Most retention policies, the rules about what data gets kept and for how long, were written for systems the organisation controls: the customer database, the shared drive, the software used to manage that data. None of that says anything about the AI chat tool an employee opened in a browser tab this morning and pasted a client file into.
A Behaviour Shift Nobody Wrote A Policy For
Two years ago, sending sensitive information outside the organisation meant something deliberate: an email, or a file sent to a partner, something most people would pause and think twice about. Pasting the same content into ChatGPT or Claude to summarise or rewrite it doesn’t register the same way. It feels like using a tool, not sending data outside the business. But it’s exactly that: content leaving your systems and landing on someone else’s computers, governed by terms and conditions you’ve probably never read.
The Assumption Doing The Damage
The quiet assumption is that protections must exist by default, because a well-known company built the tool. That’s often wrong. The honest rule of thumb: if the terms don’t clearly say your content won’t be used to train the AI or kept afterwards, assume that it will be.
Why This Belongs Inside Your Policy, Not Next To It
Once information leaves your systems for a third-party AI tool, everything your retention policy is meant to control (how long something is kept, whether it can be deleted on request) now depends on that company’s terms instead of yours. This kind of policy has always stopped at the edge of the systems the organisation owns. It needs to extend to the browser too.
Nobody’s saying you should ban anything. The questions worth asking of this channel are the ones you’d already ask of anywhere else your data ends up, and they haven’t changed.
What’s Worth Doing
Know which AI tools your organisation has properly approved, read the fine print about what the provider can do with your data before rolling anything out, and apply the same rules you already use to flag sensitive documents to what leaves through the browser too, not just what sits on a shared drive.