Yes. Sometimes. And hardly anyone asks before pasting a client's contract into a chat.
On 26 October, Brown University presented a map of the human chain behind AI. It was created by Cunyan Ma, a student at the technology responsibility centre led by Professor Suresh Venkatasubramanian. The map connects 13 data labelling companies with 141 corporate clients and workplaces in 31 countries. Centific, Sama, TaskUs and Innodata are on it. And, as clients, OpenAI, Anthropic, Google, Microsoft and Meta. Wolters Kluwer and Deloitte, too.
That map does not prove that your clients' data ends up in Kenya or the Philippines. Labelling is used to train models. That is not the same as someone reading your conversations. But the map does show one thing: behind the machine there are people, lots of them, in many countries, and the chain is out of sight.
So I asked the question that matters to a law firm: who can read what I upload? I have read the terms of the big four. Here is what they say.
Google Gemini, consumer version: the most serious case
Google says it plainly. Human reviewers, including reviewers working for its service providers, read some chats to improve the service. Reviewed chats are disconnected from your account and kept for up to three years. And they are not deleted even if you delete your activity.
Google adds a piece of advice: if you have activity turned on, do not enter confidential information or anything you would not want a reviewer to see.
For a lawyer, the conclusion is simple. The consumer version of Gemini is not for client data.
OpenAI: ChatGPT Business, Enterprise and API
OpenAI does not train on your data by default on its business plans. That is the good part.
But its terms say who can access your conversations. On the one hand, authorised employees, for technical support, investigating abuse and complying with the law. On the other, “specialized third-party contractors”, bound by confidentiality and security obligations, only to review abuse and misuse.
In other words: people outside OpenAI can see what you write. For a limited purpose and with obligations. But they exist. And OpenAI does not say on that page who they are or where they work.
Microsoft: Azure OpenAI and Foundry
Microsoft gives the most detail. Its system analyses prompts and responses to detect abuse. By default, a machine carries out that review. A person steps in only if the machine cannot reach a sufficient level of confidence.
That person is an authorised Microsoft employee, using secure access workstations and temporary access approved by their manager. And for deployments in the European Economic Area, those staff are based in the EEA.
You can also ask for no human review. Microsoft calls it “modified abuse monitoring” and designed it for highly sensitive or confidential data. But it is not a switch. It is a request that Microsoft has to approve.
Anthropic: API and commercial products
Anthropic deletes inputs and outputs after 30 days, with exceptions. If its automated system flags something as possible abuse, it keeps the content for up to two years and the classification scores for up to seven. It may also retain data when required by law.
What the page does not say is who reviews the flagged content or whether a third party is involved. That needs asking.
Copilot and legal tools: I do not know yet
Microsoft 365 Copilot, Harvey, Lexis+ AI, Karnov or Wolters Kluwer's solutions. I have not found sufficient public terms to know whether their staff or their subprocessors' staff read your queries.
My not finding it does not mean it does not happen. It means you need to ask for it in writing before signing up.
The other eyes, with any provider
Abuse review is not the only possible human access. There are others, and they apply to any provider:
- Technical support, when you open a support ticket.
- A security incident.
- An order from an authority.
- Third-party connectors and add-ons you enable without reading the terms.
- Misconfigured employee accounts.
- Data that is retained after you delete it.
And this is not exclusive to AI. Email, cloud services, transcription and document management can involve similar access. AI has simply made it visible.
Why it matters to a law firm
Professional secrecy leaves no room for the excuse “I did not know someone could read it”. If you upload client data to a tool, you choose whom you show it to. Even if access is remote and for a limited purpose.
And the GDPR asks for the same thing by another route. Whoever processes data on your behalf is a processor. Their subprocessors need your authorisation. If the data leaves the EEA, the transfer needs a valid basis. You cannot comply with any of that if you do not know who is in the chain.
What to do
- Do not use consumer versions or personal accounts with client data. Ever.
- Use only business plans with a data processing agreement (DPA) and an EU/EEA region. Where available, request an exemption from human review.
- Demand a list naming the subprocessors, with their country and role.
- Minimise or anonymise before sending. Leave out criminal and health data.
- Ask the provider these questions, in writing, before signing:
- Who can see my data: employees, contractors or both?
- From which countries?
- For what purpose and with what access controls?
- How long is it kept, including after I delete it?
- Can I request no human review?
AI has no eyes. The companies selling it do. You have a right to know whose.
General information as of 27 October 2026, based on each provider's published terms. This is not legal advice. Terms vary by plan, configuration and region.
Sources
Text by Roberto Ortega, prepared with AI editorial assistance. The Norwegian and English editions are editorial adaptations of the Spanish original.