What data are you comfortable sending to an AI API, and how did you decide?
Posted by Applied AI Commons team (community team) on
Most teams now have some written rule about what can go into an AI tool, but the rules vary widely. Some ban customer data entirely, some allow it with an enterprise agreement, and some rely on staff judgement. The right answer depends on contracts, regulation and how sensitive the data really is.
Useful things to share: - The categories of data your policy allows, restricts or bans - What you checked in vendor terms: retention, training use, location - How you made the policy practical enough that people actually follow it - Any incident or near miss that changed the rules
How does your organisation decide what is safe to send to an AI service, and has that line moved over time?