Every few weeks a new AI app arrives, and some arrive with enormous attention. When DeepSeek launched its chat app at the start of 2025 it went to the top of the app stores within days, and plenty of people tried it at work before anyone had asked what happened to what they typed.
The useful question is whether it meets the same tests as every other tool your people use, and the time to ask is before the first piece of work data goes in.
Six checks for any new AI app
1. What happens to what you type
Read the terms for the account type people would use. Find out whether conversations can train the vendor's models, how long they are kept, whether people at the vendor can read them and whether any of that can be switched off for the business rather than person by person.
2. Where it is processed and whose law applies
Wherever data is stored, the country it sits in has legal powers to obtain it, and the location matters for data protection transfers from the UK and the EU. Check where the app processes and stores data, what the vendor says about requests from authorities, and whether it offers a choice of region. Ask this of every app, because it applies to all of them.
3. Whether the business can control the account
Personal sign-up only, with no business tier, no company sign-in and no administrator, means the business cannot see or close the account. For most work, that alone rules an app out until a business version exists.
4. What it can reach
Phone apps ask for permissions, browser extensions read pages, and connectors reach into mail and files. List what the app asks for and decide whether the job needs it.
5. Its security record
Look for published security information, independent certifications such as ISO 27001, and how the vendor has handled past incidents. In January 2025, researchers at Wiz found a publicly reachable DeepSeek database holding chat history and secret keys, which DeepSeek closed quickly once told. Because incidents like that can happen to any vendor, look at how quickly and how openly each one was fixed.
6. What regulators have said
Data protection regulators sometimes act on new apps quickly. Within days of its launch, Italy's regulator blocked the DeepSeek app over questions about personal data. A regulator's action in a country where you operate is a strong signal to wait.
The model is not the same as the app
Some AI models are released with open weights, so other companies can run them on their own infrastructure. Because DeepSeek's models were released that way, the same model can be reached through the vendor's own app or, under a different set of terms, through a cloud provider you may already use. The checks above apply to whichever route your people would use, and the answers can be very different between them.
A quick way to decide
When someone asks to use a new app, run the four questions from your policy: where the data goes, what the account can reach, who supplies it and whether there is a reason to use it. Most requests are settled in minutes. Record the answer on the register either way, so the next person who asks gets the same one.
Where this fits
New apps that appear without anyone asking are covered in finding the AI tools nobody approved, and the approval route belongs in your AI policy. Watching for new tools and checking them as they arrive is part of Trackside.