Governance, legal, and privacy across the scopes
Lesson 3 of 5 in The GenAI Security Scoping Matrix: Know What You’re Securing.
Walk the disciplines now, starting with governance and compliance — the policies, procedures, and reporting that let the business move while keeping risk in check. At Scope 1, the rule is blunt: use public, non-proprietary data only, because consumer providers may use whatever you submit to improve their models or services. A pasted price list can become someone else’s training data. At Scope 2, the enterprise contract is the control: insist on protections and opt-outs that keep proprietary and sensitive data out of the vendor’s training and improvement pipelines, and write policy stating which data classifications may enter the tool at all.
From Scope 3 up, your own data enters the system — and where it enters is the whole game. At Scope 3 it arrives at inference time, through RAG, knowledge bases, or agents, which means you can filter it per request and it never persists in the model. At Scopes 4 and 5 it goes into the weights, which triggers the matrix’s most quotable rule: classify the resulting model at the highest sensitivity level of any data used to train it, and restrict inference to users authorized for that classification. Train on confidential data and you have built a confidential asset — one that answers questions for anyone allowed to call it.
| Discipline | Buy (Scopes 1–2) | Build on a model (Scopes 3–4) | Own it all (Scope 5) |
|---|---|---|---|
Governance and compliance | Scope 1: public, non-proprietary data only — submissions may train the provider’s model. Scope 2: contractual protections and training opt-outs for proprietary data. | Scope 3: data enters at inference (RAG, knowledge bases, agents) — filterable, never fused into the model. Scope 4: the fine-tuned model inherits the highest classification of its training data; gate inference accordingly. | Same classification rule, applied to everything — you curated the corpus, so every sensitivity decision and every report about it is yours. |
Legal and privacy | Understand the provider’s EULA and ToS before anyone uses the tool; at Scope 2, negotiate the enterprise terms that consumer users never get. | Validate two stacks of terms: the service provider’s terms for the service and the model provider’s terms for the model served through it. | Your legal team writes your own terms of service for any external use of the model — you are now the provider someone else scopes against. |
The data rule of thumb | Nothing proprietary crosses the boundary without a contract that protects it. | Prefer inference-time data over trained-in data; when you do train it in, classify the model like the data. | Treat the training set as a regulated asset from day one — erasure requests will test it. |
Now legal and privacy. Across Scopes 1–4 someone else’s paper governs you: end-user license agreements, terms of service, and whatever contracts wrap them. Scopes 3 and 4 hide a subtlety teams miss: there are two providers in the stack — the service hosting the model and the organization that made the model — and you must validate both sets of terms. A model reached through a cloud service is governed by the service’s terms and the model maker’s terms for use within that service. At Scope 5 the direction reverses: if outsiders use your model, your lawyers write the ToS others must live under.
Then the privacy problem with teeth. Under the GDPR, individuals can invoke the right to erasure. If their data went into training or fine-tuning, the only fully effective removal is to delete it from the training set and retrain the model — routinely impractical when one person’s records are a sliver of the corpus, and very costly at any serious model size. This is not a corner case; it is the strongest single argument for the inference-time pattern: data that only ever entered prompts can be deleted from a database tonight.
Can we paste customer data into a free public chatbot to save time?
No — that is a Scope 1 workload, and the governance rule is public, non-proprietary data only. Consumer providers may use submissions to improve their models and services, so the paste is functionally a disclosure. If the task genuinely needs customer data, it belongs at Scope 2 with contractual protections, or Scope 3 where your own filters guard the prompt.
We signed an enterprise contract — does that settle the data question?
Only if the contract actually says what you assume it says. Scope 2 protection is not the logo on the invoice; it is specific clauses — proprietary data excluded from training and improvement, opt-outs exercised, data-handling and residency commitments. Procurement should read the genAI addendum, not just the master agreement.
We only use RAG — do training-data rules apply to us?
Mostly no, and that is the pattern’s charm. At Scope 3 your data enters at inference and never modifies the model, so the model-classification rule and the retraining problem stay out of your life. What you do inherit: filtering that data per user before it reaches the prompt — the controls discipline in the next lesson.
A customer invokes the GDPR right to erasure — and their data is in our fine-tuned model. Now what?
The uncomfortable truth from AWS’s own guidance: the only fully effective way to remove data from a model is to delete it from the training set and train a new version. That is often impractical and can be very costly. The real lesson is preventive — keep erasable personal data out of training corpora and supply it at inference instead, where deletion means a database operation.
Whose terms govern a third-party model we reach through a cloud service?
Both parties’ terms, stacked. At Scopes 3 and 4 you must validate the service provider’s terms for using their service and the model provider’s terms for using their model within it. The two documents can disagree — on permitted use cases, on data handling, on indemnities — and you are bound by both.
We trained our own model and license it to others — what changes legally?
You have switched sides of the table. At Scope 5 there is no upstream EULA to inherit: your legal team drafts the terms of service for external use of your model, and your customers now run their scoping exercise against you. Their Scope 3 is your product.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.