It depends on the data and the service

A common question is whether it is safe for an AI system to process company documents. The rigorous answer is that it depends on two factors: what information is processed and with which service. A public catalogue is not the same as a contract with client data, nor is a personal account the same as an enterprise service configured by the technical lead.

Before processing real information, I review the company’s internal policies and which services are authorised. To validate an idea, I use test documents without real data.

Training, retention and access are separate questions

The main providers state that, by default, they don’t use data from their enterprise services or API to train their models. That is relevant, but it doesn’t settle every question: you also need to know how long data is kept, where it is processed, who can access it and which integrated services receive it.

Those answers depend on the specific service contracted and its configuration. I am wary of general statements about “AI” that don’t refer to a specific service and account.

A custom system doesn’t remove the providers

Building your own system doesn’t by itself guarantee privacy. A custom application may still send information to an external provider for processing, so every component the data passes through must be reviewed: the model, the search database, technical logs and integrations.

When requirements demand it, there are alternatives: providers that process data within the European Union, models deployed on your own infrastructure or anonymising data before processing. Each option has cost and quality implications worth evaluating.

How I document it

Before putting a system into production I document which providers are involved, what data each one processes, where and under what conditions, and the legal basis for processing under the GDPR. If the system may fall into a category regulated by the EU AI Act, its specific obligations are reviewed too.

With that documentation, the company can decide with sound criteria what information each system processes and answer any question from a client or its data protection officer with confidence.

Further reading

If you want to make sure your AI systems meet your company’s privacy requirements, here is how I work, or book a meeting and we’ll look at your case.