Sources checked: 7 September 2026
Start with use, then the product
Record which task the tool supports and which information it actually needs. A model rewriting public product text has a different risk profile from an assistant with access to personnel files. The brand name alone cannot establish whether the use is appropriate.
Questions for the discussion
Ask where inputs, outputs, backups and support data are processed. Ask which subprocessors are involved, whether data is used for model training and which setting controls that. Have the supplier explain access, deletion, export and changes to terms. Request evidence for the actual subscription and region you plan to use.
Connect evidence to a decision
Keep a reference to the relevant terms, their version date and your assessment. A certificate may provide information about assessed controls, but does not replace reviewing your own configuration. An unanswered question remains an open issue with an owner and due date.
A trial without real case files
Test first with synthetic examples. Check whether information reaches another team unintentionally, permissions are sufficiently restricted and an export is actually useful. Agree what outcome is required before granting more access. Also record how to stop the integration.
Include cost and exit
A low licence price can coexist with substantial review work or an expensive transition. Include support, usage, error correction and migration. These questions support a reasoned choice rather than a blanket judgement that a supplier is safe.
What you can use it for
A supplier record for each application, including evidence, open questions, cost and an exit route.
This guide provides general information. Assessment of a specific application depends on your role, data and intended use.
Sources and further reading
This article was prepared with AI assistance and checked against our editorial and sourcing guidelines.