When you send data to an AI provider, the contract governs what happens to it. Review the specifics rather than relying on marketing statements. This is a checklist for discussion with your legal team, not legal advice.
Points to check
- Data use — whether your inputs and outputs are used to train models, and how to opt out.
- Retention — how long prompts and outputs are stored, and deletion on request.
- Location — where data is processed and by which sub-processors.
- Change notice — advance warning of model changes or retirements.
- Security evidence — audit reports and breach notification terms.
- Exit — data return and deletion at the end of the contract.
Get commitments in the contract. Settings and documentation can change; signed terms are harder to change.