Ask “can my employer see what I type into AI” and you get an answer that depends on who is asking. A personal ChatGPT account used on your own phone is a different case from a company Copilot licence, and both are different from a personal account typed into a work laptop with endpoint monitoring turned on. The vendor policies answer only the first half of the question. The second half is documented by Microsoft, and it is the part that surprises people.
TL;DR
- Training and visibility are different questions. Microsoft states that prompts, responses, and Microsoft Graph data in Copilot are not used to train foundation models, and Anthropic says commercial inputs and outputs are not used to train its models by default. Neither of those facts has any bearing on whether an administrator can read what you wrote.
- Copilot prompts and responses are stored. Microsoft records “the user’s prompt and Copilot’s response, including citations to any information used to ground Copilot’s response,” and admins reach that data through Content search or Microsoft Purview (Microsoft Learn).
- Retention policies can reach consumer apps. Microsoft’s retention documentation lists ChatGPT, Google Gemini, the consumer version of Copilot, and DeepSeek among the supported AI app locations, so a work account’s retention policy can be aimed at personal AI apps and not only corporate ones (Microsoft Learn).
- AI apps can be found through the browser, not only through an app install. Microsoft describes consumer AI apps as detected “through browser activity” and categorized as Generative AI in the Defender for Cloud Apps catalog (Microsoft Learn).
- What you can control: delete your own activity history, check what your account’s activity setting does to retention, and keep personal questions on hardware your employer does not manage.
Three questions hiding inside one
“Can my employer see my AI chats” collapses three separate questions that have three different answers.
Who pays for the account decides what the vendor promises. Who manages the device decides what is on the machine. Who runs the compliance stack decides what is searchable, exportable, and retained after you delete it. The vendor documentation only ever answers the first question in a way that is easy to misread as the answer to all three.
Start with the one that is easiest to check. Anthropic’s data-retention help article, updated in August 2026, says that by default it does not use inputs or outputs from its commercial products to train its models, and that feedback data is stored in its secured back-end for up to five years (Anthropic). Google’s Gemini activity controls sit in the same territory: with activity on, chats saved in your Activity can be used to develop and improve services, a subset of chats is reviewed by human reviewers, those chats are disconnected from your account before going to service providers, and activity is deleted after 18 months by default, with 3 or 36 month options. With activity off, future chats are still saved for 72 hours (Google Help).
Read that carefully. The training answer is the reassuring one, and it is not the visibility answer.
What the employer pays for: Copilot
For a company-licensed Copilot, the visibility question is answered plainly in Microsoft’s own documentation. Interactions are stored: Microsoft says it stores data about user interactions, and that the stored data includes the user’s prompt and Copilot’s response, together with the citations used to ground that response. That record is the user’s Copilot activity history, and it is processed and stored under the same contractual commitments as the rest of a Microsoft 365 tenant’s content.
The next sentence is the one people quote in meetings: admins can view and manage it. Microsoft states that admins can use Content search or Microsoft Purview to view this stored data, and can set retention policies for chat interactions with Copilot. For Teams chats with Copilot, admins can also use the Microsoft Teams Export APIs to view the stored data (Microsoft Learn).
Microsoft also documents the part most employees never think about: an AI that summarizes your performance is a different product decision. Its privacy page says workplace harms means inferences, judgments, or evaluations about an employee’s performance, attitude, internal or emotional state, or personal characteristics, and it ends with “We restrict the use of generative AI or models from being used for these purposes.” A restricted use is not the same as a logged prompt. The prompt that produced the summary is stored; what you can be evaluated on is constrained.
What you control is deletion, not visibility. Microsoft documents that users can delete their Copilot activity history, “which includes their prompts and the responses Copilot returns,” and it points them to the My Account portal (Microsoft Learn).
What IT manages: the device and the browser
The work laptop is a separate question from the work account, and it is where a personal AI account quietly becomes company data.
