Checklist: is this AI tool safe for client data?

It is structured along the three phases that the German Data Protection Conference (DSK) also distinguishes: selection, introduction and use of an AI application.

Note: This checklist is for orientation and does not replace legal or data protection advice in individual cases.

How to use the checklist: Items marked (M) are minimum requirements. If one of them is missing, the tool should not be used with client data.

Part A: Selecting the tool

A1 Contract and legal basis

• (M) Data processing agreement (DPA) under Art. 28 GDPR is in place
• (M) List of all sub-processors is available, including AI model providers, hosting and web search
• The provider informs you in advance about new sub-processors
• (M) For transfers to third countries such as the US, a legal basis is documented, e.g. standard contractual clauses
• Technical and organisational measures (TOMs) are documented and available for inspection
• Confidentiality and liability are regulated by contract

A2 Data location and processing

• (M) Clearly documented where data is stored (country, data centre)
• (M) Clearly documented where the AI models process the data. This is often not the same as the storage location.
• Option for processing exclusively in the EU available
• Backups, logs and web search are also covered by the location commitment

A3 Training and data use

• (M) Contractually assured: no training of the AI models with your data, also not by the model providers
• It is regulated how long inputs and results are stored
• Clarified whether and when provider staff can view data, e.g. for abuse monitoring
• Checked whether the underlying AI model was trained in compliance with data protection law. The DSK also explicitly points this out.

A4 Security and evidence

• Certification under ISO 27001 and/or SOC 2 Type II, held by the tool provider itself, not just by the hosting service provider
• Independent penetration test carried out
• Encryption in transit and at rest
• Process for security incidents, including immediate notification, described
• Trust centre or security documentation publicly available

Part B: Introduction in the firm

B1 Access and separation

• (M) Strict separation of the data of different customers of the provider
• (M) Separation between your engagements: data from engagement A is not visible in engagement B
• Existing access rights, e.g. from SharePoint, are adopted
• Sign-in via single sign-on (SSO) and/or two-factor authentication
• Roles and permissions defined in the tool
• Log of all access and actions (audit log) available

B2 Internal organisation

• Selection decision and review documented. The DSK explicitly recommends this, even if no data protection impact assessment is mandatory.
• Checked whether a data protection impact assessment (Art. 35 GDPR) is needed
• Tool recorded in the record of processing activities
• Internal AI policy: which data may go into which tools?
• Employees trained and made aware of whether and how they may use AI applications
• Data protection officer involved

B3 Client contracts

• Non-disclosure agreements (NDAs) with clients checked for AI use
• Where needed, AI use and the type of quality assurance agreed with the client
• For auditors, tax advisors and lawyers in multidisciplinary firms: professional duties of confidentiality taken into account

Part C: Ongoing use

C1 Results and traceability

• Results are backed by sources
• Human review before use in the deliverable is firmly provided for
• It is traceable how a result came about
• The accuracy of results is checked. This is also a GDPR requirement, which the DSK highlights.

C2 Regular review

• Changes to sub-processors and models are tracked
• Certificates and evidence are re-checked annually
• Transparency obligations under the EU AI Act checked, e.g. for chatbots or published AI content
• Deletion of data after the end of the project regulated and implemented

Evaluation

Questions to ask the provider (to copy)

1. Can you send us the DPA, TOMs and the complete list of sub-processors?
2. Where exactly is our data stored, and where do the AI models process it?
3. Is it contractually excluded that our data is used for training, including by the model providers?
4. How long are inputs and results stored, and who can view them?
5. Which certifications do you hold yourselves, and when was the last independent penetration test?
6. How do you separate data between customers and between projects?
7. Are our existing access rights, e.g. from SharePoint, adopted?
8. Is there an option to process all data exclusively in the EU?