Check whether an AI vendor uses submitted data for training

Start with the exact product, account type and feature that will receive the business data. Check the governing terms for what they cover and whether submitted data may be used to train models; do not carry a rule from one product or account to another.

Record the answer for the proposed task, including any gaps about uploaded files, connected content or feedback. A general “business data” claim is useful only if it applies to the account and workflow you plan to use.

Check a vendor's training rule

Identify the account and feature

Record the exact product, sign-in and account type, plan, and feature. A vendor may apply different rules to individual accounts, business workspaces and APIs, so verify the account the team will actually use.

Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat. Some experiences, licences and capabilities may still use the former names during the transition, so check the specific service and subscription rather than relying on “Copilot” alone.

For Microsoft Copilot and Microsoft Copilot Chat as used by organisations, Microsoft says the governing documents are the Microsoft Products and Services Data Protection Addendum (DPA) and Microsoft Product Terms. Microsoft acts as a data processor, and enterprise data protection (EDP) refers to the commitments and controls that apply to customer data for those users.

Microsoft says Copilot follows administrative settings, and that specific controls and policies vary by underlying subscription plan. Check the settings and terms for the actual subscription; do not assume a setting changes training unless its wording says so.

Record a precise determination

For the proposed task, record:

A completed Microsoft determination can state: Microsoft Copilot or Microsoft Copilot Chat used by an organisation; EDP applies under the DPA and Product Terms; Microsoft acts as a data processor; prompts and responses are covered; customer data is not used to train foundation models.

The stated coverage names prompts and responses. Do not extend it to uploaded files, connected content or feedback unless the terms for the exact subscription confirm that those categories are covered.

If a vendor uses wording such as “service improvement”, ask what activities it includes. Training, safety review and other processing are not interchangeable; ask the account owner to confirm any unresolved point in writing and identify the applicable terms or control.

Keep the determination with the task and review date. Recheck it when the plan, integration, feature or setting changes.

Record a precise determination

Decide what may be submitted

The OAIC publishes Guidance on privacy and the use of commercially available AI products. Consider it alongside the product’s applicable terms when deciding whether a proposed use of business information is appropriate.

If the training rule or its coverage remains unresolved, use material that is authorised and non-sensitive until the account owner confirms the position. Check the exact product and account again before relying on that answer for live business data.