Vendor reuse of organisation data

What it is

What an organisation sends to an AI provider is valuable to the provider as training material. Terms differ by provider, by product tier and over time: some exclude customer data from training by default, some include it unless the customer opts out, some permit human review of conversations for safety or quality. The risk is that data is reused under terms nobody read, or under terms that changed. Once data has been used to train a model it cannot practically be withdrawn.

How it happens

• Staff use a consumer tier whose terms allow training on inputs.
• The default setting permits reuse and nobody changed it.
• The provider amends its terms and the notice goes unremarked.
• A supplier passes data to its own model provider under different terms.

Why it matters

Confidential information may be learned by a model that competitors also use. For personal data, the organisation has enabled a new purpose with no lawful basis and no transparency. Contractual and professional duties of confidentiality to others may be breached.

Warning signs

• Nobody can state the data-use terms for each AI provider.
• Training opt-outs have not been checked in product settings.
• Different teams use different tiers of the same product.
• The contract permits the provider to change terms on notice.

Who owns it

The owner of the supplier relationship is accountable for the terms. Legal and the data protection officer review them. IT administrators apply the settings. Procurement tracks changes.

In practice

A law firm's staff use the free version of a transcription tool for meetings with the people it acts for. The tool's terms allow recordings to be used to improve the product. The same pattern generalises to any AI product adopted for its convenience before anyone read what it does with what it is given.