"What data was your AI trained on?" — the training-data question
This is the question vendors are most tempted to answer with fiction — not out of dishonesty, but because they feel they must produce something, and they didn't train the model. The correct answer has two layers, and one of them is allowed to be short.
Why buyers ask this
Three worries hide inside one question. First, provenance: what kind of model is behind the feature and where it came from — model provenance is a standard item in AI due diligence, alongside the inventory and subprocessor list. Second, contamination and IP: whether the model's training data creates risk the buyer inherits. Third — often the real question — "will our data end up training it?", which is technically a different question about future data use, but arrives bundled with this one.
Notice what the buyer is not asking for: a treatise. They are testing whether you know exactly where your knowledge ends and your provider's begins. Vendors who blur that line fail the test even with impressive-sounding answers.
The honest answer structure
Two layers, matching Step 2 of our method for the AI section:
- Layer 1 — the base model (the provider's layer). You did not train it and you do not hold its corpus. Name the model and provider, and answer strictly from the provider's public documentation — model cards, technical reports, published policies — citing it as the source. Where the provider publishes little, your answer says so. Nothing in this layer should be a sentence the provider hasn't published.
- Layer 2 — your layer (fine-tuning / RAG, if any). This one you must know exactly. If you don't fine-tune: say so plainly — customer data touches the model only at inference. If you fine-tune or build retrieval on customer or proprietary data: state which data, under what agreement, and what it changes (weights vs. retrieval index).
Template — adapt and verify every bracket before use:
"Two layers. (1) Base model: [feature] in [your product] is powered by [provider]'s [model], accessed via API. The base model was trained by [provider]; its training approach is described in [provider]'s published documentation [reference]. We do not have access to the training corpus and do not restate details beyond that documentation. (2) Our layer: we do not fine-tune or otherwise train models on customer data. [If applicable: we use retrieval-augmented generation — customer documents are indexed and retrieved at inference time to provide context; they do not modify model weights.] Future use of customer data for training is governed by our agreement with [provider], reviewed as of [date]."
On that last sentence: enterprise APIs from the major providers don't train on API data by default — but check the version of the DPA you actually signed before asserting it in writing. If you can't verify it right now, mark it as pending verification rather than asserting it.
The mistake that costs deals
Filling the provider's gap with your own prose. It shows up in two forms:
- Invented provider detail. A confident paragraph about the base model's corpus — sources, cut-offs, filtering — that the provider never published. Reviewers can check it against the provider's own documentation in minutes, and once one paragraph turns out to be decorated, every answer in the document gets re-read as potentially decorated.
- Conflating RAG with training. Telling a buyer "the model is trained on your data" when what you run is retrieval scares them for no reason; the reverse — fine-tuning on customer data while writing "we don't train on customer data" — is the kind of overstated answer that collapses in due diligence, when you may be asked to warrant what you wrote.
The discipline is the same one that runs through the whole AI section: state what you know, cite where it comes from, and mark the boundary. It is also the discipline behind the inventory question that usually precedes this one.
Mini-FAQ
We use RAG — does that count as training on customer data?
No. Retrieval happens at inference time and does not modify model weights. Say that, plus what is indexed, where it lives, and retention. Calling RAG "training" alarms buyers unnecessarily; omitting it reads as evasive.
The provider doesn't publish its full training corpus — what do we write?
Exactly that: model, provider, a pointer to the provider's published documentation, and a plain statement that you do not restate details beyond it. An honest boundary reads as diligence; invented detail reads as fabrication the moment someone checks.
Is the training-data question an EU AI Act requirement?
The Article 50 transparency duties most SaaS vendors face from 2 August 2026 concern disclosing AI interactions to users and marking synthetic content — not publishing a training corpus. Buyers ask this as risk management and provenance. If your questionnaire ties it to a specific legal obligation on your side, flag that item for legal review instead of guessing — and check your own Article 50 position with the free Article 50 checker.
Just received the questionnaire this question sits in? Start with the first-24-hours playbook.