Every prompt is a disclosure to a technology provider. Whether that disclosure is safe depends on the terms, not the brand.
Questions to ask about any AI tool
- Training: can the provider use your inputs or outputs to train or improve its models? Many enterprise and API offerings say no by default; many free consumer versions allow it unless users opt out.
- Retention: how long are prompts and outputs stored, and why (service delivery, abuse monitoring, legal holds)?
- Human access: can provider staff read your data, for example to review abuse? Under what controls?
- Disclosure: when will the provider disclose data to third parties or authorities, and will it tell you?
- Location and sub-processors: where is data processed and by whom?
- Security: certifications, encryption, access logs and incident notice.
Classify, then match
Use a simple data-to-tool matrix: data classes (public, internal, confidential, privileged, regulated personal data) against approved tools, with yes, no or "with controls" in each cell. People follow simple rules at the point of use.
Shadow AI
If you don't give lawyers a good approved tool, some will use their personal accounts. Blocking alone rarely works; an approved alternative plus training does.
Third-party confidentiality
NDAs, protective orders and data processing agreements may restrict sharing documents with sub-processors, including AI providers. Check before you upload a counterparty's documents or discovery material.