8 questions to ask any AI vendor before you share data
By Ben Serunyigo, co-founder of Nimara · Updated October 2026
A new AI tool looks great in the demo, the sales rep says your data is safe, and your team can't wait to try it. Before anyone uploads a donor list or a client file, ask eight questions and get the answers in writing. This guide tells you what to ask, what a good answer sounds like, and what US and UK guidance says.
Before you share data with any AI tool, ask the company whether it trains its AI on your data, where your data is stored, who else handles it, and how long it's kept and whether you can delete it. Then ask who can see it, how they keep it secure, whether they'll tell you about a breach and how fast, how they tested the tool and its limits, and whether a person can check the work first. Get every answer in writing in the contract or terms, since a sales page isn't enough.
- 1Why this is your job, not the vendor's
- 2The 8 questions
- 3Red flags
- 4What US and UK guidance says
- 5How to decide
- 6Sources worth your time
Why this is your job, not the vendor's
Here's the part that surprises a lot of leaders. When you send personal information to a company to process for you, you're still responsible for it. In the UK, data protection law treats your charity as the controller, and a company working for you can use the data only on your documented instructions (Information Commissioner's Office). In the US, several state privacy laws now cover nonprofits, including Oregon's since July 2025 (Oregon Department of Justice). Laws like Colorado's keep the responsibility with you and require a binding contract with any company that processes data for you (Orrick).
In plain words, "the vendor said it was safe" won't protect you, your donors or the people you serve, but asking good questions will.
And this isn't only about new tools. AI is showing up inside tools you already pay for, like your email, your donor database and your design software. Sometimes it's switched on without anyone telling you, and the same questions apply.
The 8 questions
Send these to the company before its AI touches your work, and ask for the answers in writing. A good vendor won't mind. Our free Vendor Question Sheet has a longer version with space for their answers.
1Do you use our data to train your AI?
This question comes before the others for a reason. If your data trains their AI, pieces of it could shape answers other people get. Free and personal versions of AI tools often have different privacy terms than business versions, so check the version your staff actually use.
2Where is our data stored, and who else handles it?
Ask which country your data is stored and processed in, and which other companies (often called subprocessors) touch it. Many AI tools send your data to another company's AI model behind the scenes.
3How long do you keep it, and can we delete it?
You should be able to download all your data and have it deleted when you leave. Ask what happens to your data if the company is sold or closes.
4Who at your company can see our data?
Some companies let staff read your conversations to check quality. That might be fine for public information, but it's not fine for a client file.
5How do you keep it secure?
Ask whether an outside firm has checked their security. The common checks are called SOC 2 and ISO 27001, and you should also ask if you can require two-step sign-in for your team.
6Will you tell us about a breach, and how fast?
If something leaks, you may have to tell the people affected, and you can't do that if the vendor doesn't tell you first.
7How did you test it, and what are its limits?
Every AI tool makes mistakes. A trustworthy company can tell you how it tested the tool, which version, in which languages, and where it tends to go wrong. If you serve people in more than one language, ask about each of those languages.
8Can a person check the work before anything goes out?
The tool should never send, post, delete or change records on its own unless you decide that. Ask whether its AI features are on by default, and whether you can turn off the ones you don't need.
Red flags: stop and take a closer look
If you see any of these, pause and talk to your AI lead before anyone shares data.
- They won't say which country your data goes to.
- They train on your data, and you can't turn it off.
- You can't delete your data when you leave.
- The AI can send, post or change records without a person saying yes.
- The answers are only on a sales page, not in the contract or terms.
- An AI feature was switched on without telling you.
What US and UK guidance says
Neither the US nor the UK has an AI law written for nonprofits or charities, but privacy, equality and consumer law already apply to the AI tools you use (Wilson Center; Lewis Silkin). Official sources in both countries say clearly what to ask vendors, so here's the short version.
If you're in the US
- State privacy lawsPrivacy laws in states such as Colorado, Oregon, Delaware, Minnesota and Maryland apply to many nonprofits, although many small ones fall below the size limits. Where a law applies, you need a binding contract with any company that processes data for you. It should cover the company's instructions, the types of data, how long the work lasts, confidentiality, and the same duties for any company it passes your data to (Oregon DOJ; Wagenmaker & Oberly; Orrick on Colorado's law).
- Federal Trade Commission · 2024The FTC says it's illegal to use AI tools to trick, mislead or defraud people (Operation AI Comply). It has also warned AI companies that changing their terms without clear notice, so they can use your data for AI, could be unfair or deceptive (FTC tech blog). So read the terms again whenever a vendor updates them.
- CISA and FBI · 2024The Secure by Demand Guide lists questions to ask software makers before, during and after you buy, and because it covers all software it works well alongside the eight questions here (CISA). In May 2025, CISA, the NSA and the FBI also published best practices for keeping AI data secure, together with agencies in the UK, Australia and New Zealand (AI Data Security).
- NISTThe AI Risk Management Framework 1.0 and its Generative AI Profile (NIST AI 600-1) are free and voluntary. The profile names 12 risks that come with generative AI, which gives you a ready list to ask about when a vendor says their tool is "tested" (NIST).
