Before the Answer: Governing Generative AI Inputs as Controlled Data Ingress

An AI inventory tells the organisation which generative tools have been sanctioned, who owns them and what risk tier applies. It does not tell the organisation what has been typed into them. That gap matters because the prompt box is where staff routinely combine personal data, confidential commercial material and regulated information with instructions to a model. In UK governance terms, the prompt is not a trivial query; it is an input event that can create a record, trigger a data protection obligation and become evidence in a regulatory or employment process.

Why the inventory is not enough

Most UK organisations now have some form of AI register. It may sit within information security, data protection or procurement. It records tools, owners and approvals. It rarely records the content of individual interactions. That is understandable: prompt content can be voluminous, repetitive and sensitive. But an inventory without an input policy leaves the most common point of data ingress uncontrolled.

The governance question is therefore not whether generative AI is permitted. It is what may cross the boundary from the organisation into the model, under what conditions, and with what record. A prompt-handling policy answers that question in operational terms.

Define the prompt record

For governance purposes, a prompt record should be defined narrowly enough to be workable and broadly enough to be defensible. It should cover the user-entered instruction, any attached or pasted content, the selected model or tool, the date and time, the user identity and, where material to the decision, the output. It should not attempt to capture every keystroke or every ephemeral interaction. The aim is a controlled record of material input events, not surveillance of routine working.

Organisations should distinguish three levels. First, a prompt that contains no organisational data and no personal data may be treated as low risk and need not be retained. Second, a prompt that contains personal data, confidential information or regulated material should be logged in a prompt register or retained within the approved tool according to a defined schedule. Third, a prompt that supports a decision affecting an individual, a contractual position or a regulatory submission should be retained as part of the decision record.

Prohibited inputs: set the boundary clearly

Staff need a short, unambiguous list of what must never be entered into a general-purpose generative AI tool. The list should be approved by the Senior Responsible Owner for data governance and reviewed alongside the AI inventory. A practical baseline for UK organisations includes:

• special category personal data, unless a specific approved use case and DPIA permit it;
• personal data relating to children or vulnerable individuals;
• financial account details, authentication credentials and security keys;
• material subject to legal professional privilege;
• unpublished financial results or price-sensitive information;
• personal data received under a confidentiality agreement;
• information classified as OFFICIAL-SENSITIVE or above in public sector contexts;
• source code or system configuration that could expose security controls.

The policy should also address indirect ingress. Staff may not paste a document, but they may upload it, link to it or ask a model to summarise a file held in a connected repository. The prohibited-input schedule must therefore apply to attachments, retrieval-augmented generation sources and any plugin or connector that can reach organisational data.

Logging triggers: when a record must exist

Not every prompt needs to be retained. Retention should be triggered by defined conditions rather than by blanket capture. A workable set of triggers includes: the prompt contains personal data; the prompt contains confidential or regulated information; the output is used in a decision about an individual; the output is incorporated into a client deliverable or regulatory response; the prompt relates to a high-risk use case on the AI register; or the user is operating under an exception approved by the data protection officer.

Where logging is triggered, the record should capture minimum metadata: user, tool, timestamp, data categories, purpose, retention period and whether a DPIA or approved use case applies. The content of the prompt should be stored only where necessary and protected accordingly. In many cases, a register entry that describes the input class and purpose will be more proportionate than retaining the full text.

Retention and disposal

Prompt records should follow the organisation's retention schedule, not the default settings of the tool. A useful starting point is to align retention with the underlying business record. A prompt that supports a customer decision should be kept for the same period as the customer record. A prompt used for internal drafting with no personal data may be deleted at the end of the session. A prompt that is part of a regulatory submission should be placed under legal hold where appropriate.

Disposal must be evidenced. The prompt register should record when records were deleted, by whom and under which retention rule. Where the tool provider retains data, the organisation should confirm contractual deletion terms and record them in the AI inventory.

Evidence for ICO and internal audit

When an ICO request or internal audit arrives, the organisation will need to show that it exercised control over generative AI inputs. A credible evidence pack contains the approved prompt-handling policy, the prohibited-input schedule, the AI inventory, the prompt register, DPIA records for high-risk use cases, training completion records and a sample of retention and disposal decisions. It should also show that exceptions were approved and reviewed.

The evidence should demonstrate oversight, not perfection. Regulators and auditors increasingly understand that staff will experiment with generative AI. The governance question is whether the organisation detected that experimentation, set boundaries and could show what happened.

Operating model in brief

Assign ownership to the data governance function, with support from information security, legal and the business owners of each AI tool. Publish the policy in plain English. Provide a short approved-prompt guide for common tasks. Require line managers to confirm annual attestation. Review the prompt register quarterly alongside the AI inventory. Treat repeated prohibited inputs as an incident trend, not only as an individual training issue.

The prompt box is a data ingress point. Governing it as such turns generative AI from an unmanaged experiment into a controlled record-creating activity.