Who it suits

Anyone signing up for an AI tool, or being told that a tool they already pay for now has an AI feature built in.

The problem

Every software vendor is adding AI, including the ones behind your email, your document tool, your accounting package, and your scheduling app. Each addition changes where your data goes, and the announcement rarely says so in plain words.

You do not need to understand the technology to protect yourself. You need nine answers in writing. A vendor that serves small organizations well can answer these in a page. A vendor that cannot, or will not, has told you something too.

The checklist

  1. Is our data used to train or improve your models?

    You want a clear no, or a clear description of how to opt out and proof that the opt-out applies to your account.

  2. Who at your company can see our data?

    Ask whether that means support staff, engineers, contractors, or nobody, and whether access is logged.

  3. Do you send our data to another company?

    Many tools pass your text to a model provider behind the scenes. Ask who, and what that company's rules are.

  4. How long do you keep it?

    Ask about the content you enter, the outputs, and the logs. Ask what happens when you delete something and when you close the account.

  5. Where is it stored?

    Country and region matter for some clients and some laws. A plain answer is enough.

  6. Can we get our data out?

    You want it in a normal format, within a reasonable time, and without paying extra.

  7. What happens if you have a breach?

    How fast will they tell you, and in what form. Ask if that promise is written into the agreement.

  8. Can we turn the AI feature off?

    For the whole organization, not per person. If the answer is no, you cannot control it.

  9. Will you put all of this in writing?

    An email from your account representative is fine. A link to a marketing page is not.

If you find a problem

If any answer is missing or vague, do not turn the feature on for anything involving client information. Use it for public material only, or not at all, until the answer arrives. Write down the date you asked. If a vendor never replies, that is the answer.