Free Tool

Fine-tune it, or gate it?

Seven inputs covering sensitivity, revocability, regulation, and the value this data actually adds. A weighted score returns a clear call, with the risk flags a "yes" answer still needs.

Listen to this briefing

Should You Fine-Tune, or Use Retrieval?

0:00

Your Dataset

Restriction Level Today3

How restricted is access to this data today, before any AI touches it?

Fully publicExec / board-only
Revocability Need3

If this data needed to be deleted or revoked later, how important is that?

Doesn't matterMust stay revocable
Regulatory Obligation3

Is this data subject to specific retention, deletion, or processing rules?

Not regulatedHeavily regulated
Model Value3

How much would training directly on this data improve the model's usefulness?

Marginal valueCore to the model
PII Density3

How much personal or identifiable information does this data contain?

NoneExtensive
Update Frequency3

How often does this data change, get corrected, or need updating?

Static, rarely changesFrequently updated
Blast Radius If Leaked3

If this surfaced to the wrong person, how severe would the harm be?

Minor / no real harmSevere: legal, competitive, safety

Your Call

RETRIEVAL-ONLY

Keep It in a Permission-Gated Retrieval Layer

This dataset carries enough risk across sensitivity, revocability, or regulation that baking it into a model's weights is not worth it. Serve it through access-controlled retrieval instead, where a bad query can still be fixed.

Retrieval-OnlyFine-Tune Safe
50/100 fine-tune suitability

Key factors driving this call

  • Balanced inputs across sensitivity and value keep this a close call either way

The threshold for Fine-Tune Safe is set at 60/100, not 50. Fine-tuning is irreversible, so the bar to clear is deliberately higher than a coin flip: when a dataset is genuinely borderline, this tool defaults to gated retrieval.

Opens a 3-page report with your inputs, calculated below. Print or save it as a PDF from there.

Fine-Tune Safe

When it applies

The data adds real value to the model, and you would be genuinely comfortable handing it to every employee who has access to the model. Low sensitivity, no meaningful revocability need, and nothing that a regulator would ask you to trace or erase later.

What to still do
  • De-identify any residual PII before training, even at low density
  • Document the training set for EU AI Act traceability requirements
  • Re-check this classification if the dataset's contents change materially

Retrieval-Only, Gated

When it applies

The data is sensitive, regulated, changes often, or you need the ability to revoke access later. A model can't selectively forget what it memorised during training, so this data stays in a document store where every query is filtered against the requester's clearance before anything reaches the model.

What to still do
  • Gate at query time with row-level security, not after the model has already generated an answer
  • Redact structured sensitive fields at ingestion, not at the screen
  • Log every retrieval with an identity trail for audit and incident response

If It's Still Not Comfortable

When it applies

A small category of data shouldn't touch an AI system at all, gated or not: material under legal hold, privileged legal communications, or data with an explicit contractual or regulatory bar on automated processing. This tool scores fine-tune vs. retrieval; it doesn't clear that third question.

What to still do
  • Route anything scoring high on both Regulatory Obligation and Blast Radius to legal review before it touches any AI system
  • Treat "gated retrieval" and "not connected to AI at all" as genuinely different answers
  • Re-run this check after a legal or compliance review changes the facts