Start with the right question
A legal AI procurement decision should describe the actual data flow. Consumer accounts, enterprise contracts, and optional features may have different settings. Record the specific plan and policy version instead of assuming a vendor-wide marketing statement covers your use.
Work through the checks
Inventory the data
List prompts, attached records, generated answers, user identifiers, and diagnostic logs. Ask which are stored and where each can be accessed. A deletion control may cover only some categories.
Ask about secondary use
Request a clear explanation of training, evaluation, abuse monitoring, and human review. Note opt-out requirements and whether they apply prospectively. Do not infer exclusions from a generic confidentiality sentence.
Test export and deletion
Use non-sensitive sample material to inspect available exports and deletion controls. Ask about backups, legal retention exceptions, and account closure. Record limitations rather than claiming complete erasure from a button click.
Check operational access
Identify account roles, shared workspaces, integrations, and support access. Ask how access is revoked when a person leaves. A secure vendor cannot compensate for an accidentally public workspace setting.
A record you can use
- Plan and policy version
- Data category and purpose
- Retention and deletion limits
- Training or review setting
- Unanswered contractual question
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional team compares two plans from the same vendor. One retains uploaded documents under a workspace policy; the other uses an individual account policy. The team records the difference and postpones uploading client records until the intended plan and contract are confirmed. The brand name alone does not settle the issue.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
This checklist is not a security certification or a conclusion that a product meets professional confidentiality obligations. Vendor answers can change, and sensitive legal data may require specialist contractual and security review.
Keep dated written answers with the procurement decision. Revisit the review when the plan, integration, retention setting, or intended category of information changes.