28creation
Newsletter
Guide AI

Choosing an AI assistant: 6 vendor questions and a 2-week trial

Most people who use AI at work bring their own tools; the six questions to ask a vendor, the answers to expect and a two-week trial that settles the choice.

By 28creation Desk 9 min read

The short read

In Microsoft's survey, 78% of people who use AI at work bring their own tools; at smaller firms, 80%.

  • One vendor can write very different rules for personal and business accounts, from training on chats to how long they are kept.
  • The guide gives six questions to put to vendors in writing, and a two-week trial on real work.

What you can do with this

Send each shortlisted vendor the six questions in writing, starting with whether your data trains their models. You get answers tied to a contract or a setting, not a sales-call promise.

Eight people in a small meeting room, most with laptops open around a table, two standing by a screen.
Photo: Robert Scoble, CC BY 2.0
In this article
  1. 1. List the work before you look at products
  2. 2. Ask the team what it already uses
  3. 3. Ask whether your data trains the model, and who reads it
  4. 4. Ask how long prompts are kept and where they are processed
  5. 5. Ask what it can open, and which contract covers it
  6. 6. Write one page on what can and can’t be pasted
  7. 7. Run a two-week trial on real work
  8. 8. Measure five numbers before deciding
  9. 9. Decide on one page, with a review date

In Microsoft’s 2024 Work Trend Index, 78% of people who use AI at work said they bring their own AI tools. At small and medium-sized companies, the share was 80%. That matters because the same vendor can write very different rules for a personal account and a business one.

Anthropic is a clear case. Its consumer plans keep chats for five years if the user allows them to be used for training. Its business plans don’t use inputs or outputs for training by default.

So the first decision is which terms your team’s words fall under. Features come second. This guide gives six questions to put to a vendor in writing. For each, it shows what a good answer looks like, quoting four vendors’ published policies.

Then it lays out a two-week trial on real work and the five numbers worth measuring before anyone signs.

1. List the work before you look at products

Write down the five to ten tasks your team actually wants help with, in tedious detail. “Writing” is useless. “First drafts of replies to support emails” is useful, and so is “a summary of a 40-message client thread before a call”.

Rank the list by how often each task happens. The top three become your trial. A tool that is brilliant at something you do twice a year is a worse buy than one that is merely decent at something you do every morning.

2. Ask the team what it already uses

Before you pick anything, find out which tools are already in use, and on which accounts. Ask without blame. Microsoft’s survey also found that 52% of people who use AI at work are reluctant to admit using it for their most important tasks. A survey that sounds like an audit will get polite answers.

The answers tell you where your data sits today. Google’s privacy hub for the Gemini app says human reviewers, including trained reviewers from its service providers, review some chats. Reviewed chats are kept for up to three years, and the page asks users not to enter confidential information they wouldn’t want a reviewer to see.

The same page says work and school accounts may have different terms. That difference is what the next three steps check.

3. Ask whether your data trains the model, and who reads it

Put the six questions below to every vendor in writing. Expect answers that point to a contract, a policy page or an admin setting. A promise on a sales call is worth what you paid for it.

Question 1: Is our input or output used to train or improve your models, and is that the default? A good answer is a plain no, in writing, with the exceptions named. As of October 2026, the large vendors’ business offerings put it like this:

Now look for the exception in the feedback buttons. Anthropic says a thumbs up or down stores the entire related conversation for up to five years. It may use that feedback to train its models. Owners of Team and Enterprise plans can switch feedback off for everyone, under Data and Privacy in the organization settings.

Question 2: Who at your company can read our content, and when? A good answer is specific. Microsoft says its Copilot services have opted out of abuse monitoring in Azure OpenAI, the process that includes human review of content.

4. Ask how long prompts are kept and where they are processed

Question 3: How long do you keep prompts, files and outputs, and who sets that? A good answer gives a number and lets an admin change it. Google Workspace keeps Gemini conversations for 90 days to indefinitely, as set by admins. On Anthropic’s business plans, deleted conversations leave its back end within 30 days. Microsoft lets admins set Copilot retention in Purview, and users can delete their own Copilot history.

Short retention has a cost of its own. People lose the history they search when they want last month’s draft, so agree on the number before the trial, not after.

Question 4: Where is our data processed, and which features are exceptions? Ask for the list of exceptions, because that is where the surprises sit. Microsoft keeps EU users’ Copilot traffic inside its EU Data Boundary, but Anthropic models used inside Copilot are currently excluded. Web searches are another carve-out: those queries go to Bing, where Microsoft acts as an independent data controller and the EU Data Boundary doesn’t apply.

