Do AI providers automatically use my input for training?

Not all of them, but many consumer versions reserve the right to – sometimes with an option to switch it off in the settings. Business versions usually rule out training use in the contract. Only rely on what has been agreed in writing.

What is a training exclusion?

The provider’s contractual commitment not to use your input and uploaded documents to train or improve its AI models. It belongs in the contract or the data processing agreement (DPA) – a statement on the website is not enough.

Is an opt-out in the settings enough?

It is better than nothing, but much weaker than a contractual commitment. Settings can change with updates, often apply only to individual user accounts and are hard to prove if there is a dispute. For company data, the exclusion should be in the contract.

Why is the free version a problem for company data?

Free and personal versions usually come without a data processing agreement (DPA), the provider often reserves the right to use input for training, and the company has no central control over accounts and settings. Several of the foundations for GDPR-compliant use are therefore missing at once.

Where can I find out whether my data is used for training?

In the data processing agreement (DPA) and its annexes, in the terms of use of the business version and in the privacy policy. Many providers also have their own security pages. If these remain vague, ask in writing – and file the answer with your records.

Is my data used for AI training? How to check providers

Whether your data is used for AI training depends on the provider, the version you choose and the contract – there is no blanket answer. As a rule of thumb, consumer and free versions often reserve the right to use data for training, while business versions usually rule it out in the contract. For your company, only what has been agreed in writing counts. This article sets out the five points to check with every AI provider before any company data goes into the tool.

In brief

Whether your input is used for AI training is decided by the contract, not the technology – and contracts differ considerably between free, personal and business versions.
A training exclusion is the provider’s contractual commitment not to use your documents and input to improve its models.
An opt-out in the settings is weaker than a contract: it can change and is hard to prove.
Once data has gone into a model, it is practically impossible to get it back out – which is why it pays to check before the first upload.
The five checkpoints: data processing agreement (DPA), an explicit training exclusion, the right version, the settings, and sub-processors and storage period.

Why is AI training on company data a problem in the first place?

If a provider uses your input to train its models, you lose some control over that data. That matters on two levels at once.

Data protection: company documents almost always contain personal data – customer names, employee data, contact details. The GDPR requires purpose limitation: data you collected to fulfil a contract cannot simply be used for something entirely different, such as training someone else’s AI models. If the provider trains models for its own purposes, it also steps outside its role as a processor acting on your instructions – and that is precisely what the data processing agreement (DPA) must rule out or set clear rules on.

Trade secrets: cost calculations, recipes, customer lists and internal know-how are often worth more than any machine in the workshop. Once something has gone into a model, there is practically no way to remove it selectively. Even if models don’t usually reproduce input word for word, you have given up control over what happens to that knowledge.

For context: this article sets out general principles and is no substitute for legal advice on an individual case.

Consumer or business: what is the difference?

The same provider can behave quite differently in its free version and its business version. The typical differences:

Feature	Consumer/free version	Business version
Use for training	Often reserved, sometimes with an opt-out in the settings	Usually ruled out in the contract
Data processing agreement (DPA)	Not usually available	Offered, often as part of the contract
Account management	Private individual accounts the company cannot control	Central management, with rights and rules set by the company
Storage location and deletion	Little or no say	Can be set out in the contract
Proof if something goes wrong	Difficult	Contract and documentation available

The table also explains the biggest everyday risk: employees using private free accounts because the company provides nothing official. The consumer terms then apply – without management knowing.

The five checkpoints in detail

Is there a data processing agreement (DPA)? As soon as the provider processes personal data on your behalf, a data processing agreement under Art. 28 GDPR is mandatory. A service that doesn’t offer one is unsuitable for company data. The Austrian Economic Chamber (WKO, wko.at) provides templates and guidance.
Is the training exclusion explicitly in the contract? Look for clear wording that input and documents will not be used for training or to improve models. Vague statements (“we take data protection seriously”) don’t count.
Are you really using the right version? Check which plan is actually in use – and whether all employees work through company accounts. The best business contract is no use if staff are using private free accounts on the side.
How are the settings configured? Business environments also have switches for telemetry, history storage and product improvement. Check them once centrally, set them appropriately and document them.
Who are the sub-processors, and how long is data stored? An AI service often relies on other providers, such as model operators and data centres. Check their list, how long input is stored and when it is deleted.

Which questions should you put to the provider in writing?

If the documentation leaves things unclear, a short written enquiry helps. Four questions work well:

Are our input and uploaded documents used to train or improve AI models – even in anonymised form?
Where is the data stored, and who can access it from where?
Which sub-processors are involved, and where are they based?
How long is input stored, and how is it deleted when the contract ends?

Keep the written answers with your contract records. If something happens – an enquiry from the Austrian Data Protection Authority (dsb.gv.at), for example – what counts is what you can prove.

What if company data has already gone into an AI tool?

The reality in many companies is that people tried it out long ago – with real quotations, real customer emails, real cost calculations. A level-headed four-point plan helps:

Take stock: which tools were used, with which accounts and roughly which data? Ask without apportioning blame – otherwise you won’t find anything out.
Correct the settings straight away: switch off training use wherever there is an option to; delete stored histories as far as possible.
Move to a proper set-up: introduce a business version with a data processing agreement (DPA) and a training exclusion, and stop using private accounts for company purposes.
Request deletion: ask the provider to delete stored input – the GDPR gives data subjects and controllers the means to do this. To be honest, anything that has actually gone into a model can hardly be removed afterwards. That makes the rule for the future all the more important.

What does this mean for your company in practice?

The checkpoints add up to a simple company rule: company data only goes into tools covered by a data processing agreement (DPA) and a contractual training exclusion – and only through official company accounts. Put this rule in writing and tell your staff about it, otherwise shadow IT fills the gap.

For an AI knowledge base that holds your company’s collected knowledge, the bar is particularly high: instructions, service records and experience are the company’s capital. A reputable provider rules out training use in the contract, keeps the data on EU servers and backs every AI answer with the source document – so every statement can be checked, because even a well-connected AI can get things wrong.

The training exclusion is one building block among several – alongside server location, the data processing agreement (DPA) and access control. The article AI and the GDPR in Austria gives the full picture, including a provider checklist.

As a next step, take the two or three AI tools your company already uses and go through the five checkpoints – it rarely takes more than an hour per provider. The How it works page shows how a knowledge base with a contractual training exclusion is introduced.