Review an AI vendor's data handling before connecting business records

Describe the service and the information it will receive

Record the intended use, user groups, data categories and connected systems. Identify personal information, confidential business content and any sector-specific restrictions. Separate optional features from essential processing so the review does not accidentally approve a broader deployment than the business needs.

Draw a simple flow from the source system through the AI application, model provider, storage and output destination. Include operational logs, support access and failed requests. Ask whether staff can use the service effectively with less data, redacted examples or a narrower document collection.

Ask separate questions about training and retention

Confirm whether inputs or outputs are used to train models, whether that setting can change, and which terms govern it. Then review retention for prompts, files, application state, logs and abuse monitoring. An account-level statement may not cover every endpoint or connected feature.

OpenAI's data-control documentation illustrates why these questions need to be separate: it describes API training treatment and feature-dependent data controls. Use the applicable vendor documentation and contract for your own service. Do not turn a general provider statement into a claim that the complete business workflow stores no data.

• Identify the exact product, subscription and enabled features.
• Record deletion behaviour, limitations and who initiates deletion.
• Check whether tool providers receive additional copies.

Evaluate responsibilities and evidence

Review the relevant processing agreement, subprocessor information, security evidence, incident process and arrangements for access or deletion requests. Verify the entity and service scope on certifications or assurance reports; evidence for one product or hosting layer does not automatically cover another.

For UK personal-data processing, use current ICO guidance and involve the organisation's responsible privacy lead where needed. The ICO states its AI guidance is under review following legislative change, so check current requirements before relying on an older checklist. This page is a practical procurement aid, not a determination that a particular deployment is legally compliant.

Turn the decision into configuration and review

Document which uses are approved, which data is excluded and which features must remain disabled. Set organisational accounts, appropriate permissions and a route for users to report unexpected behaviour. The procurement decision should result in settings and operating responsibilities that someone can verify.

Revisit the review when a new connector, data category, geography or major feature is introduced. Keep the evidence date and the reason for approval with the service record. If a material question remains unanswered, narrow the pilot to non-sensitive test data or defer that part of the rollout rather than treating uncertainty as assurance.