AI tool customer data: what to ask before connecting

An AI tool customer data request usually arrives as something ordinary: a CRM export, a mailbox connection, or a form archive full of names, emails, job history, and form answers. Before the first file moves, get written answers on training use, how long each copy is kept, what deletion actually removes, and how you turn access off. A useful answer names the product tier you are buying, every other company that will see the records, and a test you can run on a sample file. A demo line that the vendor takes privacy seriously is not that answer.

Name the records before you name the tool

List the systems the tool would touch, then the fields. Drafting a reply might need the last message and the customer's name. It does not need every closed job from years ago, a tax ID buried in an old note, or people who already asked you to delete their information.

The UK Information Commissioner's Office, in AI guidance it currently marks as under review, says you must not collect personal data on the off chance it might be useful later. A hope that it will help some future prediction is not, by itself, a reason to keep it. [8] The tool can reach forgotten exports and old form archives you still store.

NIST's AI Risk Management Framework 1.0 (2023) is marked on NIST's site as under revision. The published Core still says to map risks for every component, including third-party software and data. [4] Write down three parties: you, the app vendor, and the model host if that is a different company. If you cannot name the model host, you are not ready to connect.

On our team, we also write the job in one sentence. "Summarize open form submissions from the last 30 days" is a job. "Connect the CRM so the AI can help" is not. If the access request is wider than that sentence, narrow the request.

Ask whether the records will train a model

Settle this before the export. A later deletion request may not pull a customer back out of a model already trained on the file.

Ask, in writing, for the exact product you will buy:

• Will prompts, uploaded files, outputs, or derived data train, fine-tune, or otherwise improve any model?
• Does that include a general model, a model shared with other customers, or a subcontractor's model?
• Is that use off unless you opt in, or on unless you opt out?
• Can the vendor's staff or contractors read the records, and can you turn that review off?

A useful answer is a yes or no on each line, in the contract or the data processing addendum. API terms, a chat product, and a business plan often disagree. Ask which document wins.

The Federal Trade Commission has said that companies selling model access can break the laws it enforces if they drop privacy commitments. That includes a promise not to use customer data to train or update a model, directly or through a workaround. In past cases the FTC has required deletion of products built on unlawfully obtained consumer data, including models and algorithms, not only the files. [1] That remedy comes after a violation. Do not assume you can untrain a model later. Prohibit unwanted training before the file moves.

NIST's July 2024 Generative AI Profile lists data privacy as its own risk: leakage and unauthorized use, disclosure, or de-anonymization of personally identifiable or other sensitive information. It says training generative systems on personal data puts pressure on transparency, on consent and other individual participation, and on limiting use to a stated purpose. Models may also leak, generate, or correctly infer sensitive information, including by memorizing training examples that appeared only a few times. [3] "We deleted the file" and "the model cannot reproduce that customer" are different sentences. Get the vendor to say which one it can stand behind.

Federal buyers already force a version of this clause. OMB Memorandum M-25-22 (April 3, 2025) tells agencies that AI contracts should permanently prohibit using non-public agency inputs and outputs to further train publicly or commercially available AI algorithms, unless the agency explicitly consents. Vendors should collect and retain agency information only when reasonably necessary for the contract. [10] The memo binds federal agencies, not a private shop. It is still the shape to ask for: no training of a public or commercial model on your records or the tool's outputs unless you agree in a separate writing.

Ask who else can open the file

The company on the invoice is rarely the only one in the path. A cloud host, a model provider, a logging service, or a support contractor can each hold a copy.

NIST's Govern function calls for policies on AI risks from third-party software and data, and a way to handle failure in a high-risk third-party system. Its Manage function says to keep monitoring third-party risk, not to check it once at signup. [4] NIST Special Publication 800-53 Revision 5 adds the operational point: when an outside provider runs the service, you do not control how it builds the safeguards, and responsibility for the risk stays with you. [11]

Where UK data protection law applies, or the paperwork is written to that standard, Article 28 of the UK GDPR is the contract checklist. It is the UK's maintained text of the 2016 regulation, not a new American statute. The controller uses only processors that can protect people's rights. The contract must require the processor to follow documented instructions, to add another processor only with written authorization, and to help answer people's requests. [7] A useful answer is the current subprocessor list, the countries where records are stored or processed, and notice before that list changes. "Industry-standard partners" is not a list.

The FTC Safeguards Rule, 16 CFR part 314, is narrower than it sounds. It applies to financial institutions under FTC jurisdiction, not to every small firm. [5] Where it applies, you must select service providers that can safeguard the customer information, require those safeguards by contract, and reassess them as the risk changes. If a vendor serves as the qualified individual running the security program, you still own compliance, and a senior person on your side still oversees that vendor. [6] If the rule does not cover you, do not treat that as a reason to skip the contract.

Ask how long each copy stays

Retention is not one clock. Ask for a number of days for the uploaded file or the mailbox being read, for prompts and outputs, for logs (including any safety or abuse log), for derived data such as embeddings or an index, for backups, and for copies a support agent downloads. "As long as necessary" is not an answer. "For the life of the account" is not either, unless you know what happens on the day you cancel and how far backups lag behind.

The ICO minimisation guidance, also marked under review, says training and test copies get moved and duplicated, so they are easy to lose. Record those moves, and delete intermediate files once they are no longer required. Its example: if a model is built to use only the last 12 months of data, the schedule should say older data is deleted. [8] Use the pattern even when 12 months is not your number. Pick the window the job needs and ask the vendor to match it, or to name the copy it cannot shorten.

