Before staff put business data into an AI tool: eight questions

Before approving an AI product, clarify:

1. What business, personal or sensitive information will enter the tool?
2. Where is that information processed and stored?
3. Who can access prompts, files and outputs?
4. Is customer data used to improve the provider's models?
5. What administrative and access controls are available?
6. Can the organisation retrieve and delete its data?
7. What audit evidence and incident notification does the provider offer?
8. Who owns the product decision and its regular review?

Define permitted uses and prohibited data before rollout. Public tools should not receive personal or sensitive information by default. Assign an owner, train users and schedule reviews—the due-diligence decision is not set and forget.