What to Disclose When You Fine-Tune on a Customer's Own Support History

Quick answer

Disclose, specifically to that customer, that their own historical support transcripts were used to fine-tune the version of the agent serving them, what categories of information from those transcripts were used, and how to opt out of future fine-tuning without losing service. This is a narrower and more specific disclosure than general data reuse consent, because the customer is not being told their data trains a model in the abstract, they are being told a model was built specifically from their own history, which carries a different, more personal expectation of notice.

Why this needs its own disclosure, distinct from general training consent

General consent for reusing conversation data to train AI systems typically covers the broad case: customer conversations, in aggregate, may be used to improve the model that serves all customers. Fine-tuning specifically on one customer's own transcripts, to build a model or a configuration tuned to that customer's account, history, or preferences, is a narrower and more personal case. A customer who is comfortable with their anonymized conversation being one of a million training examples may feel differently about a model built specifically to reflect their own history, especially if that history includes disputes, complaints, or sensitive account details.

Tell the customer what was used and why

The disclosure should name that their own historical support transcripts were used, what the fine-tuning was intended to improve, for example faster resolution of issues similar to their past cases, and roughly what categories of information were included, without necessarily quoting the transcripts back verbatim. Vague language like 'we use data to improve your experience' does not meet a reasonable disclosure bar for this specific case, since it does not distinguish customer-specific fine-tuning from general product improvement, which most customers already expect and do not require special notice for.

Offer a real opt-out, not a buried toggle

A customer should be able to decline having their own history used for fine-tuning without losing access to the underlying service, and the option to opt out should be visible at account or privacy settings level, not buried several menus deep. If opting out means falling back to a non-personalized version of the agent, say so plainly, since customers should be able to weigh that tradeoff rather than discover it after the fact. This mirrors the transparency expectation set in trustworthy AI agent UI design and source citations, where the underlying principle is the same: customers trust systems more when they can see what is happening, not less, and a clear opt-out path builds more trust than it costs in engagement.

Treat this as a data retention and deletion question too

If a customer opts out after their history has already been used for fine-tuning, be clear about what that means practically, whether the specific fine-tuned artifact gets retrained without their data, retired, or whether the opt-out only applies going forward. This connects to the same infrastructure questions covered in data residency and sovereignty for AI agents: once customer-specific data has shaped a model artifact, deleting the raw transcripts does not automatically undo the model's learned behavior, and being honest with customers about that technical reality is part of a complete disclosure, not an optional detail.

FAQ

Does this disclosure requirement apply even if the fine-tuning only affects that one customer's experience?

Yes, and arguably it applies more strongly in that case, since a customer-specific fine-tune is exactly the scenario where a customer would reasonably expect to be told, versus a broad, anonymized training set where the connection to any one individual is much weaker.

Is a general terms-of-service clause enough to cover this?

A general clause can establish legal consent in some jurisdictions, but it does not meet a good-practice transparency bar, and in jurisdictions with meaningful data protection regulation, specific and informed consent for this kind of processing is often required regardless of what a general terms clause says.

What should happen if a customer requests deletion of a fine-tuned model built from their data?

At minimum, stop using their data in future fine-tuning runs and be transparent about whether the existing fine-tuned artifact will be retrained without it or retired; committing to a specific, honest answer here before you need one avoids an awkward improvised answer during an actual deletion request.