GASP AICF

Search controls and profiles

Search by control ID, name, domain or profile

AIG-040 Customer Data Use in Model Training

Tier 2+AIProviderDeployerGPAI Model ProviderManaged Service Provider

Description

Whether customer content and customer-derived data may be used to train, fine-tune or evaluate the organisation's models is stated in the customer agreement and in the product documentation, in terms that agree with each other. Where such use takes place, the record for each customer shows the date and the basis relied on, consent or a term of the contract. A control available to the customer stops its data entering training, takes effect inside a stated period and is recorded when it is exercised. Training, fine-tuning and evaluation datasets are drawn only from sources carrying a recorded permission for that use. Data from customers without one is excluded by the pipeline, not by instruction. Dataset lineage records which customer sources each dataset version drew on, so an exclusion can be demonstrated after the fact.

Rationale

AIG-013 records where every training input came from and on what basis. AIG-040 does not restate that record. It governs one source, the data a customer entrusted to the organisation to run a service. To that it adds a statement in the agreement the customer can read, a control the customer can operate and a pipeline that enforces the result. AIG-012 is dataset quality and AIG-014 is special category screening; neither asks whose data it is. DAT-019 holds the lawful basis for processing and DAT-010 the consent mechanics; the training purpose is the further-processing case those controls do not single out. AIG-032 is this question put to a model provider rather than answered as one. What makes the control testable is the enforcement: the claim an assessor can fail is that a customer who withheld permission cannot be found in a dataset version. Demonstrating that needs lineage, not an assertion. Where a customer agreement is silent, no permission exists: silence is a fail and not a default. Provider seat (ADR-031).

Applicability (9 profiles)

SaaS AI Providerstablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

Enterprise AI Deployerstablerequiredsatisfied by provider

The deployer is the customer. It obtains the provider's statement on whether its inputs are used for training, exercises the opt-out and records the answer in the AIG-032 assessment.

GPAI Model Providerstablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

High-Risk Provider (EU)stablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

Public Body Deployer (EU)stablerequiredsatisfied by provider

The deployer is the customer. It obtains the provider's statement on whether its inputs are used for training, exercises the opt-out and records the answer in the AIG-032 assessment.

Data Act Cloud Provider (EU)stablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

DORA ICT Provider (EU)stablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

HIPAA Business Associate (US)stablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

NIS2 Cloud Provider (EU)stablerequiredrole duty

The statement on customer data in training and the opt-out are the provider's to give.

Framework Mappings (13)

DSP-12Limitation of Purpose in Personal Data Processinginformative
DSP-15Limitation of Production Data Useinformative
DSP-12Limitation of Purpose in Personal Data Processinginformative
DSP-15Limitation of Production Data Useinformative
GDPR-Art.13.3Notice of Further Processingpartial
GDPR-Art.5.1bPurpose Limitationinformative
GDPR-Art.6.1Lawfulness of Processing: the Six Legal Basesinformative
GDPR-Art.6.4Compatibility Test for Further Processingpartial
GDPR-Art.7Conditions for Consentpartial
A.7.3Acquisition of datainformative
GV-4.2-001Organisational AI Risk Communication | GV-4.2-001informative
MS-2.2-003Human Subject Evaluation Requirements | MS-2.2-003informative
LLM02Sensitive Information Disclosurepartial

Evidence (3)

contractdocumentmanual

The customer agreement clause governing use of customer content for model training, together with the matching statement in the product documentation and in any published trust page.

Example: Master Services Agreement v7 clause 9.4 of 1 February 2026, with the corresponding paragraph of the published AI data handling page.

Test: Verify: (1) the agreement states whether customer content may be used to train, fine-tune or evaluate models, rather than leaving it unaddressed, (2) the product documentation says the same thing and does not offer a broader or narrower permission, (3) where use is permitted, the clause names the control the customer can operate to stop it and the period inside which it takes effect, (4) the clause version in force for a sampled customer matches the version the register records for that customer.

configurationtechnicalautomated

The training pipeline configuration that filters source data by recorded training permission, with the dataset lineage record for a recent dataset version naming the customer sources it drew on.

Example: Pipeline definition training/build_dataset.yaml at commit 4f21c8e and the lineage manifest for dataset customer-corpus v2026.06.

Test: Verify: (1) the filter reads the permission state from the system of record rather than from a static list, (2) the pipeline fails the build when a source carries no permission state, rather than skipping the source silently, (3) the lineage manifest for the latest dataset version enumerates its customer sources, (4) selecting a customer recorded as withholding permission and searching the manifest returns no source belonging to that customer.

recorddocumentmanual

Register of permissions and withdrawals, showing for each customer the basis relied on, the date it was obtained, any withdrawal received, the date it took effect and the datasets rebuilt or refiltered as a result.

Example: Training permission register, extract of 30 June 2026, with the twelve withdrawals received in the period and their effect dates.

Test: Verify: (1) every customer whose data has entered a training dataset has a recorded basis with a date that pre-dates the dataset build, (2) every withdrawal shows an effect date inside the period the agreement states, (3) for each withdrawal, a dataset rebuild or refilter is recorded or the record shows that no dataset contained that customer data, (4) the register population reconciles with the customer list from the billing or contract system.

Questions (3)

boolean

Does your customer agreement state whether customer content may be used to train or fine-tune your models?

An agreement that is silent on the question is a no. Answer yes where the agreement addresses it either way, including where it states that customer content is never used for training.

multi

Which of the following apply to your use of customer data in model training?

The agreement and the product documentation say the same thing about itA basis is recorded per customer, with the date it was obtainedThe customer can operate a control that stops its data entering trainingThat control takes effect inside a period stated in the agreementDatasets are filtered by recorded permission in the pipeline itselfDataset lineage records which customer sources each version drew onNone of the above

Options follow the path from the agreement through to the dataset. Tick the pipeline item only where the filter is enforced by the build; a documented instruction to engineers does not count. Where you never use customer content for training, tick the first item and the lineage item if they hold; the assessor then tests the exclusion instead of the permission.

select

How is the exclusion of a customer data from training enforced?

The build filters on recorded permission and fails when a source has no permission stateThe build filters on recorded permission and skips sources without oneA scheduled job removes excluded sources before each buildAn engineer applies the exclusion list manually before each buildThere is no enforcement step

Options run from the strongest enforcement to the weakest. Answer for the pipeline that produced your most recent training dataset.