Start with the purpose and minimum information
Describe what the AI application should help accomplish. Improving general copy requires different information from analysing a customer file. Ask which information the task actually needs. Could you first investigate the approach with a fictional example or public information?
Using less data can simplify the assessment, but does not replace checking confidentiality and authority. Removing a name does not automatically make a document anonymous. A combination of amounts, roles, locations or events may still reveal information about a person or organisation. The EDPB explains why pseudonymisation and anonymisation are different [E2].
Check the specific setup
Record the service, account and subscription being used. A personal account, business account and API connection may have different terms. An API is a way for software to exchange information; the term itself says nothing about where that information stays.
A business AI tool may use additional models, search services or integrations. Check not only the name on its homepage, but also the components enabled for the intended task. The terms of one component do not establish the terms of every other component.
Data use involves separate questions
Documentation for business Microsoft Copilot describes storage of prompts and responses alongside terms concerning model training [M2]. No model training therefore does not automatically mean no storage. Also check whether web search, an additional AI assistant or an integration involves other services. This is not an assessment of your account.
Also check logging: what information is retained to investigate usage or failures? Who can see it? What can an administrator delete or export? This article cannot establish your account configuration. Missing answers need investigation before using the relevant information.
On a narrow screen, scroll the table sideways. With a keyboard, focus the table and use the arrow keys.
| Area | What to have specifically confirmed |
|---|---|
| Training | Which data is used for which purposes under the terms for this product and account? |
| Storage and processing | Where are documents, prompts and responses stored and processed; are there exceptions? |
| Access and third parties | Which colleagues, suppliers, connected services and model providers may process data? |
| Logging and retention | What is kept for use or error investigation, for how long and who can delete it? |
| Export and termination | What can you take with you, what is deleted and which exceptions remain? |
Three fictional situations
Public product copy: an employee wants to shorten a public description. Check that the information really is public, that you may use it and that the draft remains accurate. Do not accidentally include internal comments or customer information copied from another document.
Internal revenue report: a manager wants a summary of changes. Assess who may see the figures, which details are necessary and which environment is approved for them. A report without names may still be commercially sensitive. An existing report or an aggregated fictional example may initially be sufficient to test the approach.
Customer or personnel file: this may contain sensitive or identifiable information. An employee cannot decide that input is appropriate solely because the tool has a business licence. Ask the responsible owner and, where needed, a privacy or security specialist to assess purpose, authority and configuration. This example gives no general permission to use such files.
What does inside your organisation mean?
No model training means that, under the applicable terms, information is not used to train models. It does not automatically mean nothing is stored. Regional processing concerns locations; other organisations may still be involved within that region.
A private cloud environment is an environment configured for your organisation with a cloud provider. Fully local processing is different. Even local processing requires attention to permissions, management, logging, updates and human mistakes. Do not treat these four properties as interchangeable security promises.
Read the terms for the actual situation
Lleverage’s DPA distinguishes paid subscriptions from the test environment. Its described EU-only option for paid plans requires a written request and may limit features [L1]. Check the applicable agreement and enabled options. These terms do not establish that data stays inside your company or that the same arrangements apply to a test.
A DPA is an agreement about processing, not evidence that every setting in your environment is correct. Check which agreement applies, which additional suppliers are involved and how changes are communicated. Mentioning a supplier here does not establish a partnership or an implementation delivered by Boermans Digital.
When should you ask first?
Pause the intended input if the origin, rights or terms are unclear. Discuss what information is needed, who can authorise its use and which environment fits. The decision might be to use less information, choose an approved existing application or carry out the task without AI for now.
The European Commission describes information organisations must provide to individuals about processing [E1]. This article is not a legal assessment of your application. Questions about legal basis, contractual confidentiality or sensitive information require assessment of the actual situation, not a universal checkbox.
Make a short decision note
Record the task’s purpose, necessary information, chosen service and account, checked terms, unanswered questions and decision owner. Note when the terms were examined. New models or connections may change the assessment.
For an initial advice request, share only a description of the situation. Do not send customer files, personnel information, passwords or confidential system documentation. Agree additional investigation separately; an exploratory conversation is not a complete privacy or security audit.
Frequently asked questions
- Does no model training mean no storage?
- No. Training, storage and logging are separate uses of information. Check the terms for each.
- Does a business AI tool keep everything in-house?
- There is no universal answer. The provider, account, setup and additional services determine the processing involved.
- Can I use a document after removing the names?
- Not automatically. Information can remain confidential or identifiable without names. Assess the actual situation.
Sources and conditions
Official documentation checked on 12 October 2026. Capabilities and terms depend on the product, account, subscription and setup. No customer account or supplier agreement was tested.
Discuss your needs
All exploratory conversations are free of charge and without obligation. The first conversation takes about 30 minutes. Further work follows separate agreement on scope and costs. An enquiry is not a confirmed appointment.
Discuss your needs