Before business data enters an AI tool, ask these questions
Before business data enters an AI tool, identify the task, classify the information and review how the provider will handle it. Check access, retention, training use, location and the need for human oversight. The right decision depends on the data and intended use, rather than the product’s general marketing description.
Put the advice into practice
Build a workflow your team can actually rely on
Connect systems and follow-up with agreed rules, human review and exception handling.
Discuss your workflowA team can begin with a harmless experiment and gradually introduce material that carries different obligations. A public brochure, an internal procedure and an identifiable client record should not enter a selection process as if they were equivalent.
Name the information before choosing the tool
List what the task needs and remove information that is unnecessary. Identify personal information, sensitive information, confidential commercial material and information the business is authorised to use only for a particular purpose. Include the output in the review, because a tool may generate personal or confidential information as well as receive it.
The OAIC’s guidance on commercially available AI products calls for due diligence, attention to data flows and appropriate oversight. It recommends against entering personal, particularly sensitive, information into publicly available generative AI tools as a best practice. Applicable obligations need to be assessed for the organisation and use.
Read the settings and terms for the actual product
Review the specific plan and configuration being considered. A brand may offer several products with different terms, retention controls or administrative features. Do not assume that a general statement about one version applies to every account.
Ask what information the provider and other parties can access, whether inputs or outputs may be used to improve models, how long information is retained and what happens when access is revoked. Record where the answer came from and who is responsible for confirming it remains current.
A practical review worksheet
| Area | Decision to document |
|---|---|
| Purpose | The task and the information genuinely required |
| Authority | Who may approve this use of the material |
| Data handling | Access, retention, training use and relevant locations |
| User access | Who can input information and retrieve the output |
| Accuracy | Which outputs require review before use |
| External effect | Whether the tool communicates, changes records or makes decisions |
| Exit | How access and retained information are handled if the tool is withdrawn |
An unanswered question is a useful finding. The team can reduce the proposed scope, seek a documented answer or choose a different approach. A worksheet should not manufacture confidence merely because every row has been filled.
An illustrative document-summary pilot
Imagine a hypothetical advisory firm wants to summarise internal meeting notes. The original proposal includes names, client details and unreviewed observations. A safer evaluation could begin with approved sample material that contains no real personal information and tests whether the summary preserves the important decisions.
The team can then assess whether the tool is suitable before considering a wider use. Removing names alone may not be enough to make real records anonymous; context can still identify people or organisations. The proposed data treatment needs review by the people responsible for privacy and confidentiality.
The example is deliberately limited. It does not establish that a particular tool is approved for client records or that a sample test resolves every obligation.
Keep the review active after selection
Set clear instructions for staff about permitted material and tasks. Make those instructions available where the tool is used, and provide a route for uncertain cases. A procurement decision is less useful if everyday users have to guess which information they may enter.
Review material changes to the product, configuration or use case. A tool approved to assist with public-content drafting is not automatically approved to make decisions using personal records. Keep the task boundary visible and require a fresh decision when it expands.
The objective is a deliberate adoption process: the business knows what it is asking the system to do, what information is involved and who remains accountable for the result. That foundation makes later automation decisions easier to assess.
