Cleared for reporting, but for AI? How do you track what data can be used for?
I’m the PM on a B2B product (not an engineer, so plain words). A lot of our customer data was cleared long ago for one thing, like dashboards and monthly reports. Now someone wants to use the same tables for an AI feature.
A made-up example: support tickets that were fine for counting volume are now going to be summarized, word for word, by an outside model.
Why it’s hard, as far as I can tell: nobody wrote down what the data was cleared for. The answer lives in an old contract, a Slack thread, or one person’s memory. The data itself only says “you have read access”.
What we’re trying (early, could be wrong): a short note on each dataset saying which uses are OK, and asking again whenever a new AI use comes up instead of assuming.
Two questions:
When a team wants to use existing data for a new AI feature, who says yes, and how do they check?
Do you write down allowed uses per dataset anywhere, or is it handled case by case?
Replies
Small consumer app, but the same question, and what works for me is treating the privacy policy as the written list of allowed uses, per data item. Each item says what it is used for and which outside service sees it, and when a use changes, the written answer changes with it. A real case: photos a user picked were at first described once by a model and not kept. When a photo slideshow feature needed to store them with the song, the policy paragraph, Google Play's data safety form and the App Store privacy answers were all updated the same day. The rule underneath: data reaches a new model or a new place only if a written line covers it. Your note per dataset is the same idea, just inside the company.