For a professional-services firm, the practical question is whether an AI provider can use prompts, uploaded files, retrieval data, or outputs to train or improve its models. The answer affects client confidentiality, contractual commitments, procurement, and the evidence you can give a client or auditor.
Start with the exact service and account configuration
Do not rely on a vendor's broad marketing statement. Record the product name, plan, region, account settings, and the date checked. Training and retention terms can differ between consumer, team, enterprise, API, and managed-service products. Capture the relevant contract, data-processing terms, security documentation, and the configuration screen that controls data use.
Build a client-data decision record
Create an inventory of AI use cases that touch client information. For each one, identify the data type, provider, model, legal basis, approved users, retention setting, training setting, human reviewer, and the evidence location. This turns an uncertain vendor question into a repeatable control that a partner, client, or auditor can review.
Set the operational controls before adoption spreads
Where training use is not contractually excluded and evidenced, keep confidential client data out of the workflow. Use approved enterprise or API configurations, role-based access, a documented escalation route, and an AI acceptable-use policy that explains which data may be entered. Test the policy against real delivery workflows so staff have a safe alternative rather than an unusable prohibition.
Answer client and procurement questions with evidence
A useful response states the product configuration, the governing terms, the owner who reviewed them, and when the review will be repeated. Avoid an unqualified claim that a provider never trains on data unless your account, contract, and settings support it. A short evidence pack reduces sales friction and makes renewals, client due diligence, and incident review faster.
When to get help
If considering a Pattrn AI Risk & Efficiency Audit, agree which tools and client-data uses it will cover, the evidence available and the proposed deliverables. Confirm whether supplier-term review and implementation priorities are included; the service name alone does not establish that scope. For a focused next step, book a discovery call.