{"slug": "can-companies-use-customer-data-to-train-ai-a-legal-review", "title": "Can Companies Use Customer Data to Train AI? A Legal Review", "summary": "Companies can train AI models on customer data only when their contracts, privacy commitments and applicable law permit that specific use, according to a legal review published by GC AI, whose legal AI software is used by 2,100 legal teams including those at TIME, SKIMS and Lockheed Martin. The review says teams must check each customer's signed agreement, order, data processing agreement and amendments before training, and notes FTC staff guidance warns companies providing AI models can face enforcement for failing to honor privacy and confidentiality commitments, including promises about training. GC AI's example involves a product team seeking to train one ticket-categorization model for all customers on 2025 support tickets from three customers, where stripping company names still leaves ticket text, attachments and corrections identifiable.", "body_md": "Yes, companies can train AI on customer data, but only when their contracts, privacy commitments, and the law allow that specific use. Having the data isn't the same as having the right to train on it. What each customer agreed to when the data was collected, and what the company has promised publicly, set the limits.\n\nGC AI, turnkey legal AI software used by 2,100 legal teams, including those at TIME, SKIMS, and Lockheed Martin, helps you check whether planned training is allowed before the product launches. It reviews each customer's agreements and identifies terms that allow or restrict the proposed training, with citations for you to check. For a broader contract-review framework, see our AI contract review guide.\n\nWhat Customer Data Will the AI Model Use?\n\nStart by asking exactly how the product team plans to use the data. Permission for one use may not cover another. “Improve our AI” is too vague to approve. Ask the product and engineering teams for:\n\nSource and contents: Which customers, collection dates, fields, attachments, personal data, and third-party material are included?\n\nUse: Which model and provider will the team use, and who is responsible for the work? Will the feature analyze data to answer a request, adapt a model for one customer, or train a model used across customers?\n\nResult and access: Who can use the model and anything created from it? Can either be reused for another product?\n\nRecipients and storage: Which internal teams, model providers, or other processors receive the data, and what do they retain or review? A provider's promise not to train on the data doesn't tell you how long it keeps the data or whether its staff can read it.\n\nRemoval and change: Can the team exclude a customer from future training, remove source copies, or address a model trained on that data? Who is responsible for each step?\n\nThe Example: A Support-Ticket Model\n\nYour product team messages Legal: “Can we use last year's support tickets to train a model that categorizes tickets for all customers if we strip out company names?” The feature is already on the roadmap.\n\nThe team wants to train one model for all customers using 2025 support tickets from three customers and the corrections support agents made to those tickets. Removing company names still leaves the ticket text, attachments, and corrections, so treat the records as identifiable until the team shows otherwise.\n\nDo the Customer Terms Permit AI Training?\n\nOnly if each customer's terms allow it.\n\nPermissions can differ from one customer to another, even when the records sit in the same support system. For each customer, review the signed agreement, order, data processing agreement (DPA), and amendments. Also check policies made part of the agreement, notices provided when the data was collected, and any later permission for training. Watch for an improvement or analytics clause that sounds broad but is defined to exclude the customer's content. Our SaaS agreement guide covers how AI training and output rights fit within a vendor negotiation.\n\nPromises outside the contract count too. FTC staff guidance warns that companies providing AI models can face enforcement for failing to honor privacy and confidentiality commitments, including promises about training. The agency has also cautioned companies about changing terms or privacy policies to allow AI training on data already collected. Read customer-facing statements alongside the contract.\n\nCheck that the customer's permission covers the proposed training. You may still need other permissions to use personal information, third-party content, or confidential material in the dataset.\n\nAsk privacy counsel to review whose data is included, how it will be used, what notices people received, who will receive it, and which laws apply. Confirm that the customer has the right to authorize the use. If the dataset includes data from multiple jurisdictions or regulated information, check those requirements before releasing it. For a broader view of privacy counsel's role in product decisions, see our related guide.\n\nFor the contract side of that review, add each customer's agreements to GC AI's Files along with the product team's request. Ask GC AI to organize the findings by customer and contract version, cite terms that allow or restrict training, and flag where permission is missing. Check the cited clauses to see which customers have agreed to the proposed use.\n\nHow One Customer's Terms Apply to the Example\n\nFor one of the three customers, the agreement limits processing to the services supplied to that customer:\n\nProvider may process Customer Content solely to provide the Services to Customer.\n\nIts separate improvement provision says:\n\nProvider may use Usage Data to improve its products. Usage Data means service activity metrics and excludes Customer Content.\n\nUnder this agreement, ticket text and agent corrections are Customer Content. The improvement clause only permits use of service activity metrics, so it doesn't allow training a model for other customers on those tickets. Record the findings in a permission matrix, a table showing what each customer allows:\n\nReview Item\n\nFinding for This Customer\n\nData and proposed use\n\nTicket text and support agents' corrections, treated as Customer Content, for training a model used across customers.\n\nSupporting language\n\nProcessing is limited to providing Services to this customer. The improvement clause excludes Customer Content.\n\nRecommended decision\n\nKeep training on hold until the customer permits use of this dataset and Legal completes the remaining rights review.\n\nWho acts next\n\nThe account manager requests the amendment, and Legal checks it.\n\nReview the other two customers' terms before combining their records. For each customer, record which document versions apply and the clauses that support your findings in the permission matrix.