\u002Fh2>\n\u003Cp>Once data has been shared with a provider, you may not be able to take it back. Terms can allow the provider to keep it, use it to improve models, or share it with other companies that help run the service. Checking first is cheaper than renegotiating, or explaining a problem to a customer, later.\u003C\u002Fp>\n\u003Cp>It also gives you a written record of what you were told, which helps if the vendor's practices or terms change.\u003C\u002Fp>\n\u003Ch2>Step 1: Decide what data you plan to send\u003C\u002Fh2>\n\u003Cp>Start with your own side. List the types of information the tool will handle, and sort them into groups such as public, internal, personal, and confidential. Note any customer contracts or rules that limit where data may go.\u003C\u002Fp>\n\u003Cp>A tool that only sees public text needs a lighter check than one that sees customer records.\u003C\u002Fp>\n\u003Ch2>Step 2: Find the vendor's documents\u003C\u002Fh2>\n\u003Cp>Collect the documents that actually govern your use:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Terms of service or master agreement.\u003C\u002Fli>\n\u003Cli>Privacy policy.\u003C\u002Fli>\n\u003Cli>Any data processing terms or addendum.\u003C\u002Fli>\n\u003Cli>Security or trust pages.\u003C\u002Fli>\n\u003Cli>Pricing and plan details, because terms often differ between free, business, and enterprise plans.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Note the date of each document, and confirm that they apply to the plan you would buy.\u003C\u002Fp>\n\u003Ch2>Step 3: Ask the core questions\u003C\u002Fh2>\n\u003Cp>Use the same list for every vendor so answers can be compared.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Training use\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Is our data used to train or improve the provider's models?\u003C\u002Fli>\n\u003Cli>Is that the default, and can it be switched off? Is it off for our plan?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Retention and deletion\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>How long are inputs, outputs, and logs kept?\u003C\u002Fli>\n\u003Cli>Can we delete them, and how long does deletion take?\u003C\u002Fli>\n\u003Cli>What happens to our data when we cancel?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Location and sharing\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Where is data processed and stored?\u003C\u002Fli>\n\u003Cli>Which other companies (sub-processors) receive it?\u003C\u002Fli>\n\u003Cli>Is data shared for advertising or analytics?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Access\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Who at the vendor can see our data, and under what conditions?\u003C\u002Fli>\n\u003Cli>Can we control which of our staff can use the tool and what it can access?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Security and incidents\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>What security practices and independent assessments does the vendor describe?\u003C\u002Fli>\n\u003Cli>How and how quickly will the vendor tell us about an incident that affects our data?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cstrong>Continuity\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Can we export our data?\u003C\u002Fli>\n\u003Cli>How much notice is given before terms or features change?\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Step 4: Read the answers critically\u003C\u002Fh2>\n\u003Cp>Look for clear, specific, dated statements. Be cautious about:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>Vague phrases such as "may use data to improve our services" without detail.\u003C\u002Fli>\n\u003Cli>Answers that apply to a different plan from the one you would buy.\u003C\u002Fli>\n\u003Cli>Promises made in marketing materials but absent from the contract.\u003C\u002Fli>\n\u003Cli>Terms that allow the vendor to change conditions without notice.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If a point matters to you, get it in writing in the contract or an official document, not only in a sales call.\u003C\u002Fp>\n\u003Ch2>Step 5: Test the settings, not just the documents\u003C\u002Fh2>\n\u003Cp>Where possible, run a trial with fictional or public data and check the real settings. Look for options to turn off training use, set retention periods, restrict who can use the tool, and export or delete data. Confirm that the settings behave as described.\u003C\u002Fp>\n\u003Ch2>Step 6: Compare the risk with the benefit\u003C\u002Fh2>\n\u003Cp>Match the vendor's answers against the data you listed in Step 1. For each type of data, decide whether the tool is approved, approved with limits, or not approved. For example, a tool might be fine for drafting public announcements but not for customer records.\u003C\u002Fp>\n\u003Ch2>Step 7: Record the decision and set a review date\u003C\u002Fh2>\n\u003Cp>Write a short note covering the tool, the plan, the date, the documents you reviewed, the answers you received, and your decision with any limits. Store it with your AI tool list. Set a review date, because terms, features, and data practices change over time.\u003C\u002Fp>\n\u003Ch2>Vendor check checklist\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Data types and any contractual limits listed.\u003C\u002Fli>\n\u003Cli>Governing documents collected, dated, and matched to your plan.\u003C\u002Fli>\n\u003Cli>Training use, retention, location, access, and incident questions asked.\u003C\u002Fli>\n\u003Cli>Answers confirmed in official documents, not only by sales staff.\u003C\u002Fli>\n\u003Cli>Settings tested with fictional or public data.\u003C\u002Fli>\n\u003Cli>Approval decision made for each data type.\u003C\u002Fli>\n\u003Cli>Decision and evidence recorded, with a review date.\u003C\u002Fli>\n\u003Cli>Legal review requested where personal or regulated data is involved.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2>Frequently asked questions\u003C\u002Fh2>\n\u003Cp>\u003Cstrong>Is a free plan treated differently from a paid one?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Often yes. Free and consumer plans may allow broader use of your data than business plans, so check the plan you will actually use.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Do I need a lawyer for every tool?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>No. Use the checklist for routine tools, and bring in an adviser when personal data, regulated information, or significant spending is involved.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>What if the vendor will not answer?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>Treat unanswered questions as risks. Limit the tool to low-risk data or choose another vendor.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>How often should we repeat the check?\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>At least once a year, and whenever the vendor changes its terms, adds major features, or changes how it handles data.\u003C\u002Fp>\n\u003Ch2>The practical next step\u003C\u002Fh2>\n\u003Cp>Choose one AI tool your team already uses and run it through the core questions this week. Write down the answers and the decision, and add them to your AI tool list.\u003C\u002Fp>\n\u003Cp>For wider context, read \u003Cem>AI and Organizational Intelligence\u003C\u002Fem>. Related reading: \u003Cem>How do you build an AI tool inventory in one afternoon?\u003C\u002Fem> and \u003Cem>How do you tell a real AI product launch from an announcement before you buy?\u003C\u002Fem>\u003C\u002Fp>\n\u003Ch2>Sources and review\u003C\u002Fh2>\n\u003Cp>This article contains editorial guidance and does not rely on external statistics, product claims, or legal claims.\u003C\u002Fp>\n\u003Cp>Factual review: 5 November 2026. Implementation steps are editorial recommendations. This article is not legal advice.\u003C\u002Fp>\n","Pratiksha","2026-11-05",1793885122000,[18,19,20,21,22],"AI vendors","data protection","AI procurement","AI governance","risk management",null,false]