Data Governance
Rules about what data may be used, by whom, and retained how long.
The policies and controls around data used with AI systems: what may be sent to a provider, retention periods, residency, access controls, deletion rights.
This is where most enterprise AI projects actually die, and it is decided by contracts and architecture rather than by the model. Ask early whether the provider trains on your data and where it is stored.
The questions that decide most of it are concrete: what leaves your network, who can retain it and for how long, where it is stored, and how deletion works in practice. Provider documentation answers the first three per vendor; the fourth is usually your own system and is usually the weakest part.
Retention you did not choose
A provider retains inputs under a default abuse-monitoring period.
Check the data controls rather than assuming, and establish whether your account qualifies for zero retention. This is a configuration decision with a compliance consequence, and it belongs in the design review rather than in legal review after launch.
- docsData controls in the OpenAI platform ↗
Training-use and retention controls, including default abuse-monitoring retention and Zero Data Retention eligibility. Vendor-specific, and no substitute for your own privacy review.
- standardAI Risk Management Framework: Generative AI Profile (NIST AI 600-1) ↗
The official record for the cross-sector GenAI companion to the AI RMF. Use it as the governance vocabulary; the PDF itself was not machine-readable in this research pass, so do not quote definitions from here.