Decide if Company Data Should Be Used to Train an AI Model

TL;DR — Do not start with "can the model learn from our data?" Start with "what exact data, for what exact model, under what contract, and with what customer promise?" The most common correct outcome is: only use data for training if it is explicitly approved, stripped of personal and confidential information, and your provider settings and contract both say it will be used that way. Reading time: ~5 min

Goal

When you finish, you will have a written yes/no decision on whether your company data may be used to train a model, a list of which data is in or out, and proof that your vendor settings, internal approval, and customer commitments all match that decision.

Prerequisites

• Access to your AI provider's admin dashboard, billing page, and terms or data-processing pages
• Access to your contract, order form, or data processing agreement (DPA, a privacy contract) with the provider
• Your company's privacy policy, customer contract template, and any security policy that mentions AI, analytics, or data sharing
• One person from legal, privacy, security, or compliance who can approve the final decision
• A list of the data you plan to send to the model, with 3-5 real examples copied into a document
• If regulated data may be involved: the rule set that applies to you, such as GDPR (EU privacy law), HIPAA (US health privacy law), or PCI DSS (payment card security standard)
• Optional: spreadsheet software or a shared doc to fill in the decision table below

Steps

Step 1: Write down the exact training question

Create a one-page note with these exact headings and fill them in with literal values:

Use case:
Model type:
Provider:
Will data leave our systems? Yes/No
Data examples:
Contains customer data? Yes/No
Contains personal data? Yes/No
Contains confidential business data? Yes/No
Requested outcome: Allow training / Do not allow training
Decision owner:
Decision date:

What you should see when this succeeds: one document exists with every line filled in, not left as "TBD".

Step 2: Classify the data you want to send

Copy this table into your doc or spreadsheet and mark every row with Yes or No.

Use these literal rules while filling it in:

If the data identifies a person, mark "Use for training? = No".
If the data includes customer content not already approved for reuse, mark "Use for training? = No".
If the data is confidential and would harm the company or a customer if memorized or leaked, mark "Use for training? = No".
If the data is already public and owned by your company, mark "Use for training? = Yes" only if legal/privacy approves.

What you should see when this succeeds: every planned data source has a Yes/No answer in the "Use for training?" column.

Step 3: Check what your provider says it does with data

In your provider's dashboard, open the admin or account settings area and look for data usage, privacy, model improvement, retention, or training controls. Common menu paths vary by vendor, but usually look like one of these:

Provider dashboard → Settings → Data controls
Provider dashboard → Admin → Privacy
Provider dashboard → Organization → Security → Data usage
Provider dashboard → Billing or Legal → Terms / DPA

Record these exact values in your note:

Training on our prompts/inputs: On / Off / Not stated
Training on outputs: On / Off / Not stated
Retention period: <number of days> / Not stated
Zero-retention option available: Yes / No
Enterprise no-training terms available: Yes / No

What you should see when this succeeds: your note contains actual provider answers, not assumptions like "I think enterprise plans are private".

Step 4: Compare the provider terms to your customer promises

Open your privacy policy, customer contract, and security commitments. Search for these exact words:

train
model improvement
subprocessor
third party
customer data
confidential
machine learning
artificial intelligence
analytics

Then write one line under each document:

Privacy policy result: Allows / Forbids / Silent on provider training
Customer contract result: Allows / Forbids / Silent on provider training
Security policy result: Allows / Forbids / Silent on provider training

What you should see when this succeeds: you can point to the exact document that allows or blocks training use.

Step 5: Make the decision with this rule set

Use this exact decision matrix:

Now add this exact line to your note and fill in the final value:

Final decision: Allow training / Do not allow training
Reason: <one sentence tied to the matrix above>
Approved by: <name>

What you should see when this succeeds: a single final decision exists, with an approver's name.

⚠️ If your decision is "Do not allow training," change the provider setting before any team member sends production data. Waiting until later can create a policy violation you cannot undo.

Step 6: Enforce the decision in the provider

If the decision is "Do not allow training," in your provider dashboard turn off any setting labeled like these:

Use our data to improve models = Off
Allow training on prompts and completions = Off
Model improvement = Disabled
Feedback sharing = Off
Conversation history for training = Off

If the dashboard has no such control, send this exact message to your provider contact or support channel:

We require written confirmation that our inputs, outputs, files, and metadata will not be used to train or improve any shared or provider model. Please confirm the applicable contract terms, retention period, and whether this applies to all users in our account.

If the decision is "Allow training," record exactly which datasets are approved:

Approved for training:
- Public website pages
- Published help-center articles
- Product documentation owned by our company
Not approved for training:
- Customer messages
- Support tickets
- CRM exports
- Source code
- Files uploaded by customers

What you should see when this succeeds: the dashboard shows training-related toggles set to Off, or you have written provider confirmation; if training is allowed, the approved dataset list is explicit.

Step 7: Save the decision where your team will actually use it

Put the final note in your shared policy location, then send this exact internal message in email or chat:

AI data training decision
Final decision: <Allow training / Do not allow training>
Approved datasets: <paste list>
Blocked datasets: <paste list>
Provider setting checked on: <date>
Owner: <name>
Before sending a new dataset to any AI tool, reply in this thread with the dataset name and owner.

What you should see when this succeeds: your team has one link to the decision and one message they can refer back to.

Verify it works

Use this checklist end to end:

1. Open the provider dashboard and confirm every training/model-improvement toggle is set to Off if your decision was "Do not allow training".
2. Open the contract or provider confirmation and confirm the words "not used to train" or equivalent are present.
3. Open your decision note and confirm it contains: Final decision, approved datasets, blocked datasets, approver name, and date.
4. Ask one teammate to review a sample dataset against the table in Step 2 and confirm they reach the same result.

Expected result:

- Dashboard setting matches the decision
- Contract/confirmation matches the dashboard setting
- Internal note matches both
- A second reviewer reaches the same yes/no answer

Common pitfalls

Treating "we do not store data" as the same as "we do not train on data"

Mistake: Reading a retention statement and assuming it also blocks model training. Symptom: The provider says data is deleted after a period, but terms still allow model improvement. Fix: Check both values separately and write them down as "Retention period" and "Training on our prompts/inputs".

Assuming enterprise or paid plans automatically disable training

Mistake: Believing a higher-priced plan means no training use by default. Symptom: You cannot find written no-training language in the dashboard or contract. Fix: Open the admin settings and legal terms, and record the exact training value as On, Off, or Not stated.

Calling data "anonymous" when it is only lightly edited

Mistake: Removing names but leaving ticket IDs, rare events, or company names that still identify people or customers. Symptom: Reviewers disagree on whether the dataset is safe for training. Fix: If a person or customer could still be identified, mark "Use for training? = No" and treat it as confidential.

Forgetting customer contracts and privacy notices

Mistake: Looking only at the provider's settings. Symptom: The dashboard allows training, but your own contract or privacy notice forbids reuse. Fix: Search your documents for "train," "machine learning," "customer data," and "confidential," then record Allows/Forbids/Silent.

Approving a broad category instead of a specific dataset

Mistake: Writing "support data is approved" without separating public FAQ content from private tickets. Symptom: Team members send raw customer conversations because they think the category was approved. Fix: List approved datasets by name, such as "Published help-center articles," and list blocked datasets by name, such as "Support tickets."

This article was written by an AI system and published pending human review. Verify anything you intend to act on.