Can we put member data into an AI tool?

It gets asked in almost the same words every time, and it usually names a product — most often ChatGPT, sometimes Copilot or Gemini. The product varies; the sentence does not: can we put member data into it? The person asking is normally sensible, has already decided they would like to, and wants a yes.

The useful answer is not yes or no. It is that the question contains three separate questions, each answered by a different body of law, and the AI Act — the one everybody is currently reading — is the one that says least about it.

Three regimes, one paste

A single copied paragraph can trigger all three at once, and they do not defer to each other.

• Data protection law asks whether you have a lawful basis to process the data, whether the recipient is a processor acting on your documented instructions, where the data goes, and whether the processing is proportionate. This is the regime that decides most cases, and it is the one that applies whether or not AI is involved.
• The AI Act asks what kind of system it is and what duties attach to you as deployer or provider. For a general-purpose chat assistant used to draft a summary, the answers are usually thin: the literacy duty under Article 4, a transparency question if a member is dealing with a machine, and Article 26 only if the use is high-risk. The Act does not contain a rule that says member data may or may not be uploaded.
• Contract and confidence ask whether the terms you accepted put the data where you think it is, for as long as you think, and in front of whom you think. This is not law. It is the thing that turns a defensible decision into an indefensible one eighteen months later when the terms have changed and nobody kept a copy.

An association that answers only the third question — "their privacy page says they don't train on business data" — has answered the easiest one.

Why the vendor's privacy page cannot settle it

Two reasons, and the second is the one that catches people.

First, the controller/processor question is a question of fact, not of marketing. Articles 28 of the GDPR require a written contract with a processor, setting out the subject matter, duration, nature and purpose of the processing, the type of personal data, the categories of data subject, and the obligations of the processor. A consumer account created with a corporate email address is not that contract, however good the settings are.

Second, the terms change, and your decision does not automatically change with them. The answer that was true when the tool was adopted may be false a year later, and nothing will notify you. That is not an argument against using the tools. It is an argument for recording the reasoning at the point of decision, with a date and a named owner, so that a later change can be re-assessed rather than discovered by accident.

The two switches people confuse

Most of the popular explanation of this subject collapses three different things into one word, and the confusion runs in both directions — some people think they are safe when they are not, and some think they are exposed when they are not.

• Training on your data is whether your input becomes part of a model that later serves other customers. This is the one everybody asks about.
• Retention is how long the text sits in an account, a log, or a review queue before deletion. A tool that does not train on your data can still hold a complaint letter for a long time, readable by support staff.
• Human review is whether a person employed by the provider can read the content — for abuse monitoring, quality, or a reported message. Many services reserve this right in their terms and exercise it rarely.

The middle one is the one that matters in a regulatory conversation and the one least discussed, because it is less alarming to a buyer than training. If a member's disciplinary correspondence is retained for months in a system outside your control, the fact that it was never used for training is not much comfort.

The categories that need their own answer

Generic advice — "don't paste personal data" — fails because it gives staff no way to decide in the ten seconds they have. What actually works is naming the categories that can never go to a rented service, in language a person can apply while working.

For a membership body those categories are fairly consistent across the sector.

• Disciplinary and complaint material, which is personal data about an identifiable person's alleged conduct, often with a third-party complainant in the same document.
• Health and disability information, which the GDPR treats as a special category under Article 9, and which surfaces constantly in fitness-to-practise, reasonable-adjustment and event-accessibility work.
• Accreditation and examination records, particularly anything that records a candidate's performance, an assessor's judgement, or a moderation decision.
• Safeguarding material involving a minor or a vulnerable adult, where the consequences of a disclosure are not recoverable.
• Anything under an active legal hold or subject access request, where a copy in a third-party system creates a disclosure problem you cannot easily undo.

That list is not a legal opinion, and it should not be one — it is the association's own classification, adopted deliberately and published to staff. The value is that it converts an abstract duty into five examples a person recognises.

A three-bucket rule staff will actually follow

The rule that survives contact with a busy team has three buckets, not two.

• Open. Published material, your own drafting, agendas, general research. Any approved tool. No decision required.
• Controlled. Internal material about identifiable people that is not in the categories above — routine correspondence, ordinary case notes. Approved tools only, with the account and settings that the association has vetted, and never a personal account.
• Prohibited. The categories above. Not "handle carefully" — not entered, in any tool, by any route, including the one on a personal phone.

Three buckets take one page and can be taught in ten minutes. A policy that says "exercise judgement" takes ten seconds to write and produces nothing, because judgement is exactly what people do not have time to exercise mid-task.

The assessment question

If the use is systematic rather than incidental — a tool processing member records at scale, or evaluating people in a way that affects them — a data protection impact assessment under Article 35 is likely to be expected, and the association should be able to show it considered the transfer, the retention and the rights of the people concerned.

For a single staff member drafting a newsletter, a DPIA is disproportionate and saying so is part of a mature position. The failure mode in this sector is not usually an association that assessed too little. It is an association that cannot say which of its uses it assessed, because nobody wrote down where the line was drawn.

What a machine in the building changes, and what it does not

A model running on hardware the association owns removes one problem and leaves the rest.

It removes the transfer. Material processed in your own building does not leave it, which is the reason such a machine exists — not sovereignty as a slogan, but a place to put the work that cannot go to a rented service. That is the honest framing, and it is narrower than the marketing version.

It does not remove the need for a lawful basis, a classification, a retention rule, or a named owner. A private system that holds disciplinary material for seven years because nobody set a deletion policy is a different problem from a public one, not the absence of a problem. The machine changes where the data is. The governance question follows it indoors.

The answer, then

Can we put member data into an AI tool has an answer, and it is a decision rather than a fact: yes for some material, in some tools, under settings you have written down, with a classification your staff can apply, and with a record of who decided and when. The associations that are comfortable with this question are not the ones that found a reassuring vendor. They are the ones that decided, in advance, what may leave the building — and then had somewhere for the rest to go.

---

The full picture: The AI Act for associations — what your body must actually do sets out provider versus deployer, the four duties, the dates, and the evidence a board will ask for.

Who holds the obligation: Who is responsible for AI Act compliance as a deployer? is about where the duty lands and what discharges it.

If the requirement is a place for the prohibited category to live, that is what the Brain is — a private AI in your own building, priced and buyable without a call.