Preventing AI vendors from keeping client data starts before upload
To restrict a vendor from using client data for training, check the product-tier terms, negotiate the contract where needed, confirm settings and retention separately, and record which evidence supports each claim.
For confidential client work, decide what data the tool may receive before staff upload it. Record whether the contract permits training or other secondary use, and refer any proposed exception to the people responsible for confidentiality and data protection.
The safest approach is a written no-training control backed by evidence
Check the no-training term against the product tier you will use, then inspect the settings and the vendor’s retention evidence. Training restrictions, storage periods and support access need separate answers; switching off training does not answer the other two.
Collect the current data processing agreement, training terms, sub-processor list and deletion process. Ask the vendor to explain retention and support access for the selected workspace. Hold back confidential material while important answers are missing.
Check which AI tools are safe to use with client data
What the contract needs to say
Ask legal to review terms limiting processing to the agreed service and restricting model training or other secondary use. Check the coverage for prompts, uploaded files, outputs, logs, support tickets and metadata, including any human review.
Review deletion rights, breach notification, sub-processor changes and assurance rights alongside the training restriction. Make the permitted account or workspace clear so staff do not move client material into an unapproved consumer product.
What to check in the product settings
Inspect the available controls for training, chat history, analytics, support review and workspace retention. Save the approved settings with the vendor record, noting the product tier and review date. Use workspace-level controls where available so the decision does not depend on each user remembering it.
Check which enterprise, region and access controls the product actually provides. Assess SSO, role-based access and data loss prevention against the workflow, and keep personal accounts or browser plugins outside client work unless they have been reviewed for it.
The governance process should be practical, not theoretical
Start the review with the data staff want to upload and the users who need access. Record the allowed use cases, training terms, retention periods and upload restrictions. Recheck those decisions when the contract, model, product tier or sub-processor list changes.
Name one owner to maintain the vendor record. Legal, risk, information security and operations can review their respective issues, with unresolved points and the final approval recorded in the same place.
Put lightweight AI vendor governance in place
A simple control checklist
- Ask whether prompts, uploads, outputs, logs or feedback may be used for training or another secondary purpose.
- Record the training setting for the selected product tier and whether an administrator can enforce it.
- Check retention and deletion separately for user content, system logs and support records.
- Confirm who can access client data, including support reviewers, contractors and sub-processors.
- List the approved use cases and the data staff must not upload.
- Keep the reviewed terms, settings evidence and vendor assurance material with the approval and review owner.
What to tell staff
Tell staff which tools are approved for each type of client data and where to ask about an unapproved use. Until it is reviewed, keep confidential, privileged or regulated material out of the tool. Removing names alone is not a reason to treat client matter details as safe to upload.
Make the approved workspace and escalation route easy to find, so staff can check a proposed upload before sending it.
Conclusion
An approved vendor list needs evidence behind each entry and upload rules staff can follow. Keep the contract decision, settings and review owner together so a product change prompts a fresh check before the same data is used again.
Build the approved AI tooling process for your team
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.