Client data and AI tools: the boundary rules

Client data enters an AI tool only when three conditions hold: the vendor gives a contractual commitment not to train on your inputs, the data is the minimum needed for the task, and you could explain the full data flow to your client in one paragraph without wincing. If any of the three fails, the data stays out. Most AI privacy problems are not dramatic breaches — they are quiet defaults in terms of service that nobody read.

What actually happens to data you put into an AI tool?

It depends on which tier of the product you are using, and the difference matters more than most firms realise. Consumer tiers of AI assistants have commonly used inputs to improve models by default. Business and API tiers typically commit not to train on your data, though inputs may still be retained for a period — often around 30 days — for abuse monitoring. Those are the current norms, not guarantees; check the specific vendor, because terms change.

So the same prompt, pasted into the same-looking chat window, can have entirely different consequences depending on the account it runs under. This is why "we use AI carefully" is not a policy. A policy names tools, names tiers, and names what may enter them. I made the broader argument in AI Automation for B2B: what actually works: the gap between AI that helps and AI that hurts is almost never the model — it is the configuration around it.

Which client data should never go in?

Sort data into three bands and most decisions make themselves.

• Green — fine for any reputable tool. Public information: company names, websites, published job titles, your own marketing copy.
• Amber — business or API tier with a no-training commitment only. Internal working material: call notes, draft proposals, pipeline commentary, prospect lists.
• Red — stays out of third-party AI tools entirely. Anything covered by a client NDA or confidentiality clause, credentials and API keys, financial records you handle on a client's behalf, and any special category personal data under UK GDPR.

The red band is not about distrusting vendors. It is about a simpler problem: you cannot honour a confidentiality commitment when the data now sits in a system your client never agreed to.

What are the five boundary rules?

This is the mechanism we apply on every build.

1. When data identifies a person, minimise first. If the task works with "operations director at a 30-person recruitment firm", then the name and email address do not go in.
2. When a tool offers no business tier with a no-training commitment, then it receives no client data. Not "be careful with it" — none.
3. When a workflow sends data to a model automatically, then the boundary is enforced inside the workflow. A filter step before the AI step strips or blocks red-band fields. A policy document does not stop an n8n scenario running at 2am; a filter node does.
4. When a client asks where their data goes, then you answer in one paragraph. Named vendors, hosting region, retention period. If you cannot write that paragraph, you do not understand your own stack.
5. When in doubt, then the data stays in systems you already contract with. Your CRM and your email platform have signed processing terms; a novel AI tool discovered on Tuesday has not.

What should you check before adopting a new AI tool?

Five checks, in order: a data processing agreement you can actually download; no-training as the default, not a buried setting; a stated retention window; a published sub-processor list; and UK or EU data residency options if your clients care — many do. Under UK GDPR you typically remain the controller of client personal data while the AI vendor acts as a processor, which is precisely why the DPA matters: the obligations stay with you. That is a general description, not legal advice; for contractual specifics, speak to a solicitor.

Does drawing this boundary limit what AI can do for you?

Far less than you would expect. Most of the automation that actually generates revenue in B2B — the working patterns I covered in AI agents in 2026: what's real in B2B operations — runs on company-level data: firmographics, public signals, your own campaign metrics. Follow-up systems like the 90-Day Follow-Up Framework run on CRM data inside platforms you already have terms with. The boundary rules mostly exclude data that was never going to improve the output anyway. In practice, what kills automations is rarely the privacy boundary — it is the failure modes I set out in Why automations fail: the five usual suspects.

---

Next step: the Growth System Audit — £450, seven days, credited against any build — maps where your growth system leaks and what to build first.