Does using AI mean my client data is being used to train models?

The longer version

Here's how it actually breaks down. The free and consumer versions of most AI tools — the ones your team is probably already pasting things into — generally reserve the right to train on what you type. The business tiers and API-based setups typically don't. Same company, same model, completely different data handling depending on which door you walked in.

That's the trap: most small businesses don't have a policy, so each employee makes their own call. Someone pastes a client list into a free chatbot to "clean it up," and now your client data is training material. Nobody meant any harm. It just happened.

The fix isn't complicated, but it is deliberate. You need three things: know which tools your team actually uses (not which ones you approved — which ones they use), configure each one to its no-training setting where that exists, and put the data handling in writing with any vendor that touches client information. If a vendor won't put "we do not train on your data" in the contract, that's your answer about that vendor.

How BIS handles this

This is literally the first thing I sort out in every AI engagement. Before we build anything, we document exactly which tools touch which data, what each vendor's training policy is, and where the gaps are. Then we close them — configuration, contracts, or replacing the tool.

My boundary offer exists because of this question. Default-deny data access, written limits, three tiers sized to the client. You shouldn't have to wonder what your AI touches. You should be able to point at a document.