The duty to protect your data stays with you, whichever vendors you use.
What it means
Using an AI vendor, a cloud service or an IT company doesn’t move your legal or contractual duties to them. If your AI says something wrong to a customer or leaks a record, it’s still your business’s problem.
A simple example
In 2024, a Canadian tribunal ordered Air Canada to compensate a customer after its website chatbot gave wrong information about a fare (The Register). Air Canada argued the chatbot was responsible for its own actions. The tribunal wrote: “It makes no difference whether the information comes from a static page or a chatbot.”
Closer to home, a school transportation company holds drug and alcohol test results for its drivers. Federal rules say those results can’t be released to third parties without the driver’s specific written consent, whichever software the company uses. Student information shared by a school district may be used only for the purpose it was shared.
Do it yourself
- Keep a list of every AI vendor and what data each one sees.
- Write down the big AI decisions and who approved them.
- Answer insurance and customer security questionnaires truthfully, based on what’s actually in place.
- Check each vendor’s terms on training, retention, storage location and who can see your data.
- Before customer information goes into AI, check your own contracts and privacy notice too. A client contract or NDA can forbid sharing or require consent.
- Know your field’s own rules. A medical office needs a business associate agreement that covers the AI product. A tax preparer needs the client’s signed consent before sharing tax return information with an outside service, unless a narrow IRS exception applies. If you’re unsure, ask your attorney.
- If you hold regulated records, also collect the documents listed under “Questions to ask any AI vendor”.
Questions to ask any AI vendor
- Is our data used to train or improve your models, and is that in the contract or only on a web page?
- How long do you keep our prompts, files and chats, and can we choose that or delete them?
- Who at your company can see our data, and when?
- Where is our data stored and processed, and which other companies process it for you?
- Does the AI respect our existing permissions, and can we limit it to read only and to specific folders, records or actions?
- Does each person connect with their own account, or does one key see everything?
- Can our people sign in through our identity provider, with multifactor authentication?
- What’s logged, who can see the logs, and can we export them?
- Can a person approve actions before they happen, and can we set spending limits per person?
- How and how quickly will you tell us about a security incident?
- If we leave, how do we get our data back, and how is it deleted?
If you hold regulated records, or your customers’ contracts ask for it, also ask for these documents:
- their customer terms, the contract you’re agreeing to;
- their privacy policy;
- a data processing agreement (DPA) or security addendum;
- their subprocessor list, the other companies that handle your data for them;
- their service level agreement (SLA);
- how they handle a breach, and how fast they’ll tell you;
- their written information security program (WISP), or a summary of it;
- a SOC 2 report;
- a summary of a recent outside penetration test.
How to check
Could you show an auditor, an insurer or a customer which AI tools touch their data, under what terms, and who approved them?
What that misses
The vendor list, the decisions and the questionnaire answers need an owner and regular updates, or they stop matching what’s actually in place.
What we do for you
We keep your list of AI tools and vendors and check their terms. When an insurance or customer questionnaire arrives, we help you answer it with what’s actually in place. The duty to protect your data stays with you, and so does the final say.
“What we do for you” describes work we do for our clients, and what’s included depends on your plan. Already a client? Your engineer can tell you what your plan covers.
Back to all rulesGet the full guide
Technology, managed by people.
The real McCoy: real oversight, real understanding, real answers. Start with a free AI Check.