AI training data opt-out is configured

GDPR Article 28 requires that when a processor (AI provider) uses sub-processors or uses data for additional purposes (like model training), the controller (you) must be aware of and have agreed to those terms. CCPA §1798.100 and NIST AI RMF GOVERN 6.1 both require transparency about how user data is used by third parties. By default, some consumer-tier AI API plans allow the provider to use API data for model improvement. For B2B products or any application handling sensitive user data, allowing user conversations to feed into a third party's training corpus without user disclosure is a material compliance gap.

Verify your training opt-out status with your AI provider and document it in code. Steps vary by provider:

• OpenAI: API data is not used for training by default for API users. Confirm at platform.openai.com → Settings → Privacy. For contractual guarantees, use Azure OpenAI.
• Anthropic: API data not used for training by default. Verify at console.anthropic.com → Settings.
• Google: Use Vertex AI rather than AI Studio for enterprise data terms.
• Azure OpenAI: No training use by default under Microsoft's enterprise DPA.

Document the verification in your AI client configuration file:

// lib/ai/client.ts
// DATA POLICY: Using Azure OpenAI — data not used for model training
// per Microsoft Enterprise DPA. Verified: 2025-01 via Azure portal
// Data & Privacy settings. Re-verify on contract renewal.
const openai = new AzureOpenAI({ ... })

Set a calendar reminder to re-verify at contract renewal — provider terms change.