Before using an AI service for client work, a UK law, accountancy, insurance or advisory firm should establish what happens to prompts, uploaded files and outputs. Product labels alone do not answer whether content is used for training, how long it is retained or which parties may access it. Check the terms and settings for the exact service and account tier, then document the decision before confidential client material is used.
Check the service, account tier and evidence
Ask the vendor to clarify whether customer prompts, files or outputs are used to train or fine-tune models; whether the answer differs by plan or configuration; how content and logs are retained; and which subprocessors may receive it. Distinguish contractual commitments from configurable settings and general product descriptions. Record what you reviewed, the account tier, the date and the evidence source, as terms and settings may change.
Set a client-data boundary before a pilot
Until the firm has assessed and approved the relevant controls, keep confidential, privileged and personal client information out of the service. A bounded test may use public, synthetic or suitably anonymised material, after considering whether people or clients could still be identified. Define approved tools and uses, who can authorise an exception, and what staff should do if information is entered into an unapproved service.
Make the decision owned and reviewable
Assign an owner to maintain the vendor evidence and approved-use decision. Keep a dated record of the service tier, terms and settings checked, permitted data categories, decision rationale and review date. Use an approved account, provide a route for staff to raise uncertain cases, and require a competent professional to review material outputs before they inform advice or are sent to a client.
Review the decision when terms, models, retention controls or subprocessors change, or when the firm proposes a new use case. A Pattrn Data AI Risk & Efficiency Audit can help map use cases, data, owners and control gaps before wider rollout. Where ongoing ownership is needed, explore governance retainers. For help implementing an agreed, bounded use case, see AI implementation projects.
Source and scope
Source question: “Will the vendor use your prompts and documents to train or fine-tune models that serve other customers?” Source: Compyl, “Vendor AI questionnaire template”. This article provides an operational risk-check framework, not a legal determination or a claim that any vendor is compliant or non-compliant. Firms should have the appropriate privacy or legal owner assess their specific circumstances.