Retention, Training and the Terms That Matter

General orientation, not legal advice; take advice on anything material.

A practical review based on “Retention, Training and the Terms That Matter” includes the time required for assessment, contracting, rollout and later reassessment. Teams can use the full guide to make that operational effort visible across owners and deadlines, while keeping the legal, security and model-risk decision in the documented approval process.

For an independent benchmark, compare the local approach with ICO artificial-intelligence guidance; the useful test is whether ownership, access and recovery remain proportionate and explainable when the usual expert is absent.

Agreements in this area are long and the parts that matter are short. These are the clauses to find.

Training use

Look for: whether customer input may be used to train or improve models.

Good: an express exclusion, with no exception for "aggregated" or "de-identified" data, which can mean more than it sounds.

Bad: silence, or a right to use data for "service improvement" without definition.

Retention

Look for: how long inputs and outputs are kept, and whether you can delete.

Good: a stated period, deletion on request, and zero-retention options for sensitive use.

Bad: "as long as necessary", which means whatever they decide.

Human review

Look for: whether staff or contractors may read submitted content.

Good: review limited to flagged abuse cases, with confidentiality obligations.

Bad: broad rights to review for quality, with no limit.

Subprocessors

Look for: who else touches the data, including the underlying model provider if the vendor is a reseller.

Good: a published list, notification of changes, and a right to object.

Bad: a general right to use subprocessors at discretion.

This clause matters more here than in most software, because the AI layer is frequently somebody else's.

Processing location

Look for: where data is processed and stored, and whether you can constrain it.

Good: a stated region with a contractual commitment.

Bad: "globally", which is common and is a problem for regulated data.

Indemnity for output

Look for: whether the provider stands behind output, particularly on intellectual property claims.

Good: an indemnity for third-party claims arising from output, with reasonable conditions.

Bad: an express disclaimer plus a warranty that output may be inaccurate, which is the common position.

Read this one before relying on output in anything commercial.

Change of terms

Look for: how terms may change and what notice you get.

Good: notice, and a right to terminate on material change.

Bad: unilateral change effective on posting, which is standard for consumer tiers.

The practical approach

Read these seven for anything you approve.

An hour per service, and it produces the row in your inventory that actually determines the risk.

What to check

For your main AI tool, can you answer all seven?

Do you know who the subprocessors are?

Is there any indemnity for output?

And what notice do you get if the terms change?

The point

Seven clauses decide everything: training use, retention, human review, subprocessors, processing location, output indemnity and change of terms..

Underlying all of this

Everything in this collection reduces to four habits: find out what people are doing and why before deciding anything, provide something good enough that the approved route is the easy one, write rules about information rather than about tools, and monitor the destination rather than the content. None requires a product, and a programme doing all four controls more than one built on prohibition.

The recurring pattern

The recurring pattern across every section here is the same: the response that feels like control reduces it. A ban removes visibility rather than use. Content inspection drives activity to personal devices. A discovery exercise with consequences produces quiet answers. In each case the organisation ends up knowing less about a risk it believes it has handled.