\n\nWhat Permission Would Let This Training Proceed?\n\nIf the customer agreements don't allow the proposed training, consider these options:\n\nEvaluate on test data: The product team can keep testing with approved data created without customer records while Legal reviews permission to use the customer data. Check how that data was made; copying or relabeling customer tickets still requires a rights review.\n\nLimit the model to one customer: Training a model for one customer using only that customer's records may fit within the agreed Services. Ask Engineering to document who can access the model, how customer data stays separate, what outside providers do with it, and whether it can be reused. Then check whether the agreement permits that design. Limiting access alone does not give you permission.\n\nGet express permission: Specify which data will be used, how the model will use it, and who can use the model. Complete the privacy and third-party-rights reviews separately.\n\nThe Example's Permission Clause\n\nIn this example, company policy requires Legal's review, the customer's express permission, and completed privacy and third-party-rights checks before Customer Content can be used to train a model for other customers. The proposed clause covers each signing customer's listed ticket text and agent corrections and excludes attachments:\n\nSample Permission Clause\n\nCustomer authorizes Provider to use only that Customer's support-ticket text and support agents' corrections identified in Schedule A to train the support-ticket categorization model described in Schedule B for use across Provider's customers. Attachments are excluded. No other Customer Content or feedback is included. Provider may not use the approved dataset to train another model or develop another product without a further written agreement.\n\nFill in the schedules, safeguards, and terms for ending the permission. Check that the clause works with the rest of the agreement before sending it to the customer.\n\nFrom Contract Review to a Decision the Product Team Can Use\n\nAfter you check each customer's findings, use GC AI to draft the amendment and instructions for the product team. Check that the permission matrix, clause, and message all cover the same data and use.\n\nExample Prompt\n\nFor each customer, check whether the agreement allows support-ticket text and agent corrections to be used to train a model for other customers. Return a table identifying the document that applies, the clauses that allow or restrict training, and any missing permission. Draft a permission clause for each customer that needs one.\n\nUse Exact Quote to check each cited clause against the source document. If you need to check whether the proposed use matches the privacy notice, use Research to find relevant legal and government sources, then review the cited authorities. When a customer needs an amendment, edit it in GC AI for Word or in Easy Edit.\n\nThe Message to the Product Team\n\nGive the product team a short update explaining what can continue, what is on hold, and who acts next.\n\nFor this example: training on the customer dataset is on hold because at least one agreement allows ticket content to be used only to provide that customer's services. Testing can continue with data created without customer records. Account managers are requesting permission, and Privacy is reviewing the personal data.\n\nLegal will release the dataset once the amendments are signed and Engineering confirms which fields are included, who receives the data, who can use the model, and how removal will work. The released version excludes attachments and includes only records each customer has expressly permitted.\n\nKeeping the Decision Current\n\nSave the reviewed matrix, document versions, signed amendments, and approval record with the dataset documentation. Have Engineering confirm that training uses only the approved dataset and leaves out excluded records. The product team should name someone to ask Legal for a new review if the data, model, recipients, purpose, or customer terms change.\n\nUse GC AI to review the customer agreements, draft any needed permission clauses, and prepare the product-team update. Check the cited terms before deciding whether training can proceed.\n\nGC AI does not use Customer Data to train generative AI models, and its model providers are prohibited from training on your data. Your data is stored separately from other customers' data and encrypted during transfer and storage. You can delete inputs and outputs in the app and request deletion of your organization's data.GC AI still stores data to provide the service. Some records are retained for legal or operational reasons. The self-serve terms allow GC AI to improve the service using combined data with identifying details removed. Private previews have separate rules for how your data can be used. Check the agreement that applies to your account.\n\nCan New Terms or an Opt-Out Setting Authorize Use of Earlier Customer Data?\n\nNot by themselves. Check whether the change legally updates the commitments that applied when the data was collected. Confirm which data and uses it covers and when it takes effect.\n\nDoes Deidentifying Customer Data Make It Available for AI Training?\n\nNo, not automatically. The process must meet the applicable legal and contractual standards, and confidentiality, third-party rights, or restrictions on use may still apply. Check whether people or companies can still be identified from the remaining records. Calling the data deidentified is not enough.\n\nWhat If a Customer Withdraws Permission After a Model Has Been Trained?\n\nThe response depends on the agreement and applicable law. Stopping future training, deleting stored records, and deciding what to do with a model already trained on those records are separate tasks. Ask the engineering team and any provider what each process can achieve before promising removal from a trained model.", "url": "https://wpnews.pro/news/can-companies-use-customer-data-to-train-ai-a-legal-review", "canonical_source": "https://gc.ai/blog/customer-data-ai-training-permission", "published_at": "2026-11-09 00:00:00+00:00", "updated_at": "2026-11-09 21:51:24.395161+00:00", "lang": "en", "topics": ["ai-policy", "artificial-intelligence", "ai-ethics"], "entities": ["GC AI", "TIME", "SKIMS", "Lockheed Martin", "FTC"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/can-companies-use-customer-data-to-train-ai-a-legal-review", "markdown": "https://wpnews.pro/news/can-companies-use-customer-data-to-train-ai-a-legal-review.md", "text": "https://wpnews.pro/news/can-companies-use-customer-data-to-train-ai-a-legal-review.txt", "jsonld": "https://wpnews.pro/news/can-companies-use-customer-data-to-train-ai-a-legal-review.jsonld"}}