Business AI tools: check data controls before uploading company files

Start with the exact service and account

Write down the product, workspace type, region where relevant and the features you intend to enable. A consumer chat account, a managed business workspace and a custom application using an API can have different settings and contractual terms. Avoid copying a statement about one service into a buying assessment for another.

For a fictional design studio, the first use case might be drafting internal project summaries. Its input pack should identify whether source notes contain client names, unpublished designs or only approved public information. That inventory lets the owner decide what belongs in the pilot before any files are uploaded.

Separate training from storage

OpenAI’s API data guidance distinguishes training use from abuse-monitoring logs and retained application state. API inputs and outputs are not used for model training by default unless the customer opts in; some enhanced retention controls require eligibility and approval. Those statements should not be treated as a policy for every ChatGPT account.

Ask the selected supplier what it keeps for conversations, uploaded files, search indexes and operational logs. Record the applicable control, its default and who can change it. A switch described as not used for training does not, by itself, establish that an uploaded document disappears after the answer is produced.

Review permissions before connecting the file library

Microsoft’s Copilot privacy documentation explains that organisational grounding follows information the user already has permission to view. This makes the quality of the underlying permission model relevant to the rollout. An assistant can make an existing over-shared document easier to discover without creating the original permission problem.

For the studio, review access to the shared client folder before enabling a connection. Test with an ordinary staff account, a project contractor and an administrator. Use harmless sample files with obvious audience markers. Inspect the retrieved material as well as the final response; a polite refusal is not a substitute for checking the retrieval boundary.

Create a small control register

Keep the register short enough to maintain. Record the date and the selected plan, rather than a screenshot with no context. Where a supplier cannot explain a required control, leave the item unresolved and keep that data class outside the proposed use. Do not replace a missing answer with an assumption based on a product’s reputation.

Include connected systems and retained copies

A chat tool may reference a drive, create an export or pass information to another application. Draw those paths on one page. Identify which system is authoritative, which copies are created and whether the integration uses an individual identity or a shared connection. The account that installed a connector is not always the only person who can benefit from it.

Test a correction and a removal using the sample files. Then remove the test user’s access and inspect the resulting behaviour. Document any delay or separate deletion step. These observations describe the configured test; they do not establish regulatory compliance for every possible document or future configuration.

Make the purchase decision around a permitted workflow

Choose the narrow workflow the team can operate with named owners and documented settings. Add review time, administration and source maintenance to the subscription cost. Revisit the assessment when the company enables another connector, changes workspace type or introduces a materially different data class.

Use the small business AI pilot guide to define an initial task and the RAG versus fine-tuning guide when building an internal assistant. A useful buying result is an approved way of working with clear boundaries, rather than an unrestricted licence to upload everything.

Frequently asked questions