Which AI tools need consent and which do not (the control question)

1 · Learn the move · Comparison matrix

The question is not which vendor. It is who controls the data once it leaves your screen. A tool under a firm agreement, with no training on inputs, a stated retention period and a data processing agreement, keeps the information under terms the firm chose; that is the posture OPR described as secure and enterprise-approved [P]. A consumer plan on the same vendor's model keeps it under terms the vendor chose for the public, and may train on it [P]. The matrix has four columns: who can see it, is it used to train, how long is it kept, is there a signed agreement with the firm. Fill it from each vendor's own page, with the date you read it, because every one of these changes. A row that reads 'no training, stated retention, firm agreement' is the row for de-identified work with a consent on file for anything more. A row with a 'may train' in it is the row for nothing identifiable, ever. The dated vendor notes under this lesson hold what each page said when it was read; the lesson states none of it as current. Draft copy, not legal advice.

Build a control matrix for the AI tools my firm is considering. Rows: [the tools and plans, pasted]. Columns: who can see what I send | used to train | retention | agreement with the firm. Fill each cell only from the vendor page text I paste, quoting the line, or write [NEEDS: the line from the vendor page] if the text does not say. Add a final column, 'what goes in', with exactly one of: nothing identifiable | de-identified only | de-identified, and named-client work only under a signed consent. Never upgrade a cell because a vendor is well known. Date the matrix with the date I read the pages.