Ask the vendor which other companies handle what you put into its AI features, what they keep and for how long. Write the answers down before you need them.
The tool is approved, so isn’t that enough?
Approval covers the tool you can see. The AI feature inside it may send your information to a company you never chose.
1. Ask who else handles it.
The provider. Which outside AI provider sits behind the feature, and where is the information processed?
Use. Is what you send used to train or improve anything?
Retention. What is kept, such as prompts, chat history and uploaded files, and for how long?
Practical check: If the vendor says it doesn’t share data, ask what that covers.
2. Keep a short record for each tool.
A fictional record:
- Tool
- A shared notes workspace.
- AI feature
- Summarizes pages and answers questions across the workspace.
- Passed to
- An outside AI provider, named in the vendor’s list.
- Kept
- Chat history for 30 days.
- Owner
- The office manager.
3. Turn off what you don’t use.
Some AI features are on by default. If nobody needs one, switching it off removes a route your information could take.
4. Ask how you’ll hear about changes.
The list of companies behind a tool can change. Find out how the vendor announces a change, and who on your side reads the notice.
Practical check: A record nobody updates stops being an answer.
Read more: Employee Data and AI Tools: Questions to Ask First · Asking an AI Supplier How Incidents Are Reported
The example is fictional. This is general guidance, not legal or security advice.