What do you do with my data when AI is involved?

Why the data question matters before AI goes live

If a provider uses AI on your data, ask which data goes to which tool, for what purpose, under which retention and training terms, and who checks the result. Get the answer for your contracted service, not a generic assurance.

For client, employee, financial or regulated information, ask the provider to identify the permitted task, data and controls. Compare its answer with the contract and workflow records before relying on it.

The safest answer: purpose-limited use, clear ownership and evidence

Ask the provider which purposes the agreement permits, which data the task needs and whether the relevant settings and terms exclude model training. Request the retention terms and review record for client-facing work. Identify who can explain the data used, the approval and the checks performed; do not assume those controls are in place from a general assurance.

Map your AI data risks before rollout

What should be documented for each AI workflow?

Use a control record to connect each AI task with its data, tool, permissions and review. The six fields below give a manager or client questions to check against the work performed.

• Data types: client files, personal data, financial records, privileged material, internal know-how or anonymised examples.
• Purpose: the business reason for using the data and the exact task the AI supports.
• Tool and vendor: the approved system, contract owner, data-processing terms and whether data is retained or used for training.
• Access: who can enter data, who can view outputs and who owns exceptions.
• Review: the human check required before the output reaches a client, customer, regulator or public channel.
• Evidence: logs, approvals, versions and decisions to compare with the stated controls.

How to answer clients without over-promising

A client-facing answer should state what the provider has checked: the agreed use, tools involved, retention and training terms, and review before an output is used. Support each statement with the applicable agreement, settings or records. If a point is unresolved, say what is unknown and who is investigating it instead of promising a control the provider cannot demonstrate.

Do not say "AI never touches client data" without checking the relevant workflows. Compare the written policy with the tools and records used for the service, including exceptions, before describing the practice to a client.

Keep AI governance evidence current

Controls that reduce data risk in day-to-day work

Put the approved-tool list, prompt guidance, confidential-data restrictions and escalation route where staff can use them during the task. Decide which records the workflow should capture and check that they are usable for review; automated logging is not evidence on its own that the controls worked.

• Classify AI use cases by data sensitivity and client impact.
• Maintain an approved-tool list with training and retention settings.
• Use redaction or synthetic examples where full client data is not needed.
• Require named review for regulated, legal, financial or client-facing outputs.
• For higher-risk work, agree how to record the prompt or task reference, source material reference, reviewer, version and final decision without unnecessary copies of sensitive data.

What leaders should ask before approving an AI data workflow

Before approving a workflow, ask who owns the data decision, which supplier terms have been checked, how errors are handled and where output review is recorded. Match the depth of review to the task, information and intended use rather than assuming every workflow needs the same prompt inspection.

Where a material answer is missing, pause the affected use and assign an owner to resolve it before approval.

Turn AI data controls into working implementation

Need a safer AI route for your firm?

If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.

• Map AI risk and opportunity
• Put usable AI governance in place
• Roll out AI with privacy and supplier controls
• See AI support for legal services