GDPR, AI writing and your knowledge base
Using a model to help write published pages raises three practical questions: what personal data goes into the prompt, where that processing happens, and whether the provider may train on it. All three are answerable in a contract and a process, and none of them are answered by avoiding the technology.
This article is a practitioner's checklist, not legal advice, and a data protection officer should sign off whatever you conclude. What follows is the set of questions that actually come up when a European company starts using a model to help write its own published material.
Question one: is there personal data in the input?
Often, and usually without anyone intending it. The raw material for a knowledge base is old emails, call notes, proposals and support tickets, and all of those are full of names, addresses and sometimes a great deal more.
Customer correspondence is a different category from your own published material and your own internal documentation. Draw the line before the ingestion, not after.
A question does not need the name of the person who asked it. Removing identifiers at intake is far easier than removing them from a knowledge base later.
You will eventually need to answer where a specific statement originated, either for a data subject request or for your own editorial confidence.
Question two: where does the processing happen?
Transfers outside the European Economic Area need a lawful basis, and the arrangements in this area have been challenged repeatedly. Ask any vendor, in writing: which sub-processors are involved, in which countries, under which transfer mechanism, and whether regional processing is available. Get it in the processing agreement rather than in a sales call.
Keep your processor list current and published. It is required, it is the first thing a careful counterparty checks, and an outdated one is a visible signal that the rest of the programme is outdated too.
Question three: can they train on it?
For business and enterprise arrangements the mainstream providers contractually undertake not to train on customer content by default. Consumer tiers frequently work the other way. The distinction is contractual, not technical, so it has to be read in the agreement you actually signed, and re-read when terms change.
Whether a provider trains on your content is a contract question, not a technology question.
What about the published output?
| Concern | Practical position |
|---|---|
| Do we have to label AI-assisted pages? | Transparency obligations focus on interaction and synthetic media rather than on assisted drafting; many publishers disclose anyway, and it costs nothing |
| Who is responsible for an error? | You are. A model drafting a page changes nothing about publisher liability |
| Can output contain personal data? | It can if the input did. Review before publishing is the control |
| Copyright in the output | Varies by jurisdiction and is unsettled; assume you cannot rely on exclusivity in raw generated text |
If you run an assistant on your own site
This is where obligations become concrete rather than theoretical. A visitor talking to a bot on your site should be told they are talking to a machine. Conversations are personal data if they are retained with anything identifying. Have a retention period and apply it. Say in your privacy notice what happens to what somebody types, and make the answer boring: it is used to answer, it is kept for a stated period, it is not sold.
Questions this settles
Not for the writing itself. The question is about the personal data in the material you feed it, which needs a lawful basis in the same way any other processing of that material does.
Transparency requirements concentrate on people knowing when they are interacting with a machine and on synthetic media. Assisted drafting of a company's own published text is treated differently, and voluntary disclosure remains a reasonable position.
Usually yes, with the boundary drawn at what may be sent. The workable pattern is to keep sensitive material out of the prompt and use the model on the general knowledge the pages are actually about.