Which AI Tools Are ISO 42001 Certified, and How to Stop Them Training on Your Data

AI tools are now woven through everyday business: drafting emails, summarising documents, writing code. For anyone responsible for governance, two questions matter more than which model is “best”: is the provider certified to manage AI responsibly, and is your data being used to train their models? The answers vary a lot between tools, and between the free and business versions of the same tool.

This is exactly the territory ISO 42001, the international standard for an AI management system, is designed to govern. Below is where the major providers stand on certification, and how to stop each one training on your content.

What ISO 42001 has to do with it

ISO/IEC 42001:2023 certifies that an organisation has a managed, audited system for developing and operating AI responsibly, covering risk, transparency, data governance and human oversight. For a business choosing AI vendors, a provider holding ISO 42001 is a meaningful signal that responsible-AI practices are independently assured rather than just claimed. It’s the AI-world equivalent of asking a supplier for ISO 27001 before trusting them with your data.

Which AI tools hold ISO 42001 certification?

More than just one, as it turns out, though the detail matters, because certification often sits with the cloud platform or enterprise product rather than the consumer app.

A useful distinction: the AI lab and the cloud it runs on are certified separately. Amazon Web Services holds ISO 42001 too, so a model served through AWS Bedrock or Google’s Vertex AI inherits that platform’s governance, even where the model maker’s own status is less clear.

How to stop each tool training on your content

Settings and labels change often, so treat the paths below as a guide and check the current wording in each app. As a rule, consumer and free tiers train on your data by default and you must opt out; enterprise, API and workspace tiers are generally excluded by default.

ChatGPT (OpenAI)

On Free, Plus and Pro, training is on by default. Turn it off at Settings > Data Controls > “Improve the model for everyone”. “Temporary Chat” is never used for training. ChatGPT Business, Team, Enterprise, Edu and the API are excluded by default, with no toggle needed.

Gemini (Google)

In the consumer Gemini app, turn off “Gemini Apps Activity” (recently relabelled “Keep Activity”). Important caveat: conversations selected for human review can be retained for up to three years and are not removed when you delete your activity. Google Workspace, Vertex AI and the paid Gemini API are excluded from training by default.

Claude (Anthropic)

Anthropic moved consumer Claude (Free, Pro and Max) to an opt-out model in August 2025. Set your preference under Settings > Privacy > “Help improve Claude”. Allowing training extends data retention to five years; declining keeps the standard 30 days. Claude for Work (Team and Enterprise), Claude for Education, Claude Gov and API use (including via Amazon Bedrock and Google Vertex AI) are excluded by default.

Microsoft Copilot

Microsoft 365 Copilot (the commercial product) does not use your tenant’s prompts, responses or data to train foundation models. That’s a contractual default, and no setting is required. The free consumer Copilot is different: training is on by default, and you opt out under Profile > Memory > Personalization and memory by turning off model training on text and voice.

Meta AI (Facebook / Instagram)

Meta trains its AI on public posts, photos and comments from adult Facebook and Instagram accounts (private messages and minors’ content are excluded). In the EU/UK there is an objection form, though the legal basis is being challenged. In Australia there is currently no opt-out: at a 2024 Senate hearing Meta confirmed it uses Australian adults’ public posts to train AI, and the only real defence is to set your posts to private. A pointed reminder that “free” often means you’re the training data.

DeepSeek

DeepSeek’s privacy policy states it uses user inputs (text, prompts, uploaded files and chat history) to train and improve its technology, and that data is stored in the People’s Republic of China, where it is subject to local laws. A training opt-out was reportedly added in 2025, but its coverage is disputed. For organisations that want DeepSeek’s capability without its servers, the open model weights can be self-hosted, which moves the governance responsibility (and the ISO 42001 obligations) onto you.

Grok (xAI)

On grok.com, opt out at Settings > Data > “Improve the model”; in the Grok app the same toggle sits under Settings > Data Controls. “Private Chat” conversations aren’t used for training. Note that Grok inside X (formerly Twitter) is governed separately and is on by default. Switch it off under X > Settings and privacy > Privacy and safety > Grok & third-party collaborators. xAI’s API and enterprise tiers aren’t used for training by default, and in the EU/EEA xAI agreed to stop training Grok on users’ personal data after action by Ireland’s Data Protection Commission (related inquiries continue). xAI publishes SOC 2 Type 2 compliance but shows no public ISO 42001 certification.

Training is one question. Memory is the other.

Every setting above stops a provider training on your content. None of them stops the tool remembering it. Through 2025 and 2026 the major assistants added persistent memory, which carries information between sessions and stores it against your account rather than discarding it when you close the tab. These are separate controls, and switching training off does not switch memory off. A business that carefully opted out of training two years ago may now have a second data store it never decided to create.

Claude’s August 2026 memory update is a useful illustration, because it is unusually explicit about what is happening. Memory is stored as a set of files the user can open, edit or delete; it extends beyond chat to cover automated task work; and sensitive categories such as health conditions and religious beliefs sit behind a separate consent control rather than being swept in with everything else. Other assistants have their own versions, with different defaults and different visibility. The point is not about one vendor. It is that memory is now a question you have to ask of every tool on your list, and the answer changes without warning.

For anyone maintaining an AI inventory, this is the awkward part. A tool recorded last year as “no retention, training disabled” may now hold a persistent store of client names, pricing and system detail that nobody chose to create. That is squarely the data question ISO 42001 asks, and where personal information is involved it engages your obligations under Australian Privacy Principle 11. The fix is not complicated: check whether memory is on for each approved tool, decide whether it should be for that tool and that data, turn off what you do not want, and record the decision so it can be shown to somebody who asks. The harder lesson is that a vendor can change what its product does with your data without you doing anything at all, which is the same reason your AI policy should not name a vendor, and why a risk assessment needs a review trigger rather than an annual date in a calendar.

The takeaways for businesses

• Free and consumer tiers usually train on your data by default. If staff use personal ChatGPT, Gemini or Copilot accounts for work, assume your content may be training a model unless someone has opted out.
• Business and API tiers are the real control. Enterprise ChatGPT, Claude for Work, Google Workspace, Vertex AI and Microsoft 365 Copilot all carry default no-training commitments, far more reliable than a toggle a user might forget.
• Deleting a chat doesn’t always erase it from training. Opting out generally affects future use only, not data already in a training run.
• Certification of the model and the cloud it runs on are separate things. Check both.

Turning this into actual governance

Knowing the settings is one thing; having a system that decides which tools are approved, on which tiers, with which data, and keeps that under review, is another. That’s what an AI management system delivers, and it’s what we build with clients pursuing ISO 42001 certification. If unmanaged AI use is a worry, our guide to shadow AI in the workplace is a good next read, and our ISO 42001 cost guide sets out what certification involves.

Need help putting AI governance on a formal footing? Talk to our ISO consultants in Australia.

Provider settings, certification scopes and memory behaviour change frequently. This article reflects information available in August 2026 and is not legal advice. Verify the current settings in each tool before relying on them.