Company documents and AI: what to check before uploading a file

Draft date: 8 November 2026. Author: Redazione X20 Digital Trust.

Before uploading a company document to an artificial intelligence service, clarify the purpose and identify which information is actually necessary. Check the file, the service conditions and the route the output will follow. Removing names is a useful precaution in some cases, but does not automatically anonymise the content or resolve other applicable restrictions.

This guide proposes an operational check for businesses and professionals. It does not certify a service's suitability or authorise submission of confidential documents. Personal data processing, professional secrecy and contractual duties require separate assessment. An account approved by the business does not mean every document may be uploaded.

Write the question first

Define the specific task: extracting deadlines, comparing versions or preparing a summary. If only certain clauses are needed, consider an extract instead of the whole contract. Reducing the material may avoid exposing information unrelated to the request and makes it easier to check whether the response answers the question.

Do not remove context necessary for the task. An isolated clause may depend on definitions or attachments that change its meaning. Prepare the extract deliberately and record excluded sections where they affect interpretation. A response based on partial text should not be presented as a complete document analysis.

Examine more than names

Look for contact details, identifiers and financial information. Also check elements that could identify someone indirectly: a unique position, a specific event or a combination of dates and places. Replacing a name with “Client A” may leave enough context to identify the person.

Examine comments, tracked changes and file properties. Visible text does not always represent everything sent. If using an exported format, open the actual copy before uploading. Do not assume a visual covering has removed underlying text. Check the document that will cross the service boundary, including information that may remain accessible even though it is not immediately visible on the page.

Check the service and account used

Identify the provider with which the business has a relationship and the conditions applying to the specific plan. Retention settings or content use may differ between accounts. Check who can access the information and which documents describe processing. Do not infer these details from a general marketing promise.

If transfers or access from other countries arise, have the relevant framework assessed. A server's geographical location does not answer every processing question. Equally, a confidentiality clause does not replace assessment of privacy roles. The internal procedure should identify who resolves these matters before use, so uncertainty does not become an assumption made by the person uploading the file.

Keep any restoration table separate

When replacing identifiers with labels, keep any connection with originals in an appropriate environment with restricted access. Sending masked text together with its correspondence table may defeat the purpose. Clarify who is authorised to restore information in the response.

Pseudonymisation does not automatically equal anonymisation. Depending on the circumstances, transformed content may remain personal data. Check the masking result rather than relying only on the presence of labels. If essential information remains too identifying, it may be necessary to change the method or abandon the upload. The decision should reflect the actual content rather than the name assigned to the transformation.

An entirely fictional example

The imaginary company “Nido Servizi” wants to extract deadlines from a draft contract. The file contains employees' names, negotiation comments and unnecessary bank details. The assigned person prepares a copy relevant to the task, removes comments from that copy and replaces certain identifiers, then checks the exported document.

Before submission, they verify that the service is approved for that material. The response is compared with the original clauses and deadlines are not automatically entered into the calendar. This example illustrates a control process rather than demonstrating that these operations make every upload lawful. The same checks must be adapted when the document or intended use changes.

Check what comes back as well

A summary may introduce errors or reconstruct information that was removed. Before sharing the result, verify references and figures against the original document. If restoring identifiers, check consistency and ensure substitutions do not attribute a clause to the wrong counterparty. Retain only what is necessary under applicable rules.

For compliance or contract tasks, maintain competent human review. Well-written text does not demonstrate accuracy. Connect observations with supporting passages and record unresolved uncertainties. Subsequent activities, including approvals and deadlines, should follow verification of the result rather than the confidence of its wording.

Sources and limitations

The EDPB guide for small businesses assists assessment of lawful and necessary processing. The GDPR on EUR-Lex is the legislative reference; this guide does not establish a universal legal basis for AI use. Confidentiality duties may require additional precautions even where no personal data is involved.

To compare tools addressing document protection and review of outputs, you can view the X20 Digital Trust apps.