If you're in the UK
- Information Commissioner's OfficeUnder UK GDPR, your contract with a company that processes data for you must say it acts only on your documented instructions and keeps the data confidential and secure. It can't bring in other companies without your authorization. It must also help you with people's data rights, breaches and impact assessments, delete or return the data at the end, and allow audits (ICO contract checklist).
- UK data protection law · data sent abroadIf your data leaves the UK, you need an adequacy decision or a safeguard such as the International Data Transfer Agreement (IDTA) or the UK Addendum, plus a transfer risk assessment. For US vendors, the UK-US data bridge covers only companies certified to the EU-US Data Privacy Framework and its UK Extension, so check the vendor is on that list.
- ICO · AI and data protectionThe ICO's guidance explains how data protection law applies to AI, and it's under review after the Data (Use and Access) Act 2025 (ICO guidance). When the ICO audited AI recruitment tools in 2024, it found some vendors wrongly treated themselves as processors, so ask each vendor who decides how your data is used and get the answer in the contract.
- National Cyber Security CentreThe NCSC's guide to AI and cyber security is written for boards and senior managers (AI and cyber security). Its supply chain guidance sets out 12 principles for managing the security risks that come with suppliers (Supply chain security).
- Charity Commission · England and WalesThe Commission says trustees remain responsible for decision making when a charity uses AI (Charity Commission blog, 2024). So make sure your trustees know which AI tools hold your charity's data.
Testing matters for another reason, too. In 2025, government AI safety bodies from several countries, including the UK's AI Security Institute, tested AI assistants with 156 tasks in each of nine languages. Pass rates changed from one language to the next, and the highest rate for any language was about 57% (International joint testing report, July 2025). If you work in more than one language, ask about each one.
How to decide
You don't need a procurement department to do this well, and here's a simple way to run it.
"Yes with limits" is often the right answer, for example "OK for drafting public content but never for client or donor information." That's a clear rule your team can follow.
If you don't have an AI lead or written rules yet, start there. Our guide to writing an AI policy walks you through it, and our board guide shows what your board should ask.
Sources worth your time
- UK · Information Commissioner's OfficeWhat needs to be included in the contract →
What a UK GDPR contract with a company that processes data for you has to cover.
- UK · Information Commissioner's OfficeGuidance on AI and data protection →
How data protection law applies when you use AI tools.
- UK · National Cyber Security Centre · 2024AI and cyber security: what you need to know →
A short guide for boards and senior managers on the security side of AI.
- US · Federal Trade Commission · 2024FTC announces crackdown on deceptive AI claims →
Why deceptive AI claims and schemes are still illegal in the US.
- US · CISA and FBI · 2024Secure by Demand Guide →
Questions to ask any software maker before, during and after you buy.
- US · NISTAI Risk Management Framework →
A free, voluntary framework for managing AI risk, with a profile for generative AI.
- Nimara · free kitVendor Question Sheet (in the AI Policy Kit) →
Sixteen questions with space for the vendor's answers, the red flags, and a decision box for your AI lead. The kit's legal notes are based on Canadian privacy law, so check them against the rules where you are.
Questions people ask
Are tools like ChatGPT or Copilot safe for nonprofits and charities?
It depends on the version and the settings, and business versions often have stronger privacy terms than free or personal ones. Ask the eight questions about the exact version your team uses, and keep personal information out of any tool you haven't approved.
Does our data have to stay in the US or the UK?
Not as a general rule, since neither country makes nonprofits or charities keep their data at home. In the UK, data that leaves the country needs an adequacy decision or a safeguard such as the IDTA, plus a transfer risk assessment. A US vendor is covered by the UK-US data bridge only if it's certified to the Data Privacy Framework and its UK Extension. Either way, check your funding agreements and contracts for their own rules, and make sure you know which country your data is in.
What is SOC 2?
SOC 2 is a report from an outside auditor that checks a company's security controls. A Type 2 report checks that the controls worked over a period of time, not just on one day, and ISO 27001 is a similar international certification.
What if a vendor won't answer?
That's an answer too. A company that won't say where your data goes or whether it trains on it shouldn't get your donors' or clients' information, though you can still use it for public content if your policy allows.
Do these questions apply to AI features in tools we already use?
Yes. When your email, donor database or design software adds AI, ask the same questions, check whether the feature was turned on by default, and turn it off if you haven't approved it.
We're a small nonprofit or charity. Is this overkill?
No. Small organizations often hold the most sensitive stories with the fewest people, and UK data protection law has no exemption for charities of any size. Eight questions and a written answer take less time than cleaning up after a leak.
Send it before you sign up.
Our free AI Policy Kit includes a Vendor Question Sheet with sixteen questions, the red flags and a decision box, plus the policy, a staff card and an AI register to record what you approve. The kit was written for Canadian privacy law, so have someone check its legal notes against the rules where you are.
Get the free kit →See Connected Systems
Want a second opinion on a tool before you commit? We help nonprofits and charities choose and connect tools they can trust, now or when they're ready for AI. Book a Call →
If they won't put it in writing, don't put your data in it.
Updated October 2026. This guide is general information, not legal advice. Written with AI assistance. Reviewed by a person.
