Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If an AI vendor may train on our data, then what do we require?

6 decision pointsThe pack behind this answer: AI Security Governance & Acceptable Use

Add to board memo

The short answer

Recommendation
For Internal and Confidential information, require a contract term that bars the vendor from using your prompts, files and outputs to train or improve its models or anyone else's. Until the term is signed, no Internal or Confidential data goes in. For Public information alone, require nothing.
Reasoning
The training bar matters only where the data does. Public information with no personal data may go into any tool, so the vendor's training changes nothing. Internal and Confidential information needs the bar in the contract (BC-2, ST-1, P15 CL-19). A vendor can change a setting, and only the contract binds it, so a setting verified off is an added technical control and never a substitute. The supplier clause library has no clause that supplies this term, so you write it yourself and Legal reads the vendor's wording. Special category data stays out whatever the contract says.
Considerations
  • Where the tool also has a setting that stops training, keep it off and check it at each review. It adds a technical control on top of the contract term and never replaces it (BC-2).
  • The training bar is one of eight AI terms (ST-1 to ST-8). Personal data also needs processor terms, and the intended purpose in writing (ST-8) has no library clause either.
  • A vendor that will not give the term for Internal or Confidential data leaves that use on hold (H-2), and a setting verified off does not clear it. Where the tool is already running, the hold becomes a dated condition and the tool is switched off if the date is missed.
  • The supplier needs a documented decision of Approve or Approve with conditions before Internal or Confidential data goes in (H-1).

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn AI vendor's terms let it train on what we put inDecisionCould special category personal data go in?OutcomeStop. No contract term makes this acceptableDecisionCould Internal or Confidential information go in?OutcomeNo training term needed for Public information aloneDecisionDoes the contract already bar training on our data?DecisionWill the vendor agree to write the bar into the contract?StepWrite the training bar into the contract and sign it before use startsStepAdd the other AI terms to the same contractDecisionIs the supplier's documented decision Approve, or with conditions?DecisionWould Confidential information go in?OutcomeApprove for Confidential data, with the baseline conditionsOutcomeApprove for Internal data only, with the baseline conditionsOutcomeHold the use. Say what clears it and by whenOutcomeKeep Internal and Confidential data out of this tool

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    An AI vendor's terms let it train on what we put in

    Some AI tools use customers' prompts, files and outputs to train or improve the vendor's models. The answer depends on the data level, because the classification rule asks for a training bar only for Internal and Confidential information.

    In the pack

  2. Decision

    Could special category personal data go in?

    Special category data never goes into an AI tool, so a training bar does not change the answer. The rule takes no exception. Change the use so that no such data goes in. If you do not know what staff would paste, answer yes.

    In the pack

  3. Outcome

    Stop. No contract term makes this acceptable

    A promise not to train does not make special category data acceptable in an AI tool. Tell the requester what would have to change. A use that no longer takes such data is a new request.

    In the pack

  4. Decision

    Could Internal or Confidential information go in?

    Information at Internal or above is covered by the training rule. A collection or export takes the highest level of anything in it, and customer or supplier material under a confidentiality agreement counts as Confidential. If you cannot say what staff will paste, answer yes.

    In the pack

  5. Outcome

    No training term needed for Public information alone

    Public information with no personal data in it may go into any tool (AG-02), so the vendor's training does not change the answer. Keep it off the work account and out of the organisation's name. Personal data still needs a tool approved for it (BC-5). If the data ever rises above Public, start this question again.

    In the pack

    See also

  6. Decision

    Does the contract already bar training on our data?

    Read the contract. Answer from what the tool does with your data, not from the product page or a sales answer. The bar should say that the supplier does not use your prompts, files or outputs to train or improve its models or anyone else's (ST-1). If you have not read the contract, answer no.

    In the pack

  7. Decision

    Will the vendor agree to write the bar into the contract?

    Ask in writing. The pack treats the training bar as a negotiated term, so involve Procurement and Legal early. A vendor that will not give it for Internal or Confidential data leaves hold H-2 open, and a setting verified off does not clear it. If the vendor has not answered, treat it as not yet answered: the use waits.

