Which AI tools touch your data?

Before an AI system goes live, someone will ask which outside AI tools receive its data, and under what terms. The answer is often already written down, spread across architecture diagrams, design notes and code.

What matters in a technical document

A technical document is mostly plumbing. Data moves from one queue to another, files land in storage, services call each other. None of that is an AI risk on its own.

For AI risk, three facts in it matter:

• Which AI tools the system uses. A hosted model service, a cloud machine-learning platform, or a model the team runs on its own servers.
• What data goes to each tool. Free text from users, records about people, health notes, internal documents.
• Whether there is a data processing agreement with each vendor. An agreement sets out how the vendor may use, keep and protect the data it receives.

What AIR records

When you upload a technical document, AIR reads it and records one line for each AI tool it finds:

• the tool, and who runs it: the vendor, or your own team;
• the data the documents say goes into it;
• the data processing agreement status: stated in the documents, stated as missing or pending, not needed because the tool runs on your own systems, or not mentioned.

A claim that a vendor is "compliant" with a law is not counted as an agreement. Only a statement that an agreement is in place counts.

AIR uses these lines when it judges vendor, privacy and contract risks, so a gap such as sensitive data going to an outside tool with no agreement on record shows up in the report.

When the agreement is not in the documents

Architecture documents often name the tool and the data but say nothing about the contract. AIR does not guess. The point stays open in the report, and it closes when you add the document that shows the agreement, for example the signed agreement itself or your vendor register.

What to upload

• Architecture or system design documents, including data flow sections.
• A list of the AI services and models the system uses.
• Your vendor register, or the agreements for the AI vendors involved.

If you use AIR inside Claude Code, the scan reads the code directly: it lists each AI service the code calls, with the file and line, and the data the code sends to it.