AI Tools & MarTech Practical insights
Check AI tool retention and training terms before use
Build a procurement worksheet for AI data retention and model training, separating account settings, contractual promises, connectors and deletion rules.
A vendor statement that customer data is not used for model training answers only one procurement question. It does not explain storage duration, support access, connected services or deletion. Evaluate the exact product and account terms before approving a marketing workflow that contains personal or confidential information.
Separate the purposes of processing
Create worksheet rows for delivering the service, storing conversation history, security monitoring, product improvement and model training. Ask which data each purpose uses, whether it is optional and what the applicable agreement says. Do not assume that a consumer account, business subscription and API service have identical terms because they share a brand.
Map retention through the whole workflow
Record retention for prompts, uploaded files, outputs, logs and backups where documented. Include the connector provider and any external system that receives a result. Deleting a conversation may not delete a source file or a copy written elsewhere. Ask for clear explanations of exceptions and deletion timing instead of interpreting a single privacy toggle as a complete data lifecycle.
Attach evidence to every answer
Save the relevant documentation date, contract clause and account setting. Mark unresolved questions for the privacy or security owner. The EDPB’s AI-model opinion emphasizes case-specific assessment, including whether personal data is involved and the relevant legal basis. [1] A vendor’s training setting alone therefore does not settle the organization’s GDPR responsibilities.
Approve a bounded use case
Test with fictional information while the worksheet is reviewed. Define the permitted data categories, responsible owner and triggers for reassessment, such as a new connector or changed contract. This is a procurement method, not a legal clearance. Where personal data is involved, have the appropriate specialist assess the actual processing before the team expands access.
Sources and evidence
Sources checked on 4 October 2026. Proposed workflows and hypothetical examples are editorial analysis.
From insight to practice