    In the pack

  8. Step

    Write the training bar into the contract and sign it before use starts

    Start from the wording of ST-1. The classification pack requires this term and the supplier clause library has no clause that supplies it, so write the term in the contract and ask Legal to read the vendor's wording. For a new use, the use does not start until it is signed. Where the tool also has a setting that stops training, keep it off and check it at each review as an added control; it never replaces the term.

    In the pack

  9. Step

    Add the other AI terms to the same contract

    A training bar is one of eight AI terms. Ask also for processor terms (P06 clause CL-06), named sub-processors including the provider of the underlying model (P06 clause CL-04), stated storage locations (P06 clause CL-05), incident notice (P06 clause CL-07), return and deletion that reaches any model or index built from your data (P06 clause CL-13) and notice of new AI features (P06 clause CL-20). The eighth, the intended purpose in writing (ST-8), has no clause either.

    In the pack

  10. Decision

    Is the supplier's documented decision Approve, or with conditions?

    Every supplier assessment ends in a documented decision: Approve, Approve with conditions, Escalate or Reject. The AI pack asks for it before Internal data goes in (H-1, AG-11), earlier than P15 CL-16, which asks for it for Confidential data only. No decision yet, or one still pending, answers no.

    In the pack

  11. Decision

    Would Confidential information go in?

    Confidential needs one more step than Internal: the tool must be approved for Confidential by name, and the supplier decision comes first (BC-4). If staff might paste customer or supplier material, or a collection with any Confidential item in it, answer yes.

    In the pack

  12. Outcome

    Approve for Confidential data, with the baseline conditions

    Put the tool on the approved list up to Confidential with the baseline conditions, including the training bar. Record the approval and its conditions in the inventory, and the supplier in the supplier register. Review it at the tier's interval, and sooner if the vendor changes its model, its locations or its AI features.

    In the pack

  13. Outcome

    Approve for Internal data only, with the baseline conditions

    Approve the tool up to Internal with the baseline conditions. Confidential material stays out until the tool is approved for Confidential, with the supplier's decision first (BC-4). Enter the supplier in the supplier register and the tool in the inventory.

    In the pack

  14. Outcome

    Hold the use. Say what clears it and by when

    Hold H-1 applies when the supplier has no documented decision and Internal or Confidential data would go in. Hold H-2 applies when Internal or Confidential data would go in and the contract does not bar training. A setting verified off does not clear H-2: the supplier can change a setting, and only the contract binds it. The use does not start. A hold names what clears it and the date by which it should. If the tool is already running, the hold becomes a condition with a date, and the tool is switched off if the date is missed.

    In the pack

    See also

  15. Outcome

    Keep Internal and Confidential data out of this tool

    Without a contract term that bars training, the tool fails the baseline for Internal and Confidential data, so only Public information may go in, and never through a work account. A setting verified off does not change that. Look for a tool that can meet the baseline. Keep the vendor's answer in the intake file, because it shows why the tool was declined.

    In the pack

    See also

Practical checklist

  1. Stop the use if special category data could go in; no contract term changes that.
  2. Decide whether Internal or Confidential information could go in, treating not knowing as yes.
  3. Read the contract itself for a bar on training, not the product page or a sales answer.
  4. Ask the vendor in writing for the term, involving Procurement and Legal early.
  5. Write the bar from the ST-1 wording, have Legal read the vendor's version, and sign it before use starts.
  6. Add the other AI terms to the same contract.
  7. Where the tool has a setting that stops training, keep it off and check it at each review as well; it never replaces the term.
  8. Hold the use until the supplier's documented decision is Approve or Approve with conditions.

Evidence to have ready

  • The signed contract term barring training on your prompts, files and outputs, with Legal's reading of the vendor's wording.
  • Where the tool has a setting that stops training, who checked it was off, when and on which account, at each review.
  • The supplier's documented assessment decision and the tool's row on the approved list with its data level.
  • Any hold, what clears it and the date by which it should, and the vendor's answer kept in the intake file.

Assumptions

  • You are a customer of the vendor. Building on a supplier's model API counts as building. If you would build or supply an AI system, Legal decides your role first.
  • You classify information in three levels (Public, Internal, Confidential), and you can say which would go in.
  • The pack's wording of the training bar is a term to negotiate and Legal reads the vendor's version against it.
  • Personal data also needs processor terms (P06 clause CL-06). That condition applies on top of the training bar.

Not covered here