Check data boundaries before introducing an AI tool

Identify the data a workflow needs, where it will go and which access, retention and approval questions must be resolved before use.

Purpose and fit

Use this before real organisational data is supplied to a new AI tool or a new integration. Evaluate the actual account, configuration and workflow. Do not assume that consumer, enterprise and API versions have identical terms or controls.

Before you start

Start with the data categories, current provider documentation and account/settings information you can lawfully access. Categories and redacted descriptions are enough to draft the checklist; do not upload restricted data or secrets to obtain advice. Use existing authorised non-sensitive material for any later configuration check; synthetic material is optional, not a prerequisite.

Use only information you are authorised to share with the chosen AI tool. Adjust the prompt to the fields and context you actually have; a specially created dataset is not required.

Required inputs

A data inventory using categories and sanitised examples
The intended tool, account tier, configuration and connected services
Current provider information and the organisation’s relevant policies
The business purpose, intended users and responsible data/system owners

Practical workflow

List the minimum information the task needs. Remove unnecessary fields. For a later authorised configuration check, prefer existing non-sensitive or appropriately redacted material; synthetic examples are optional and cannot establish behaviour on real sensitive data.
Trace each step: source system, upload/input, AI processing, connected tools, logs, exports and final storage. Include what recipients can access the output.
Gather current evidence for the questions below. Record the source, date and exact product/configuration it covers; mark unanswered questions as unresolved.
Ask the responsible owners to decide which data and uses are permitted, and under what conditions. Do not infer approval from a tool being available.
Test the approved configuration with safe material. Check access, sharing and any agreed deletion or retention behaviour before introducing the permitted real data.

Expected output

Expect a draft data-flow record and open-question checklist, not a legal compliance assessment or an approved tool. Only record an approval outcome when the authorised owner has actually supplied that decision. Actual access, sharing and retention behaviour require separate system-owner verification.

A draft data-flow record with an unresolved decision field until the authorised owner records an outcome: approved for a specific bounded use, approved with conditions, or not ready. The record includes the actual decision maker and review trigger when known.

Human checks

The data owner confirms necessity and permitted use. The system owner verifies actual settings and integrations. Security/privacy or other specialists address unresolved questions when the data or task requires their expertise. Redaction and anonymisation need checking; a removed name does not guarantee that a person cannot be identified.

Limitations

This checklist does not determine legal compliance or certify a provider. Terms, settings and service behaviour can change. A provider statement should be checked for the actual account and use. Do not assume deletion removes every backup or retained record unless supported by the applicable evidence.

Starter checklist

Workflow / tool / account configuration: ____________________ Data owner / system owner: ____________________

The business purpose and minimum required data are documented.
Sensitive, personal, confidential and third-party data are identified.
Authority to use and share each relevant data category is confirmed.
Every destination is mapped, including plugins, connectors, logs and exports.
Access roles and onward-sharing behaviour are checked.
Current information on retention, deletion, model training/use and provider access is reviewed for this exact service.
Relevant processing locations and service partners are checked where required by the organisation.
Settings and provider claims are supported by dated evidence.
Necessary specialist questions are resolved or block use of the affected data.
A safe test confirms the intended configuration and output handling.
The permitted scope, conditions, approver and review trigger are recorded.

For each unresolved item: question / evidence needed / owner / next step. Do not paste the sensitive data itself into this checklist or an unapproved AI tool.

Optional AI drafting prompt

Help me prepare the checklist above using only these authorised notes: [insert the available task, role and configuration notes]. Adapt the fields to my actual context.

For each destination and provider claim, identify the product/account configuration, dated source and verification status. Mark missing or contradictory evidence unresolved. Do not infer permission from tool availability, classify a use as legally compliant, or record approval without an actual owner decision.

Before drafting, ask a focused question if a missing detail materially changes the task or acceptance criteria. Otherwise produce a clearly limited draft and list the gaps. Label any non-critical assumptions; never invent facts, figures, sources, approvals or completed actions.

Data and AI output disclaimer

Use relevant data that exists or that you provide, with accuracy and completeness sufficient for the task. Different AI models and versions may produce different results, and responses may vary between runs. You are responsible for checking and validating the output against your own requirements, source information and acceptance criteria before relying on it.