Chapter 12Where do my words go?
Each hop, its own agreement
Every conversation is a relay: you, an app, a model, and sometimes tools that reach other companies. Each handoff can sit under a different agreement.
See what tools are and what a harness does for the parts in this picture.
Go deeper: how sensitive is it?
The more harm a leak could do, the more controlled the room has to be.
- Low
- A leak would have a limited adverse effect.
- Moderate
- A leak would have a serious adverse effect.
- High
- A leak would have a severe or catastrophic adverse effect.
Impact levels from the federal standard NIST FIPS 199.910
Examples:
- A public web page about the Gateway Arch: Low
- Internal notes from a budget meeting: Moderate
- An employee's salary and home address: High
- A patient's visit note: High Also covered by HIPAA.11
- A student's grades: High Also covered by FERPA.12
Illustration. Your organization may use different names for these levels, and decides which examples land where. NIST lists data privacy among the main risks of generative AI.13
Notes (13)
- 1Anthropic, “Is my data used for model training? (consumer),” Anthropic Privacy Center, March 16, 2026, https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training (accessed October 26, 2026).
- 2OpenAI, “Data controls in ChatGPT,” OpenAI Help Center, https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt (accessed October 26, 2026).
- 3Anthropic, “Is my data used for model training? (commercial),” Anthropic Privacy Center, August 18, 2026, https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-training (accessed October 26, 2026).
- 4OpenAI, “Business data privacy, security, and compliance,” https://openai.com/business-data/ (accessed October 26, 2026).
- 5OpenAI, “Introducing OpenAI for Healthcare,” January 8, 2026, https://openai.com/index/openai-for-healthcare/ (accessed October 26, 2026).
- 6U.S. Department of Health & Human Services, “Guidance on HIPAA & Cloud Computing,” HHS.gov, last reviewed December 23, 2022, https://www.hhs.gov/hipaa/for-professionals/special-topics/cloud-computing (accessed October 26, 2026).
- 7Anthropic, “Business Associate Agreements (BAA) for Commercial Customers,” Anthropic Privacy Center, https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers (accessed October 26, 2026).
- 8U.S. Department of Health & Human Services, “Summary of the HIPAA Security Rule,” HHS.gov, last reviewed August 7, 2026, https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations (accessed October 26, 2026).
- 9National Institute of Standards and Technology, FIPS 199: Standards for Security Categorization of Federal Information and Information Systems (NIST CSRC, February 2004), https://doi.org/10.6028/NIST.FIPS.199.
- 10NIST, “potential impact (glossary),” NIST CSRC (from CNSSI 4009-2022, adapted from FIPS 199), https://csrc.nist.gov/glossary/term/potential_impact (accessed October 26, 2026).
- 11U.S. Department of Health & Human Services, “Summary of the HIPAA Privacy Rule,” HHS.gov, last reviewed March 14, 2025, https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations (accessed October 26, 2026).
- 12U.S. Department of Education, “What is an education record?” studentprivacy.ed.gov, n.d., https://studentprivacy.ed.gov/faq/what-education-record (accessed October 26, 2026).
- 13National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1) (NIST, July 26, 2024), https://doi.org/10.6028/NIST.AI.600-1.
Chapter 12 · page 2 of 3
Turn pages with the ← and → keys.