Microsoft describes a category it calls Other AI apps, which it says are “detected through browser activity” and then categorized as Generative AI in the Defender for Cloud Apps catalog. That list contains ChatGPT, Google Gemini, the consumer version of Microsoft Copilot, and DeepSeek (Microsoft Learn). Detection through browser activity means the free personal tier is inside the perimeter even though the employee never asked an IT department for anything.
The same page describes what can be done about it. Windows computers onboarded to Microsoft Purview can be configured for Endpoint data loss prevention policies that warn or block users from sharing sensitive information with third-party generative AI sites accessed via a browser. Microsoft’s own worked example is a user being prevented from pasting credit card numbers into ChatGPT, or seeing a warning they can override (Microsoft Learn).
For people on a company account, the enterprise tier changes the picture again. Microsoft lists Anthropic Claude (Enterprise) and ChatGPT Enterprise under Enterprise AI apps, alongside Copilot experiences, as the categories its compliance tooling covers (Microsoft Learn).
What compliance is configured: retention, audit, and eDiscovery
Retention is the part that outlives deletion, and Microsoft’s documentation here is unusually blunt about your own UI not telling the truth.
Microsoft says prompts and responses for AI apps are stored in a hidden folder in the mailbox of the user who ran the app, that the hidden folder is not designed to be directly accessible to users or administrators, and that it stores data compliance administrators can search with eDiscovery tools. The conclusion Microsoft draws is worth keeping: “Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements” (Microsoft Learn).
The timing matters if you are trying to make something go away. Microsoft documents that the Exchange timer job that evaluates expired items typically runs every 1 to 7 days, that items wait at least 1 day in a soft-delete folder, and that a delete action after 1 day can take 16 days before the message is permanently deleted and no longer returned by eDiscovery searches (Microsoft Learn).
Three more capabilities sit alongside retention, all documented for AI interactions:
- Auditing. Prompts and responses are captured in the unified audit log, including how and when a user interacted with the app and references to Microsoft 365 files accessed during the interaction.
- eDiscovery. Because AI prompts and responses are stored in a mailbox, an eDiscovery case can search a user’s mailbox using the Copilot activity condition, which Microsoft says “includes all Copilot and other AI application activity.”
- Communication compliance. Microsoft’s compliance tooling can detect and manage issues across channels that “include user prompts and responses for AI apps,” with pseudonymized usernames and role-based access by default.
All three come from Microsoft Learn.
What This Means
The honest summary is that “my employer cannot see it” is a claim about a vendor’s training policy, and that is the narrowest of the three questions. Visibility is set by your account type and your employer’s configuration, and in at least one documented case, by the browser your prompts travel through.
Two habits close most of the gap. The first is to ask which account a tool is signed into, before typing anything sensitive; a personal account on a managed device is the case where the vendor promise holds and the device control does not. The second is to treat a work AI chat as company content, because on a corporate Copilot licence it is stored content that an admin can search, retain, and export.
If the answer has to be “nothing leaves my control,” local models are the only version of the answer that holds regardless of employer configuration. What each local runtime actually sends home covers that layer, and how to read an AI privacy policy before you sign up covers the rest. If you do paste into a hosted tool, redacting personal information first is the mitigation that survives either case.
The Bottom Line
Yes, in documented and common configurations. A company-licensed Copilot stores your prompt and the response, and admins can reach that data through Content search, Purview, or the Teams Export APIs. Retention policies reach further than the company’s own apps, covering ChatGPT, Google Gemini, the consumer Copilot, and DeepSeek, with data held in a hidden mailbox folder that eDiscovery searches, an audit log that records the interaction, and communication compliance that reads the prompt text. On a managed Windows device, Purview endpoint policies can detect those same consumer apps through browser activity and warn or block when you paste sensitive text into them. None of that is about training. Anthropic’s commercial default of not training on customer inputs and Microsoft’s statement that Copilot prompts are not used to train foundation models both stay exactly true while all of the above happens. Delete your activity history where you can, keep personal questions off managed hardware, and read the retention numbers above as the ones that actually decide how long a message lives.