Check Approved Tools, Training Use and Retention

The logo is not the approval

The same product family can offer personal accounts, work accounts, different subscriptions and optional connected features. Your organisation may approve one setup for a particular kind of work and prohibit another.

Check the actual account and workspace before you paste or attach anything. A paid subscription, work email address or reassuring lock icon does not by itself establish that your employer has approved the data handling. If you cannot verify the setup, use fictional material while the designated team resolves it.

Five different data questions

These answers are separate. Not used for model training does not mean not stored. Encryption does not establish permission to upload. A local application may still call a cloud service. A private chat is not necessarily private from administrators or authorised service operations.

For a concrete example, Microsoft's enterprise Copilot data guidance says relevant prompts, responses and Microsoft Graph data are not used to train foundation models, while also describing stored interaction records. That example illustrates the distinction; it is not a statement that every product called Copilot has identical terms or that your use is approved. Consult the documentation and settings for your actual deployment.

Ask a useful approval question

You do not need to interpret a vendor contract on your own. Give your IT, security, privacy or data owner enough non-sensitive context to answer the right question. Describe the type of data without attaching the real file.

I want to use AI to [task].
The information would include [data categories, without real records].
The proposed tool, account/workspace and feature are [details].
It would need to [draft/read/edit/send] and the output would go to [audience].

Is this combination approved? Which inputs, connections, retention settings and review steps are required?
If it is not approved, is there an approved alternative or a way to do the task without uploading the material?

A decision with one missing answer

Fictional situation: an approved work assistant can summarise internal process notes. A newly enabled extension sends requests to a separate document service. The extension's approval is unknown.

Worked decision: keep the extension off and use the previously approved workflow, if it still meets the task. Ask the designated team about the new recipient and its data handling. Approval for the assistant is not automatically approval for every added service.

Keep a reference to the approval and its scope in your work plan. Recheck when the account, feature, data or task changes. Do not copy sensitive contract terms into another assistant to ask whether they permit the upload.