Is it safe to put client data into AI tools?

What it is

Teams ask this before connecting AI to inboxes, CRMs or shared drives. The answer is a checklist, not a yes or no.

How it works

1. Check the vendor’s privacy and data-use pages for your exact plan. As checked on 2026-10-17: OpenAI doesn’t train on ChatGPT Business, Enterprise or API data by default, but may use personal-account chats while “Improve the model for everyone” is on. Anthropic doesn’t train on its commercial products’ data unless you send feedback or opt in, while consumer chats are used if you allow it. Google says Gemini in Workspace doesn’t use your content for training outside your domain without permission.
2. Check whether prompts are retained, for how long, and whether they are used for training.
3. Check client contracts and applicable privacy law; EU data-protection rules are one example.
4. Set an internal rule by data class and record which tools are approved.

Benefits

• Prevents accidental contract or privacy breaches.
• Gives staff a clear yes/no list.
• Builds client confidence when they ask.

Limits and risks

• Terms change; re-check on a schedule.
• Connected tools (MCP servers, plugins) have their own terms, and send parts of your input to third parties.
• Feedback buttons can change the rule: Anthropic says reported feedback may be used for training even on commercial plans.
• Regulated data (health, financial, legal) needs advice from counsel, and often a signed agreement such as a DPA or BAA.

This page summarizes published rules and vendor terms for orientation. It isn’t legal advice; check the rules that apply to your business and your clients.