Will my company's data be used to train AI models?

Consumer plans and business plans are different

Many AI products come in two flavours. Consumer plans (free or paid by an individual) are covered by consumer terms. Business and enterprise plans are covered by a commercial contract between the vendor and your organisation, often with a data processing agreement.

The difference can be real. In August 2025, for example, Anthropic announced that users of its consumer Free, Pro and Max plans would choose whether their chats may be used to train new models, with data kept for five years if they agree and 30 days if they do not. The same announcement says this does not apply to services under its commercial terms, such as Claude for Work, education plans and API use.

So the first question is not which AI your company uses, but which account each person is signed in with.

Do you know which AI accounts your teams are signed in with today? Book a free AI Value Briefing and we will look at it with you.

What the vendors' own pages say

We read each vendor's current page on 27 October 2026. Terms change, so treat this as a starting point and read the page yourself.

• Anthropic (Claude, business plans and API): the Commercial Terms of Service, effective 17 June 2025, state that Anthropic may not train models on customer content from its services.
• OpenAI (API): the developer documentation on your data says data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer opts in, and that this has applied since 1 March 2023. We could not open OpenAI's page on its ChatGPT business plans, so check it directly.
• Microsoft 365 Copilot: Microsoft's data, privacy and security page, dated 9 July 2026, states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, including those used by Copilot.
• Google Workspace with Gemini: Google's Generative AI in Google Workspace Privacy Hub, last updated in October 2026, states that Workspace does not use customer data for training models without the customer's prior permission or instruction.

Training is not the only question

A promise not to train is important, but it does not mean your data is never stored or seen. Ask about:

• Retention: how long prompts and files are kept. OpenAI's API documentation, for instance, describes abuse monitoring logs kept for up to 30 days by default, with shorter options for eligible customers.
• Human review: whether staff at the vendor can read content, for example for safety checks.
• Feedback: thumbs up or down and comments can follow separate rules from ordinary chats.
• Add-ons: Microsoft's page notes that agents connected to Copilot have their own privacy statement and terms. Connectors and plug-ins can move data to other companies.

Settings worth checking

• Which plan each user is on, and whether personal sign-ups with work email are allowed.
• Any setting about improving or training models, in the admin console and in each user's privacy settings.
• Chat history, memory and retention periods.
• Which connectors, agents and third-party apps are switched on.
• Whether feedback sharing is on.

What to ask a vendor

1. Is our content used to train or improve any model, yours or a partner's? Where is that written in our contract?
2. How long do you keep prompts, files and outputs, and can we shorten it?
3. Can any of your staff or contractors read our content, and when?
4. Which sub-processors handle our data, and how will you tell us about changes?
5. What happens to our data when we leave?

Goes deeper in our free AI Field Guide: 10. Data safety: what never to paste, and other rules, 13. Connectors and integrations: letting AI use your tools safely. Ask for these guides.