Can I use ChatGPT or Claude for compliance work without leaking data?

Publicly available LLMs typically retain user inputs to improve their models, which means any sensitive data, including controlled unclassified information (CUI), personally identifiable information (PII), or proprietary business data, entered into these systems could be stored, processed, and potentially exposed. This practice directly conflicts with the data governance and security principles mandated by ISO 42001, particularly clauses related to AI system security and data protection. Similarly, SOC 2's Common Criteria, especially those pertaining to confidentiality (CC5.1), are jeopardised by such uncontrolled data ingress, as organisations cannot assure the security or restricted access of data once it leaves their controlled environment.

To mitigate these risks, organisations must adopt enterprise-grade LLM solutions that offer explicit data non-retention agreements and operate within a secure, isolated environment, or deploy on-premise models. Implementing a comprehensive data classification policy is crucial, alongside mandatory employee training on the appropriate use of AI tools, strictly prohibiting the input of sensitive data into public LLMs. Regular audits of AI tool usage and adherence to internal policies are also essential. Compliance hinges on the organisation's ability to maintain control over its data throughout its lifecycle, which necessitates careful vendor selection and robust internal controls for any AI integration.