The Question Your Data Officer Asks About AI

The vendor questionnaire has forty rows, and the AI section is three of them. The operations team had circled the demand-forecast summaries and the helpdesk reply drafts as the reasons they wanted the system. The data officer reading the questionnaire did not ask whether the summaries were any good. She asked: which company receives our data when one is written; can we stop that without losing the system; and if a regulator or a customer asks what left the building last March, what will we show them?

Those three questions decide more software purchases than any demonstration does, and most vendors answer them with a paragraph from the privacy policy. A paragraph is a promise. What the officer wants is a mechanism: something she can switch, and something she can read afterwards that shows the switch was respected.

This is how AWRA answers them, what each answer rests on in the product, and the few places where the honest answer is more careful than the headline.

Why accuracy is the second question

An inaccurate summary is a quality problem. A person reads it, notices it is wrong, and ignores it; the figures beside it are still correct. An unexpected data transfer is a different kind of problem, because it cannot be noticed by reading the screen and cannot be undone once it has happened. A ticket thread containing a customer’s complaint, sent to a model provider the organization never assessed, is out of the organization’s hands whether the draft reply was good or not.

So the officer’s order of questions is the right order. Before anyone evaluates what the AI writes, someone has to establish three things:

• Destination. Which third parties receive content, for which features, and in which region. This has to match the sub-processor list the organization signed against, or the contract is wrong.
• Control. Whether the organization can stop all of it, from one place, without the rest of the system breaking — and who in the organization is allowed to flip that.
• Evidence. A record, kept by the system, of what was actually called and when. Not what the documentation says should happen: what did.

Each of those is easy to claim and hard to make true, for one structural reason. AI features are usually added one at a time, by different people, each calling a model in its own way. A switch then has to be wired into every one of them, and the first feature added after the switch was built is the one that forgets.

One door, so one switch is enough

In AWRA every call to a language model goes through a single component, the answer provider chain. The dashboard insights, the in-app assistant, the helpdesk copilot, the quotation and procurement narratives, the forecast summaries, supplier prequalification scoring and the workflow builder’s suggestions all ask that component for text. None of them holds a provider key or talks to a provider directly.

That is what makes the switch credible. The workspace setting is checked at the door, before any provider is chosen, so a feature written next year inherits it without anyone remembering to add it. When the switch is off, the door returns nothing, and every feature does what it already does when no provider answers — which, because providers do go down, each of them was built to handle from the start.

A switch wired into each feature is a list someone has to keep current. A switch on the only door is a property of the building.

The switch lives in Settings → AI & Data, and the same switch is on the settings screen of the mobile app. It is on by default, because that was the product’s behaviour before the switch existed. Turning it off is written to the audit log with the person who did it, so the question “when did we stop, and who decided” has an answer too. Viewing the page needs the settings view permission; changing it needs the permission to edit settings.

What each feature sends, and what happens when it cannot

The officer’s next question is always “send what, exactly”, and the honest answer differs by feature. This is what the code assembles for each one, and what a person sees with the switch off.

Three things in that table are worth a data officer’s attention, because they are the places people assume the wrong answer.

First, the arithmetic never leaves. Forecasts, quotation scores, reorder quantities and risk levels are computed by AWRA. What a provider receives is the result, and what comes back is a paragraph about it. That is also why switching AI off costs a workspace prose rather than function. The figures were never the model’s.

Second, some features carry personal data, and the table says so rather than hiding it. A prequalification evaluation includes the contact person’s name, email and phone number as typed on the application. A copilot draft includes the whole ticket thread, internal notes too, because a draft written without them would contradict what the team has already agreed. If those categories matter to your assessment, they are the reason to decide on the switch deliberately rather than leaving the default.

Third, some things that sound like AI are not sent anywhere. Reading the text off a scanned invoice runs on AWRA’s own server. When the assistant answers a question about your own figures — how many open orders, what is overdue — it answers from your data and the answer is never passed through a model to be reworded. The settings page states the rest plainly: passwords, payment card data and files from connected Google accounts are not among what is sent.

A log of the call, never of the conversation

Evidence is the question vendors most often answer badly, and they usually fail in one of two opposite directions. Some keep nothing, so the honest reply to “what was sent last March” is “we cannot say”. Others keep everything: every prompt and every reply, stored “for audit”. The second sounds more responsible. It is worse. A store of every prompt is a second copy of the most sensitive text in the system — ticket threads, supplier contacts, financial summaries — gathered into one table, with its own retention, its own access rules and its own breach exposure, created in the name of reducing risk.

AWRA’s log records the fact of each call and nothing of its content. One row per call that a provider answered:

Settings → AI & Data shows the last thirty days of it, grouped by provider and purpose, with a count and the time of the most recent call. Rows are kept for the life of the workspace and removed with it. The page also lists which providers are enabled on the platform, what each is used for, the region, and the categories of data it receives — and those rows are read from the same register that publishes the sub-processor list, so the settings page and the public list cannot say different things. Today that register names two AI providers: Groq and Google Gemini.

Because the switch sits at the same door as the log, the two prove each other. A workspace that switched AI off on the first of the month and shows no rows after that date has evidence, written by the system rather than asserted by the vendor, that nothing was sent. That is the property an auditor actually wants, and the test suite pins it: with the switch off the provider is never called and no row is written; with it on, one answered call is one row.

Where the careful answer differs from the headline

A data officer will find these if she looks, so they belong here.

Providers are tried in a fixed order, and if the first does not answer the next is asked. The log records the one that answered. A request that reached the first provider and timed out is therefore not a row, even though the text may have arrived there before it failed. Both providers are on the published list, so nothing went anywhere undisclosed, but the log is a record of answered calls rather than of attempts.

Insight summaries are cached for up to six hours so a page does not wait on a model. Switching AI off stops every new call immediately, but a summary written before the switch can stay on screen until its figures change or the cache expires. Nothing new is sent in that window; something old is still visible.

And a plan’s monthly AI allowance is checked before the switch. A workspace that has used its allowance sends nothing for the rest of the month either way, which is a billing control rather than a privacy one, and shows the same figures-without-summaries behaviour.

What the assistant itself can and cannot answer is set out in what the AI assistant can answer, and the assistants are described on the AI assistants page.

Frequently asked questions