Check how an AI service handles company data

Establish how an AI service will handle company information before sending it. You need to know what it processes, for which purposes, and who can access it at different stages.

Classify information around the task

Distinguish public instructions, internal information, trade secrets, and personal data. Ask what the task actually requires. A pilot can often use a prepared sample dataset instead of immediately transferring an entire customer register.

Removing a name does not always make data anonymous. The European Data Protection Board’s opinion on AI models (opens in a new tab) emphasizes case-by-case assessment of personal-data processing and anonymity in its EU context. Review the requirements for your use with your privacy lead or a specialist.

Ask the provider concrete questions

Ask whether inputs or outputs are used to develop models, how long they are retained, and where processing happens. Establish subcontractors, access rights, logging, and deletion practices. Check the terms of the specific service you are buying; products from the same supplier can differ.

Have the relevant agreements and responsibilities assessed before production use. A general promise of “safe AI” does not explain these details.

Define what users may do

Write brief instructions covering permitted information, approved services, and the contact for unclear situations. Agree who grants access and removes it when roles change. Define how outputs are checked before use too.

A limited customer-service pilot helps reduce the amount of data involved. But the word “pilot” is not a basis for approval by itself: requirements for processing real information must be assessed there too.