An AI tool might help draft a reply, organise information or find a pattern in a document. The convenience can make it easy to move straight from an idea to uploading a file. When that file contains information about customers, clients, staff or other people, pause to understand the arrangement first.
These seven questions are practical planning prompts. They do not establish that a proposed use meets the legal or professional requirements that apply to your work.
1. Does this task need real customer information?
A draft reply may only need the type of question and the tone you want. A workflow test can often use invented examples. Identify the minimum information required before deciding what to share. Removing a name alone may still leave details that identify someone.
2. Are we authorised to use the information for this purpose?
Consider why the information was originally collected, what the person was told, your organisation’s policies and the rules relevant to your work. Access to a file does not settle whether every further use is appropriate. Obtain qualified advice where the proposed use raises legal or professional questions.
3. Which exact product, account and settings are involved?
Record the service, plan and account type. A personal account, a commercial workspace and an API integration may have different terms and controls. Check connected apps and optional features as well as the main chat window. A brand name alone does not describe the full arrangement.
4. Where will the information go, and who can access it?
Ask about prompts, attachments, responses and logs. Consider provider staff, workspace administrators, other team members and external services connected to the tool. Check permissions on shared documents before making them available to an AI system.
5. Will the information be used to train or improve models?
Read the terms for the specific service and plan. Check the default settings, available controls and whether feedback follows different rules. Keep a dated record of the answer rather than relying on a general statement someone remembers hearing.
6. What is stored, for how long, and what does deletion remove?
Training and storage are separate questions. A statement that information is not used for training does not, by itself, answer whether prompts, files or activity logs are retained. Ask what happens to each type of information, whether you or an administrator can delete it, and what exceptions apply.
Include backups, shared conversation links and third-party connections in the discussion. Record anything you cannot yet confirm. If you need a retention or access control that the service does not offer, that matters to the decision.
7. Who remains responsible for the result and for stopping the process?
Name the person who approves the use, checks output and handles an error or concern. Decide when a task must return to a person. NCSC guidance highlights both inaccurate AI output and the need for clear responsibility and supplier understanding. A convenient answer still needs an appropriate check before it affects someone.
UNESCO’s ethics recommendation and NIST’s voluntary risk framework offer broader perspectives on privacy, accountability and human oversight. They are useful references, rather than proof of compliance with a particular Caribbean jurisdiction’s law.
Sources & further reading
- NCSC: AI and cyber security
UK guidance on AI risks, responsibility and supplier questions.
- UNESCO: Recommendation on the Ethics of AI
International recommendation adopted in 2021; includes privacy and human oversight.
- NIST: AI Risk Management Framework
Voluntary risk guidance, including the Generative AI Profile. The seven-question format is our practical synthesis.
Sources reviewed 14 November 2026. Product features and terms can change. Examples are illustrative unless stated otherwise. Suggest a correction or a useful question.