- Conditions that "not used for training" does not tell you
- Checking training, storage, access, connected services and deletion separately
- What remains after removing names, and starting with practice data
The short answer
You want to summarize meeting notes. Sort incoming inquiries. Find the part you need in a long document. Generative AI is one option for help with tasks like these.
Before entering a document, though, you need to confirm that it may be handled by an outside service at all. A statement that your data is "not used for training" does not tell you every condition. Check training, storage, access, connected services and deletion separately, and look at what the document actually contains before deciding.
Why this needs checking now
In "10 Major Security Threats 2026," published in January 2026 by IPA (the Information-technology Promotion Agency, a Japanese government-affiliated agency), "cyber risks surrounding the use of AI" entered the list for organizations for the first time, at third place. The ranking is selected based on incidents and attacks that occurred in 2025.
IPA's explanatory booklet for organizations (in Japanese) also covers "shadow AI," where staff use AI for work without the organization's permission, and the risk of using AI output without checking it properly. AI can write things that sound plausible but are untrue, which is called a hallucination.
A service you find convenient for personal use is not automatically suitable for company documents.
Look at training, storage and sharing separately
When you review an AI service, check at least the following items one by one.
| Item | What you want to know |
|---|---|
| Use for training | Whether inputs or outputs are used to improve models, for example |
| Storage | Under what conditions history and processing records are kept |
| Access | What administrators, people you share with, and the provider can see |
| Connected services | What is passed to other services you connect |
| Deletion | What users can delete, and what information is retained |
What you need to check is the contract and settings you will actually use. Even under the same product name, conditions may differ between personal and organizational plans.
If you do not know the answer to an item, do not fill it in by guessing. Ask your administrator or the provider.
Three checks before putting company documents into AI
- Is this service approved for work use?
- Personal or confidential data
- Contractual limits
- Clues left after removing names
- Use for training
- Storage and access
- Connections and deletion
Is it fine once customer names are removed?
For example, even if you delete names from a list of inquiries, addresses, order numbers and detailed descriptions of the request may remain. In some cases, the combination is enough to identify the person.
And even when no individual can be identified, unpublished prices or deal terms are not necessarily information you may pass outside the company.
The question is not only "did I remove the names?" but "what does the document as a whole contain?"
In a June 2023 alert, Japan's Personal Information Protection Commission asked businesses entering personal information into generative AI services to check carefully that it stays within the stated purpose of use. It also noted that if personal data entered without the person's consent is handled for purposes other than producing the response, the business may be in breach of the law.
Start by limiting the information you use
When trying a new service, one approach is to begin with text that is already public, or practice data that contains no real customer information.
For inquiry sorting, for example, prepare a few fictional inquiries. Check whether the sorting fits your purpose and where it goes wrong, then decide the conditions for using it in real work.
This does not mean you can skip checking the service's terms or your company's rules. It is a way to separate trying out the features from the decision to handle real documents, and to move forward step by step. How to phrase the request itself is covered in "AI Answers Missing the Mark? Four Things to Tell It."
Four things to check before entering anything
Checklist
- Is this AI service approved for work use?
- Does the document contain personal information, confidential information, or contractual restrictions?
- Have you checked how entered information is stored, used and shared?
- Is someone assigned to check the output?
These four are a starting point for checking before input. Even when all are in place, there is no guarantee that leaks or errors will not occur.
One thing to check today
Find out which AI services your company has approved, and what information may be entered into them.