A Cybersecurity Awareness Month series from Thompson Coburn’s Data Governance, Privacy and Cybersecurity practice group
Throughout Cybersecurity Awareness Month, Thompson Coburn is examining how organizations can put AI to work while maintaining control over their information. Our series focuses on practical decisions involving data inventories, access, permissible use, and vendor oversight.
In the first two installments, we explored foundational data governance considerations, including why organizations need to understand what information they retain and what their AI systems can access.
In this third installment, we turn to a different question: Just because an organization has the data, does it have the authority to use it for AI?
A New Use for Familiar Data
Consider a company that has used the same customer service platform for years. The platform contains customer communications, transaction histories, and service records. Its vendor introduces a new AI assistant that can analyze historical interactions, summarize conversations, and identify trends.
The opportunity is appealing. The company already has the information, the vendor relationship is established, and the feature promises operational efficiencies. But the introduction of AI may change how that information is processed, who receives it, and what happens to it afterward.
What if the vendor has the ability to use customer interactions to improve its models. Perhaps a new subprocessor receives information that previously remained within the original platform. Or maybe employees begin submitting confidential customer records to a separate AI tool without realizing those activities fall outside existing contractual permissions.
None of these circumstances necessarily prevents the company from deploying AI. But each raises a question that should be resolved before implementation.
Existing Obligations Still Apply When Technology Changes
The Federal Trade Commission’s 2021 enforcement action against Everalbum offers a useful illustration. Everalbum operated a photo storage application that used facial recognition technology. The FTC alleged that the company misrepresented how that technology was enabled and failed to honor commitments to delete certain user photos and videos. The agency’s final order required Everalbum to delete specified information and facial recognition models and algorithms developed using users’ photographs and videos.
The case predates the widespread adoption of today’s generative AI tools, but its significance extends beyond facial recognition. An organization’s representations about how it collects, uses, and retains information have real implications. Those commitments do not disappear when the organization identifies a valuable new application for the data.
The FTC reinforced that principle in 2024, warning that companies could engage in unfair or deceptive practices by quietly changing privacy policies or terms of service to permit materially broader uses of previously collected information, including AI model training. That warning is particularly relevant when organizations seek to repurpose historical customer information.
Changing a privacy policy does not necessarily establish authority to use previously collected information for a new purpose. Depending on the circumstances, existing commitments and applicable law may require additional disclosures, consent, contractual changes, or restrictions on the proposed use.
The Contractual Risk Hiding Inside AI Deployment
Regulatory obligations are only part of the analysis. Organizations also need to consider promises made to customers, business partners, and other third parties.
A company may have committed to use customer information only to provide specified services, maintain confidentiality, limit subcontracting, or obtain approval before engaging additional subprocessors. An AI tool’s capabilities or contractual terms may not align with those commitments. For example, a service provider may be authorized to process customer information to perform contracted services, but not to allow a technology vendor to use that information for independent model training or product development. Even where applicable privacy law permits a particular processing activity, the company’s contractual commitments may impose narrower restrictions. The resulting risk is not necessarily apparent to the employee activating the feature or the IT team implementing the integration. And where the AI functionality arrives through an update to an existing vendor product, the organization may not recognize that a material change in data processing has occurred at all.
This is why AI governance cannot be limited to reviewing new technology purchases. It must also account for changes in how existing tools use information.
AI Does Not Require a New Law to Create Legal Exposure
Recent litigation and regulatory enforcement underscore another important consideration: organizations should not assume that AI-specific legislation is the only source of AI-related legal obligations.
Plaintiffs have asserted claims under existing wiretapping, biometric privacy, consumer protection, and other statutes based on how AI technologies collect, process, and use information. Courts have reached differing conclusions depending on the claims and facts involved. For example, litigation involving AI-enabled customer communications has raised questions about whether technology vendors’ access to conversations, particularly for their own model improvement, fits within applicable statutory exceptions and consent requirements. Separately, the FTC’s 2025 final order against DoNotPay addressed allegedly deceptive representations about the capabilities of its AI-powered legal services.
These matters concern different legal theories. Together, however, they reinforce a practical governance point: organizations need to understand both what their systems are doing and whether those activities are consistent with applicable obligations and representations.
From Legal Obligations to Operational Decisions
The challenge for organizations is translating these requirements into decisions that can be made consistently without unnecessarily slowing innovation. A practical AI-use review should address five questions:
- PURPOSE — What use of the information is currently authorized?
Identify why the information was collected, the organization’s relevant privacy representations, and any legal or contractual limitations on its use. Different categories of information may carry different restrictions. - PROCESSING — What will the AI functionality actually do?
Determine what information the tool receives, whether it retains prompts or outputs, whether data is used for training or model improvement, and whether the functionality introduces new processing purposes. - PARTIES — Who will receive or use the information?
Identify relevant vendors and subprocessors. Compare their actual processing activities and contractual rights with the organization’s existing obligations, including confidentiality, onward transfer, and data-use restrictions. - PERMISSION — Who can authorize the proposed use?
Establish who owns the business decision, who evaluates legal and contractual requirements, and who confirms technical implementation. If existing permissions are insufficient, the organization needs a decision: obtain the necessary authorization, negotiate additional restrictions, modify the configuration, exclude certain data, or decline the use. - PROCESS — How will changes be identified and reviewed?
Determine what should trigger renewed review, including new AI capabilities, changes in vendor terms, additional subprocessors, broader data access, or expanded purposes. Document the approved use, applicable conditions, responsible owners, and required follow-up.
These questions can be incorporated into existing procurement, vendor management, privacy assessment, and change-management processes. The objective is to make sure the right questions reach the right decision-makers before a change in technology becomes an unexamined change in legal or contractual exposure.
Keep Control of the Decision
AI can unlock meaningful value from information an organization already possesses. But that value depends, in part, on understanding the boundaries surrounding its use. Organizations should not have to choose between innovation and compliance. They do, however, need to distinguish between information that is technically available and information that is authorized for a particular purpose.
Implementing this successfully requires more than an acceptable-use policy or a one-time legal review. It requires a process for identifying proposed changes in data use, resolving questions about authority, assigning ownership, and implementing decisions consistently. Before asking what AI can do with your data, establish what your organization is permitted to let it do. That is how organizations put AI to work while keeping control of their data.
Follow along as we continue our Cybersecurity Awareness Month series, Put AI to Work. Control Your Data., exploring practical strategies for managing AI-related risks and strengthening data governance. To discuss how these considerations apply to your organization, reach out to Thompson Coburn’s Privacy and Cybersecurity team. We welcome the opportunity to continue the conversation.
