Generative AI tools are supported by large language models. These models retain, learn from and reuse the data fed into them.

Inside many companies, that learning process will raise concerns about whether their data is directly or indirectly helping other companies, including their competitors.

In this context, companies should wonder whether they can share their data with an AI application, but prevent outsiders from benefiting from that data.

But that worry will also raise the question of whether the AI can continue to improve if the user companies do not share data.

The balancing of these two interests must be understood by companies embarking on generative AI application use.

In-house legal teams need to start probing these issues with their technology vendors now. Those vendors that employ large language models should be able to assure customers they do not retain customer data or use it to train their models.

In addition to asking about data retention, in-house lawyers or their information security teams should ask vendors the following questions:

• Can the vendor describe exactly what data is shared with the large language models to produce the responses provided in the tool? Is it encrypted at rest and in transfer? How long is it retained? Is it identifiable to your organization?
• Has the vendor put in place automatic data deletion features? Knowing if the system requires your company to actively delete its content to avoid its inadvertent use is important. Also, can your company remove all traces of its content should it discontinue the application?
• Are the prompts or questions being sent to the large language model based on generic data models that the vendor has created, or are they relying on customer users to frame questions, potentially exposing confidential data to the platform? Understand if you will need to educate your user community on effective query of the AI, or if the tool’s operation will take care of this concern by presenting structured output and controlling queries behind the scenes.
• If the tool offers market comparison information, is the participation in feeding that market opt-in or automatic?
• Does the tool provide ways for your company’s users to benefit from market information without sharing data, or does it provide a means to share some level of data without compromising confidentiality?

In-house legal teams should be partnering with their information security teams to develop these screening questions when generative AI applications are being explored to be sure applications are fit for their environments and to address the additional privacy and data security concerns these capabilities raise.