What do you check, in what order?
- Buyer terms. Confidentiality, handling, and disclosure clauses in the pack: what may leave your systems, to where, under what protections.
- Applicable law. Privacy and data-protection obligations in the relevant jurisdiction (Australia’s Privacy Act and APPs, New Zealand’s Privacy Act, the UK GDPR regime) applied to this data, not recited in general.
- Hosting and processing. Where the specific service tier stores and processes content, from that tier’s current documentation, with a verification date.
- Training and retention. Whether inputs train models, how long content is retained, and what the opt-outs actually cover at your tier.
- Access and subcontractors. Who at the vendor and its subprocessors can see content, named in the terms, not assumed from the brand.
- Contract. Your service agreement and any data-processing addendum: the tier you pay for, not the tier you read about.
General confidentiality groundwork is on security and confidentiality; this page is the per-tender, per-tool check sequence across the three jurisdictions. UK security-evidence specifics sit with Cyber Essentials and ISO 27001.
What must you never assume?
A country-wide hosting mandate: none is assumed anywhere on this page, because the answer is pack-plus-tier specific. That a consumer chatbot tier and an enterprise tier handle data identically; they do not. That “we already use this vendor” covers a new pack with stricter handling clauses; each tender re-opens the question. Untested status is stated where nothing was tested: documentation review is not hands-on verification, and this page claims no testing of any vendor’s current tier.
What does this mean for the bid/no-bid call?
A pack whose handling clauses forbid the tooling your process depends on is a process fail in week one; re-plan the assessment method or no-bid. Build the check into the gate for every AI-assisted pursuit: buyer terms, law, tier, retention, access, contract: dated, filed, repeatable. Portability and exit (getting decisions and content back out) is a later page; design for export regardless.