Your customers' data in the hands of an AI: seven questions for the provider

What changes when an AI reads your customers' conversations

What changes is that there is a third party in the middle, and that you are still the one responsible.

Personal data protection with artificial intelligence is not a new regime: in Argentina it is Law 25.326 applied to a new situation, and wherever you are the local statute does the same job. Your customer's name, phone number and whatever they told you are personal data, whether a person or a system processes them.

The enforcement authority in Argentina is the Agency for Access to Public Information (AAIP), which has also published a guide on the responsible use of artificial intelligence and a national programme on transparency in its use.

The confusion to get rid of first

The provider complying does not let you off the hook.

Your customer gave their data to you. Choosing a tool that processes it was your decision, and the responsibility towards that person stays yours. The provider is a link, not an umbrella.

That is why the questions below are not a procurement formality. They are what you will have to be able to answer if somebody asks.

1. Do you use my conversations to train models?

The most direct question, and the one most often dodged with long answers.

What you are looking for is an explicit no, in writing. Your customers' conversations belong to you and to them; feeding somebody else's model with them is a transfer of data nobody authorised you to make.

Our answer: they are not used to train models.

2. Who, inside the provider, can read them?

Different from the previous one, and almost never asked.

Not training models is one thing; who has access to the database is another. Ask whether access is per-named-person, in what cases somebody looks at a conversation, and whether that gets logged.

3. Where is it stored and under what agreement?

Location matters less than the contract, but both are worth asking about.

Ask which infrastructure providers sit behind it and what certifications they hold. And ask for a confidentiality agreement if your operation justifies it: a provider who cannot sign one is telling you something.

4. Do you tell my customer they are talking to an automated system?

Here the regulatory direction is clear.

The AAIP's national programme on transparency in the use of artificial intelligence points towards people knowing when there is an automated system on the other side. It is not just courtesy: it is the axis of the regulatory approach, and privacy regimes elsewhere are converging on it.

In practice it also pays commercially. The anger does not come from talking to a system, it comes from finding out late.

5. What happens to the credentials of my other systems?

If you connect your management system, you are handing keys to a third party.

Ask how they are stored and whether they can be read back from outside. The correct answer is that they are encrypted and never returned, neither to the panel nor to anybody querying the API.

6. What gets recorded about what the system did?

A system that decides and leaves no trace is impossible to audit.

Ask which actions get written down and where. And ask what does not: an honest provider will tell you where the record ends. In our case four concrete actions are kept as private notes, and of those only the handoff records its reason.

7. What happens to the data if I leave?

The last one, and the one that says most about a provider.

What you take with you, in what format, and what happens to what stays on their side. Ask before signing, while you still have negotiating power.

The seven, to take away

#	Question	The answer you want
1	Do you train models on my conversations?	No, in writing
2	Who can read them?	Limited, logged access
3	Where are they and under what agreement?	Named infrastructure, a signable agreement
4	Is it disclosed that this is an automated system?	Yes, and configurable
5	How do you store my credentials?	Encrypted and non-retrievable
6	What gets recorded?	Actions written down, and the limits stated
7	What do I take with me if I leave?	A concrete answer, before signing

Key takeaways

• Data protection law applies just the same when the processor is an automated system.
• In Argentina the AAIP is the enforcement authority and has published a guide on the responsible use of artificial intelligence.
• Responsibility towards your customer stays yours, even when the provider complies.
• Training models and being able to read conversations are two different questions.
• Transparency about the use of automated systems is the axis of the regulatory approach.
• Ask how to get out before you get in, including which data you take with you.