How Do We Vet AI Tools Before Using Them at Work?

Dear Will & AiME,

Our teams are starting to utilize AI tools like ChatGPT, Gemini, and Claude for content creation, code development, and customer communication. We want to support innovation, but we also don’t want to accidentally give up IP rights or expose confidential data. What should we be asking before we approve any AI tool for business use?

— Operations Director in Denver

Short answer💡

To vet AI tools for business use, companies should review the terms of service to confirm commercial rights, understand how inputs are stored or reused, and assess ownership and control over outputs. These factors determine whether using the tool could expose confidential data or limit your IP rights.

Dear Operations Director in Denver,

This is the kind of question that more businesses need to be asking. As AI tools become embedded in everyday workflows, they raise significant legal implications, particularly regarding ownership, privacy, and control.

Before any AI tool becomes part of your business process, your team should be able to answer three foundational questions:

1. Do You Have Commercial Rights to Use the AI Tool?

You can’t assume that just because you can access an AI tool, you’re allowed to use it for business. Some tools grant the user full commercial rights. Others prohibit business use entirely, or restrict it unless you’re on an enterprise plan. These rights are defined in the terms of service, not in the output itself.

If you plan to use the AI-generated content in products, advertising, training materials, or other commercial applications, you need to confirm that your license allows it and document which license tier you’re using.

2. What Happens to the Data You Input Into the AI Tool?

Every prompt your employees type into an AI tool is a form of input and often, a form of disclosure. Many AI platforms reserve the right to store that input, use it for model training, or analyze it to improve performance.

That might be acceptable for a draft subject line, but not for trade secrets, internal strategy, legal content, or anything containing confidential or proprietary information.

Always check whether the tool retains rights in your inputs, and whether you can opt out. Some enterprise platforms offer stronger data isolation than consumer versions, but you typically need to configure those settings or negotiate them up front.

3. Who Owns the AI-Generated Output and Can You Control It?

This is where many companies get caught off guard. First, U.S. copyright law doesn’t currently recognize works generated entirely by AI as copyrightable. That means if the AI tool creates content without meaningful human contribution, the output may not be eligible for copyright protection, and you may not be able to register or enforce exclusive rights in it.

Second, some AI tools reserve a license-back to the output you generate, even if they disclaim ownership. That license might allow the AI provider to use your outputs to retrain their model, conduct analytics, or publish aggregated content.

So even if you think the content is yours, you may not be able to fully control it or prevent the AI provider from using it again in some form. This can be a problem if the content reflects sensitive business strategy, customer-facing messaging, or creative elements you intend to brand or monetize.

Bottom Line

You don’t need a full AI governance program to make smart decisions. But you do need to start with clear answers to three questions:

• What commercial rights are granted in the terms?

• What rights are we giving up in our inputs?

• And what do we own or give up in the output?

If any of those answers is unclear, your risk isn’t theoretical. Don’t proceed until you’ve closed the gaps.

— Will & AiME

Three Takeaways:

• Check the terms of service to confirm you have commercial rights to use the AI tool and its output.

• Many tools retain rights to your inputs. Avoid disclosing anything confidential or proprietary.

• AI-generated output may not be copyrightable, and the platform may retain license-back rights—review both carefully.