Written by Martin Ågren - March 18, 2025
Think carefully before entering confidential or sensitive information (e.g., personal data) into an AI. Below are some things to consider.
Is data used for training?
Paid subscription? Turn off "input for training."
Personal use or through your organization?
In which country is the server your data is sent to located? Does it matter to you?
Does your organization have an AI policy or policies regarding data security or data protection?
What do these documents say about AI usage in your organization?
Should/would you like to read the terms and conditions from the company providing the AI service?
Example, copyright: What do the terms say about rights to the content generated by the AI tool? Do you need/want to subscribe to a paid plan to select settings for generated content?
Example, for schools: Users between 13 and 18 years may require guardian approval.
Are you GDPR compliant?
What happens if you enter personal data into the input field? Is the data sent to a server in the USA? Can the provider guarantee GDPR compliance through a license agreement? Should you categorically avoid entering personal data into the input field? What does your AI policy say about GDPR compliance?
Which option suits you or your organization best?
Private subscription, not linked to your organization? Multiple subscriptions? Cost?
Does your organization already have a license agreement (e.g., with Microsoft or Google)? Does this agreement need updating or renegotiation regarding generative AI tools?
Should your organization enter a new license agreement with an AI provider? Which provider and why? What does the agreement imply for GDPR compliance?
Own server with your own small (less powerful) AI model? Is this small AI model sufficient for your needs? Several hundred thousand SEK? Competence or cost for implementation and operation? Fine-tuning and RAG?
Own server with your own powerful AI model? 1 to 2 million SEK? Competence or cost for implementation and operation? Fine-tuning and RAG?