Check Whether You Are Allowed to UseYour AI Tools Before You Build on Them

Most teams planning for AI cost increases are watching the wrong risk. The faster way to lose a tool is to discover it was never eligible for the work you need it for.

Start with the number

At my last job, doing ordinary engineering work, my own token spend ran past fifteen thousand dollars in a month. One person, normal work, billed at metered rates. The subscription that does most of that same job costs two hundred dollars a month.

Those are different billing models, not a like-for-like gap. A flat subscription rate-limits you; metered API pricing is list price for unbounded volume. Anyone who has run both will tell you the real difference is smaller than the two numbers suggest, and they are right.

It is still the number that made me look.

Two doors

This week I signed a business associate agreement for client work that touches patient data. One clause governs what I may put into an AI system, and it leaves exactly two doors open.

Either the model runs in a closed environment under my own control, including a model hosted on my own hardware from which the data is not transmitted to any third-party provider. Or the vendor operates under a business, enterprise, or API agreement whose written terms contractually exclude my content from use in training, fine-tuning, or model improvement, and which provides either zero retention or retention limited to a short abuse-monitoring window.

Everything else is prohibited.

Here is the part worth copying into your own diligence, because it caught me by surprise even though I went looking for it. The NDA underneath that BAA is the wider net, not the narrower one. The BAA governs protected health information. The NDA uses the same two-door structure but applies it to all Confidential Information, adds a standing no-training covenant that applies in either case, and names the thing most people are actually doing: use of any consumer-tier or free AI platform whose terms permit input data to be used for model improvement is prohibited outright.

If you are checking one document, check the other. For most engagements the confidentiality agreement reaches further than the compliance one, and it is the one nobody reads twice.

What is actually behind door two

Door two is real and most businesses will use it. It is worth knowing what it costs you in capability before you build a workflow that assumes it.

Working from Anthropic's own data retention documentation and their zero data retention page for Claude Code:

Consumer plans are out entirely. Free, Pro and Max are explicitly excluded from zero data retention and from HIPAA readiness, including when those accounts are used for coding work. That exclusion holds regardless of whether you have turned off the training setting. An opt-out does not make a consumer plan compliant.

Zero data retention is not a setting you turn on. It is not included in the standard Claude for Enterprise plan, cannot be enabled from your admin settings, and requires the vendor to confirm your account qualifies. It is also enabled per organization, and does not automatically extend to new organizations created under the same account.

Once it is on, features start disappearing. Anthropic's documentation lists what gets disabled at the backend level: Claude Code on the web, cloud sessions from the desktop app, Artifacts, Remote Control, Claude Tag, and the ability to submit feedback. Those are blocked server-side regardless of what the client displays. Code execution is not covered either. Their newest models carry a retention requirement by default, so where an organization cannot use them the models are simply absent from the picker or shown as disabled, and the server rejects requests for them no matter how the client is configured.

The compliant version of your tool is a smaller product than the one you learned. You pay more and you get less tool. That is not a complaint about any one vendor, and the same shape shows up across providers. It is a planning fact, and it is invisible until you are the one signing.

Then the rules changed

Ten days before I wrote this, on September 1, 2026, Anthropic announced Enterprise Frontier Safeguards. It keeps the misuse-monitoring data in the customer's own cloud account rather than the vendor's, removes the retention requirement that sat on the top models, and costs nothing from Anthropic. It is rolling out in phases with broad availability targeted for later this fall, and in the meantime eligible customers get zero data retention on the frontier models anyway.

Which undoes a good part of what I just described. It went my way this time.

That is still the problem, and it is the actual lesson in this post. The constraint I had planned around changed last week, in my favor, by a decision I had no part in and no notice of. I only found out because I went looking. Next time the change may not go my way, and I will find out the same way.

The question to ask before you build

So door two works, and that is not really the point. You can be compliant tomorrow and still have your compliance be a decision someone else revisits every quarter.

A model running on your own hardware is the one arrangement nobody else can retier, carve a feature out of, or disqualify. Nobody can take back the copy already on your disk. That is a narrower claim than it sounds: a local model is not automatically compliant, because the machine holding the data still needs disk encryption, access control and audit logging, and open-weight licenses have their own terms that change too. It also will not quietly get better while the hosted model does.

But it is yours. I have a 36GB laptop, and open-weight coding models in the 27 to 30 billion parameter range now fit on it. I do not expect one to replace the best hosted model. I expect it to handle the unglamorous half without asking permission.

None of this was news to me, which is the uncomfortable part. I read the same retention rules back in March and understood then that the cheap plan was off limits for work like this. I kept building on it anyway, because it is a very good tool and moving is a pain. Six months later there is simply more to move.

That is the cost nobody prices. Not the subscription, and not the enterprise upgrade. The weeks of rebuilt workflow you owe the day the terms change, which grows every week you postpone asking.

So the practical version, for any business putting AI into a process it depends on. Before you build on a tool, confirm in writing that the tier you are actually paying for is eligible for the work you are actually doing. Read the confidentiality agreement as carefully as the compliance one. And write down, once, what it would take to move.

What would you have to rebuild?