Covered financial institutions have a harder clock. The Safeguards Rule requires disposal of customer information no later than two years after it was last used to provide a product or service to that customer, unless you still need it for business operations or another legitimate purpose, law or regulation requires you to keep it, or targeted disposal is not reasonably feasible because of how the information is stored. You must also review the policy so you are not keeping data you do not need. [6] That duty sits on the institution. The same section requires service-provider safeguards by contract, so the contract needs a disposal schedule rather than a vague promise to keep data safe. Connect the tool to records you are allowed to keep, not to a pile the rule already says to thin out.

Do not demand destruction of records other law tells you to hold. NIST control SI-12 says to manage and retain information, and system output, in line with applicable laws, regulations, and policies. [11] A tax rule or an employment rule can outlast the vendor's preferred window. The goal is a schedule with reasons.

Ask what deletion removes

Ask which stores are wiped: the live system, logs, backups, indexes, and derived data. Ask when backups age out. Ask for written confirmation with a date. Then ask the follow-up that matters: if a record was used to train or fine-tune a model, what can be removed from that model, and what cannot?

Where Article 28 applies, the processor, at your choice, deletes or returns the personal data when the service ends, and deletes existing copies unless the law requires storage. [7] "We will delete or return the records within 30 days of a written request, including backups, and confirm in writing" is an answer. "In the ordinary course" is a delay. A longer hold is an answer only if it names the log, the reason, and the outer date.

The ICO's line on models surprises owners. Erasing one person from a training set does not, by itself, require erasure of every model trained on that set, unless the model contains the data or can be used to infer it. Rights still apply to personal data in the training set, in a prediction and its result, and in the model when the data is in it. You also have to tell people if their personal data will be used to train an AI system. [9] If the vendor cannot say whether a model could still produce a customer's email or job notes after the file is gone, do not send the file.

Terms move after signature. FTC staff wrote in February 2024 that it may be unfair or deceptive to loosen data practices, such as sharing consumer data with third parties or using it for AI training, and to tell people only through a surreptitious, retroactive edit to the terms or the privacy policy. A business that collected data under one set of commitments cannot drop them after it has the data. [2] You want notice in time to disconnect, not an email that the terms changed last week. A separate FTC staff post, from January 9, 2024, says that using consumer data for a new purpose without clear notice and affirmative express consent can break the law, including when the change is buried in fine print. [1]

Your privacy notice is a promise to the people in the file. The FTC treats promises in a privacy policy, in terms, and in promotional material as binding, and it treats a material omission about collection or use as its own problem. [1] If the notice says form answers stay with you and are used to answer the inquiry, a tool that trains a shared model on those answers makes the notice false. Change the notice first, in plain language, or do not connect.

Turn access off before the real export

Give the tool its own access, not a staff login. NIST's least-privilege control limits users, and processes acting for them, to what the task needs. [11] Reading one mailbox folder is not the same permission as exporting every contact, writing back into the CRM, and holding a token that never expires. Record who on your team may widen that scope.

Where the Safeguards Rule applies, access must be limited to the customer information someone needs for their duties, and multi-factor authentication is required for information-system access unless the qualified individual approves an equivalent or stronger control in writing. [6] Outside the rule, the same shape still helps: a token you can see, expire, and delete, not a shared password in a chat thread.

Test the off switch before the real export. Connect a fake contact or one old form you can stand to expose. Confirm the tool sees that record and not the rest of the database. Revoke the token or remove the app. Confirm the tool stops with an error, not a quiet cache of the real list. NIST's Manage function calls for an assigned way to supersede, disengage, or deactivate a system that behaves outside its intended use. [4] A connection you cannot find in an admin screen fails that test in practice. Revocation stops new reads. It does not delete copies already stored. That answer should already be in writing.

Ask who on the vendor's side can turn the integration back on, and whether support staff can act as your account. A useful answer names the role and the log you can request. Re-check the written answers at renewal and whenever a new model host or subcontractor appears. Third-party risk does not end at the signature. [4] If a new answer is worse than the one you accepted, the off switch you already tested is how you stop the next export.

Practical takeaways

• Write the job in one sentence and connect only the fields that job needs.
• Get a written yes or no on training and fine-tuning, for the vendor and each subcontractor, before any real customer file moves.
• Demand a retention time for files, prompts, outputs, logs, derived data, and backups. Reject "as long as necessary" with no clock.
• Ask what deletion covers, including backups, and whether a trained model can still surface the record after the file is gone.
• Use a separate, narrow token. Revoke it on sample data and confirm the tool fails closed before the real export.
• If you are a covered financial institution, apply the Safeguards Rule's access, disposal, and service-provider duties. If UK data protection law applies, use Article 28 as the contract checklist.
• Set the vendor's answer next to your privacy notice. If they disagree, fix the notice or skip the connection.

How we can help

Have more questions or want to get in touch? Tell us which tool is asking for the CRM, the inbox, or the form archive, and our team will help you sort the answers before a customer file moves. Reach us through the contact page.

Citations

1. Federal Trade Commission, "AI Companies: Uphold Your Privacy and Confidentiality Commitments" (2024-01-09)
2. Federal Trade Commission, "AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive" (2024-02-13)
3. National Institute of Standards and Technology, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" (2024-07-26)
4. NIST Trustworthy and Responsible AI Resource Center, "AI RMF Core" (2023)
5. eCFR, "16 CFR 314.1 Purpose and scope" (2026-10-19)
6. eCFR, "16 CFR 314.4 Elements" (2026-10-19)
7. legislation.gov.uk, "Regulation (EU) 2016/679, Article 28 Processor" (2016)
8. Information Commissioner's Office, "How should we assess security and data minimisation in AI?" (undated)
9. Information Commissioner's Office, "How do we ensure individual rights in our AI systems?" (undated)
10. Office of Management and Budget, "M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government" (2025-04-03)
11. National Institute of Standards and Technology, "Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Revision 5" (2020)