Ask before you need it: what the supplier counts as an incident, how and how fast you’d be told, what the notice would contain, and who on your side acts on it.
Won’t they tell you if something happens?
Probably. The questions are when, what they’d say, and whether the notice reaches someone who can act.
1. What counts as an incident?
Data exposure, widespread wrong output, an outage, or a change in a provider behind the tool.
2. How would you hear?
Ask about the channel and the timing. Keep a current contact on your side, not the person who signed up three years ago.
3. What should the notice let you do?
See what was affected, know what to do now, and know when the next update comes.
Practical check: A promise on a sales call isn’t a commitment. Ask where it’s written.
4. Decide your side in advance.
Owner. Who reads the notice and decides what happens next?
Checks. What would you look at to see whether you were affected?
Actions. When would you pause the feature, and who tells staff or customers?
A fictional example.
- The notice
- Some uploaded files may have been visible to another customer.
- Your checks
- Is your account named? Which features were on, and who used them?
- The decision
- The owner pauses the feature until it’s confirmed.
Read more: Which Outside Companies See Your AI Data? · AI Agent Permissions: What Can Your Agent See and Do?
The example is fictional. This is general guidance, not legal advice.