Trace the data journey
For each AI use, describe the information shared, where it comes from and where it goes. A tool may involve several services: the application, a model provider and a hosting provider. Identify each party.
Document the terms of use
Gather available information on hosting, retention, access and conditions for reusing data. Record any uncertainty and ask the provider for clarification before sharing sensitive information.
Define internal rules
Specify which data teams may use and in which tools. Name the people who approve access and new uses. Review these rules when providers, models or contractual terms change.
Keep the map up to date
The map can be a table listing use, data, provider, hosting, retention period and internal owner. It helps the committee understand the practices described in your application.