b'datapresentdifferenttypesofprivacyandsecurityrisksthantraditionalcomponents.Ingeneral, understanding which parts of the system are AI-based and which parts are not can help lawyers make better decisions about client confidentiality, vendor due diligence, and ethical compliance. Retrieval-Augmented Generation Many GAI tools use retrieval-augmented generation ( RAG ) to help reduce hallucinations and provide the system with specific knowledge about individual situations. The RAG database might be provided by an entirely separate company, and these databases often store verbatim confidential information for extended periods.BecauseRAGdatabasescanretainsensitivedataandoperatelargelybehindthescenes,itis important for lawyers to verify what subcontractors are involved in managing the GAI tool, including the RAG database and what privacy and security assurances apply across the entire supply chain. The RAG process is depicted using grey arrows in Figure 2 and can be understood as follows: First , the user enters aprompt into the user interface (such as, forexample, askingChatGPT a question). Normally, this would be sent directly to the transformer model for processing, but, since the system uses RAG, something else happens behind the scenes. Second , the users prompt is redirected to a special type of AI-compatible database.The purpose of this database is to hold specific information the user is likely to need in a way that is pre-formatted for processing by the transformer model. For example, in a legal research system, the AI-compatible database might hold statutes, cases, law review articles, and other law-related resources.Third ,thesystempullsrelevantsnippetsofAI-formattedinformationfromtheAI-compatible database and prepends this additional information to the users original prompt.Fourth , the combination of the users original prompt and the augmented information from the AI-compatible database is sent to the transformer model for processing.Finally , the transformer model generates output in response to the users augmented input. In other words,thetransformermodelsgenerationisaugmented bywhatithasretrieved fromtheAI-compatible database, so we call itva . While lawyers do not need to understandr ethtreie teclh-anuicgaml ednetteadil gs eonferaotwio nRAG and AI-compatible databases should hfunction, lawyers understand that multiple providers are likely to be involved in the process of storing, processing, and transmitting information that moves through a typical GAI system. One provider might supply the transformer model, while a different provider might supply the RAG database. When reviewinganycloud-basedsystemusedtostore,process,andtransmitconfidentialinformation,its important to have a basic understanding of what third parties have access to that information and what privacy and security assurances are in place to support these disclosures. Data Retention Within the Model As weve learned, the portion of a GAI tool that performs the actual artificial intelligence processing is the transformer model. Accordingly, a key data retention issue to consider is whether the transformer model Page | 28'