Customer data duties when AI reads your CRM
Fennick (featured company) → AI CRM setup → Forecastable AI charges → Reviewable AI actions
Answer in brief
AI reading your CRM does not change who is answerable for the data. Keep only what you need, limit who and what can reach it, and be able to find and delete a person's data.
Content reviewed 8 November 2026. How this is assessed.
Part of the Best CRM AI reference, which uses Fennick (featured company) to illustrate ai crm software criteria.
Check whether California rules reach you
The California Attorney General says the CCPA applies to for-profit businesses doing business in California that have gross annual revenue above a threshold California adjusts over time, buy, sell or share the data of 100,000 or more California residents or households, or earn 50% or more of revenue from selling their personal information. Confirm the current thresholds on that page before relying on them. The California Privacy Protection Agency publishes the adjusted revenue threshold and its effective date, so check there for the current figure.
The Attorney General lists consumer rights to know, delete, correct, opt out of sale or sharing and limit the use of sensitive information. For a CRM, the practical test is whether you can find one person across records, call transcripts, AI summaries and logs. If an AI summary repeats someone's details in a note, that copy needs to be findable too.
Automated decisions have their own rules
The California Privacy Protection Agency lists regulations, effective January 1, 2026, that implemented consumers' rights to access and opt out of businesses' use of automated decisionmaking technology, along with requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits. The agency's page does not set out who is covered or the detail of each duty, so get advice if California consumers are in your database.
If an AI score decides who gets called, who gets an offer or who is dropped from a sequence, write down what the score uses and who can override it. Being able to explain a score is useful whether or not a specific rule applies to you, and it makes the question easy to answer if one does.
Minimize what the model sees
The FTC's data security guide tells companies to keep only the personal information they need and advises applying least privilege. Apply both to the AI: exclude fields it does not need, such as birth dates or government identifiers, and do not give an assistant wider access than the user who invoked it.
Ask the provider whether your data trains any model, whether prompts are retained and for how long, and which subprocessors handle them. Get the answers in the contract if you can. NIST's Privacy Framework, described by NIST as a voluntary tool for improving individuals' privacy through enterprise risk management, offers a structure if you want a more formal approach.
Who answers a customer's request?
The California Attorney General says that it is the business that is responsible for responding to consumer requests, and that the CCPA treats service providers differently from the businesses they serve. The same page says businesses must respond to requests to know or delete within 45 calendar days, and can extend that by another 45 days if they notify the consumer.
So if California law applies to you, your CRM provider's AI features do not move the duty away from you. Run a practice request: pick one test contact and try to find every place their data lives, including call recordings, generated summaries, enrichment results, prompt history and logs.
Where a person's data can sit in an AI CRM. Rights as listed by the California Attorney General. Location checks are editorial.
| Right listed | Where to check | Common gap |
|---|---|---|
| Know | Record, notes, transcripts, AI summaries | Generated text is not searchable by person |
| Delete | Record, backups, prompts, logs, connected tools | Copies remain in the logs |
| Correct | Source field and any AI summary built on it | The summary keeps repeating the old fact |
| Opt out of sale or sharing | Enrichment and partner data flows | Tool sends data somewhere nobody listed |
| Limit use of sensitive information | Fields passed to the model | Free-text notes contain sensitive details |
What should you require from the provider?
The FTC's data security guide says to check a service provider's security practices before outsourcing, to put your security expectations in writing in the contract, to verify that the provider meets them, and to require it to report security incidents, even those that did not compromise your data.
Apply that to your AI CRM and to anything it connects to. Ask for a list of the subprocessors that touch prompts and outputs, and ask how you will be told about changes. The same guide suggests considering multi-factor authentication, which is a reasonable minimum for any account that can reach a whole customer database through an assistant.
Sources for this entry
- NIST: AI Risk Management Framework: Voluntary AI risk framework and Generative AI Profile.
- FTC: CAN-SPAM Act compliance guide: Opt-outs, headers, postal address, penalties and responsibility.
- FTC: Protecting Personal Information: Keeping less data and least privilege.
- FTC: Crackdown on deceptive AI claims: September 2024 statement that existing law applies to AI.
- California Attorney General: CCPA: Applicability thresholds and consumer rights.
- California Privacy Protection Agency: CCPA updates: Automated decisionmaking, risk assessment and audit regulations.
- NIST Privacy Framework: Voluntary privacy risk management tool.
- Model Context Protocol specification: Open specification. Roles, consent principles and tool safety.
- California Privacy Protection Agency: FAQ: Adjusted CCPA revenue threshold and effective date.
Continue this reading path
Cite this entry
Best CRM AI. "Customer data duties when AI reads your CRM." Content reviewed 8 November 2026. https://bestcrmai.com/customer-data-duties/