OpenAI’s API offers data storage in 10 regions but in-region processing only in the US and Europe, plus the UAE for some models. One product can hold several sets of terms. An EU team that wants everything inside the boundary has more than one switch to check.

5. Ask what it can open, and which contract covers it

Question 5: What can the assistant see once it is connected to our email and files? The standard answer is only what the user can already see. Microsoft Copilot surfaces only data the user has at least view permission for, and Gemini won’t retrieve a document or email the user can’t access.

That sounds safe. It also moves the risk to your own sharing settings. Picture a hypothetical salary sheet shared with the whole company years ago and forgotten: anyone can now ask the assistant about it. Before you connect anything, search your drive for files shared with everyone and tighten them.

Question 6: Which contract covers our use, and are you our data processor? A good answer names the document. Microsoft says organizational use of Copilot is covered by its Data Protection Addendum, with Microsoft acting as data processor. If a vendor can’t name the document, take that as the answer.

6. Write one page on what can and can’t be pasted

One page, two lists. The first says what may go in: internal drafts, public information, your own notes. The second says what may not, at least until the vendor’s answers check out: customer personal data; passwords and keys; unreleased figures; anything under a confidentiality clause.

Name one person who answers “can I paste this?” People will ask at five to five with a deadline at five, and a quick answer from a named human beats a policy nobody has opened.

In the EU, the page also does legal work. Article 4 of the AI Act, on AI literacy, has applied since February 2, 2025. The Commission’s own Q&A takes the case of a company whose staff use ChatGPT to write ad copy or translate. Its answer: they should be informed about the specific risks, for example hallucination.

The duty is lighter than it sounds. No certificate is needed; a company can keep its own internal records of training instead. The Digital Omnibus on AI, in force since July 2026, keeps the obligation but no longer sets a “sufficient” level. National market surveillance authorities supervise it from August 2026.

A dated rules page and a 30-minute briefing on where the tool gets things wrong make a sensible record.

7. Run a two-week trial on real work

Test two candidates at most, or one against the way you work now. More than that and the trial turns into a hobby.

  • Day 1: a 30-minute kickoff. Everyone gets the task list and the house rules, then picks three tasks they will do that week anyway.
  • Days 2 to 5: people use the assistant on those tasks and log every use in a shared sheet.
  • Week 2: comparing two tools, swap them. Testing one, add the next two tasks from the list. Hold a 15-minute check-in halfway, while problems are still cheap to fix.
  • Last day: each person writes three lines: what worked, what didn’t, and whether they would pay for it from their own team’s budget.

The log needs six columns:

Date Task Usual minutes Minutes with the assistant, fixes included Outcome: used, edited or binned Errors found

Self-reported minutes are rough, but they are good enough to compare two tools used by the same people on the same kinds of task.

8. Measure five numbers before deciding

  • Unprompted use. On how many days in week 2 did people reach for the assistant without a nudge? We think this is the most telling number in the trial. Tools people need reminding about end up as a line on the card statement.
  • Edit rate. What share of outputs went out as written, and what share needed editing or went in the bin? In Stack Overflow’s 2025 survey, 66% of developers named “AI solutions that are almost right, but not quite” as their top frustration with AI tools. Near misses cost time in the fixing.
  • Minutes including corrections. Compare the usual time with the assisted time, counting every minute spent checking.
  • Errors that reached a draft. Count wrong facts and invented sources or numbers. Microsoft’s own documentation says generative AI responses aren’t guaranteed to be 100% factual, and we would treat one error that reached a customer as a serious finding.
  • Cost per active user. Divide the monthly bill by the people who used the tool in week 2. Seats don’t use anything.

An assistant that saves one enthusiast ten minutes a day and nobody else anything is a personal tool. Buy it as one.

9. Decide on one page, with a review date

Write down the tool, the tasks it is for and the house rules it runs under. Add who administers it and who removes accounts when people leave. Set a review date three months out, when you look at usage again and decide whether to keep paying.

Send the six questions to your shortlisted vendors today, and start the task list while you wait for their answers.

Sources

Read next

  1. News AI

    Gemini small-business hub: which account keeps receipts private

    Google's new Gemini tools read receipts and Xero books. On a personal account, people may review chats; on Workspace, they stay in house.

    28creation Desk 3 min read

  2. Guide Work software

    Excel CSV imports that mangle zeros and dates: 12 traps tested

    A CSV has no column types, so spreadsheets guess. Our test file lost half its cells to guessing; typed text columns kept all 24.

    28creation Desk 14 min read

  3. Analysis Automation

    Power Automate vs Zapier for Microsoft 365: 35 apps checked

    Microsoft 365 already pays for flows between Outlook, Excel, SharePoint and Teams. We checked 35 apps on both tools and priced three flows.

    28creation Desk 11 min read