Artificial intelligence could extract requirements from a tender request, compare documents, or help in preparing the tender. But can the customer's data be uploaded to the service?
Sometimes you can, but the permission depends on the material, agreements, and the service used. The fact that the file is in your own email account does not yet mean that it can be submitted to an external artificial intelligence service for processing.
What does the material contain?
The bid request may contain contact information, prices, schedules, and the customer’s future plans. Drawings may reveal technical solutions, production methods, or details that are sensitive from a safety perspective.
Personal data and business secrets are different things. Even if you remove the names, the drawing may still be confidential. Check the customer agreement, any confidentiality agreement, and the instructions for your own company. If they do not cover the intended use, the matter must be clarified before uploading.
Check the service and how it is used
The terms and settings of AI services vary. Being a paid service does not on its own tell you whether it is suitable for a client’s material. The National Cyber Security Centre Finland points out that a carelessly deployed AI application can send an organisation’s confidential information to an external service. Cybersecurity Center: Be vigilant with artificial intelligence.
Before use, please check:
- Has the company approved the service for processing this material?
- Is the input data used to train the models?
- Where are the data processed, who has access to them, and for how long are they kept?
- What do the agreements say about data processing and deletion?
- Do the add-on services or interfaces provide information to other operators?
Simply opting out of use for model training does not solve all of these questions.
If the material contains personal data, a proper legal basis is required for the processing. Furthermore, it is necessary to assess, among other things, the necessity of the data, the responsibilities of the parties, and any transfers outside the EU and the EEA. When a service provider processes personal data on behalf of a company, a processing agreement in accordance with data protection regulations is required. EU General Data Protection Regulation, in particular Articles 5, 6, 28 and 44.
Just provide the information necessary for the task
You do not always need the whole call for tenders. You can ask the AI for a bid checklist based on a general description of the task, or use a fictitious example.
If an accepted service requires real data, limit it to the essential. Remove unnecessary personal information and other identifiers from the file metadata as well. Remember that simply removing the customer's name does not necessarily prevent identification.
Finally, check the result yourself. The requirement list extracted by the AI can help with the preparation, but the dimensions, tolerances, materials, and terms of the tender must be verified from the original documents.
Tip: Artificial intelligence in public procurement
Public procurement also has AI tools built specifically for handling calls for tenders and bids. The Hankinta-Suomi webinar series in August–September 2026 presented solutions for both contracting authorities and bidders: for example, checking calls for tenders for inconsistencies, supporting requirements definition, finding suitable competitions and preparing bids.
Tanja Karonen has summarised the solutions briefly on LinkedIn: solutions already in use (webinar 28 August) and solutions in development (webinar 3 September).
The same questions apply to these services as well: before implementation, find out what data you can upload to the service and how it will be processed.
It is good practice to agree in advance in the company what data can be processed in each service. Then, every employee does not have to solve the same question again in a hurry.
Do you want to agree on clear rules of engagement for artificial intelligence in your company when working with customer data? Contact us: tanja@nexpert.fi.
Filed under
