Most businesses are using AI already, whether or not anyone made a decision about it. Someone signed up to summarise meetings, someone else uses it to draft proposals, and a third person has been feeding it spreadsheets since January.
The interesting question is not whether your team should be using these tools. It is what was agreed to when they signed up.
Start with the terms
Vendor terms vary enormously, and they vary between tiers of the same product. Free and consumer versions often permit the provider to use what you type to improve its models. Business and enterprise versions frequently do not, or allow you to switch it off. Which of those applies to you may come down to which button somebody clicked while setting up an account on a Tuesday afternoon.
Beyond training, there are a few questions worth answering for any tool that touches material you care about. How long are inputs retained, and can you delete them? Does anyone at the provider review what you submit? Has the provider given a meaningful confidentiality commitment? And where is the processing actually happening, including any sub-processors sitting behind the service?
Providers also change their terms, sometimes at short notice and sometimes in ways that alter the answers above, so this is not a question you answer once.
Where it collides with promises you have already made
This is the part that catches people. There is no single UK statute governing how businesses use AI, so the rules that live here are the ones you were already subject to, and the risk sits in the contracts you signed long before AI was on the agenda.
Your client agreements almost certainly contain confidentiality obligations, and many restrict disclosing client material to third parties or bringing in subcontractors without consent. Putting a client’s confidential document into a tool that retains it, or that uses it for training, can sit very badly against those obligations, regardless of how useful the output is.
Data protection applies in the same way it applies to any other processing. If personal data is going into a prompt, you need a lawful basis for it, you need to have told people about it, you need an appropriate contract with the provider, and you need a view on where the data is going. It is worth working out what role the provider is really taking, because a supplier that uses your inputs to train its own models is not simply acting on your instructions.
Then there is what comes out. The obligation to be right remains yours. If an output goes to a client under your name, it is your work, and someone needs to have checked it. It is also worth understanding what the terms say about ownership of outputs, and whether the provider stands behind them if a third party complains about what was produced.
Five practical steps
Firstly, find out what is actually being used, including the tools nobody formally approved, because you cannot govern what you have not mapped.
Secondly, check the tier and the settings rather than the marketing page, since the protections you want often exist but are not switched on by default.
Thirdly, write an internal policy that people can actually follow. A couple of pages that says what may go into which tools beats twenty pages nobody opens.
Fourthly, decide what must never be pasted into a general-purpose tool, and say so plainly. Client confidential material and special category personal data are the usual candidates.
Fifthly, write down the decisions you have made and when you made them. If a client, an insurer or a regulator asks how your AI use is governed, a dated record is worth a great deal more than a good memory.
None of this is an argument against using AI. Used deliberately, it is genuinely useful, and businesses that avoid it entirely are giving up ground for no good reason. The goal is to use it knowing what you have agreed to, rather than finding out afterwards.
Our AI Audit is a fixed-fee review of what AI is actually doing inside your business, including the tools in use, the data going into them, the terms behind them, and a prioritised plan for anything that needs attention.
This blog is for information purposes only and does not constitute legal advice. We recommend seeking professional advice before taking any action on the information provided.
