Six Questions to Ask Any AI Vendor Before Entrusting Customer Data

Many businesses hesitate to adopt AI due to data privacy concerns—often with good reason. The positive news: you do not need to be a lawyer to identify reputable vendors. Here are six critical questions to ask any vendor before sharing customer data. If they evade them, you already have your answer.

1. “Do you offer a Data Processing Agreement (DPA)?”

Under Article 28 GDPR, a binding contract is required in which the vendor commits to processing data strictly according to your instructions. Without a signed DPA, customer data must not be transferred.

2. “Where is the data hosted, and who else is involved?”

Ask specifically about data center locations and any sub-processors. Data residency within the EU significantly simplifies regulatory compliance.

3. “Are our data used to train your models?”

The only acceptable answer is no. Your customer data belongs to you, not to an external vendor’s foundation model.

4. “Can the AI access more information than the user making the query?”

An often overlooked vulnerability. An AI system with unrestricted data access can inadvertently leak sensitive information to colleagues who lack the proper permissions—such as private inboxes or personal calendars. The AI’s responses must respect the exact same access control levels as the human user.

5. “What actions can the AI take autonomously, and can this be adjusted?”

For every task, you should be able to configure whether the AI merely suggests, requires approval before executing, or acts autonomously—and you must be able to revoke these permissions at any time.

6. “Can I trace every action taken by the AI?”

A comprehensive audit trail documenting what the AI did, when, and why is vital for governance, compliance audits, and data subject access requests.

What about outside the EU?

The United Kingdom applies the UK GDPR with very similar principles, the United States enforces state-level regulations such as the California Consumer Privacy Act (CCPA), and Canada relies on PIPEDA. These six questions provide a solid foundation across all jurisdictions. Please note that they do not constitute formal legal advice.