A consultant has worked with the same assistant for months. He no longer explains what he does, which sector his clients are in or how he structures a report. That is the point, and it works well.
Then, in a conversation about an entirely different client, a detail surfaces that he mentioned about the first client three months ago. Nobody did anything wrong. The switch was simply on.
Memory is not the conversation
First, the distinction, because this is where assessments most often go wrong.
The context window is the working space of one conversation. When the conversation ends, that space is empty. What was in it remains in your history, but the model does not carry it into the next exchange.
Memory is a separate feature. The assistant extracts facts that look worth keeping and stores them as discrete notes: your role, your preferences, what you are working on, how you like to be addressed. When you start a new conversation, those notes are sent along with your first message.
Two systems, two retention periods, two switches.
Three owners of the same switch
The user. On consumer accounts you manage it. The major assistants offer a view of what has been remembered, and you can remove entries from it. The default is usually on.
The administrator. In enterprise tenants the control moves. The organisation can switch memory off for everyone, switch it on for everyone or configure it per group. It is one of those settings that survives a rollout on its default value because nobody went looking for it.
The vendor. The third owner and the least visible. Assistants embedded in your workspace pull in context automatically: recent documents, your calendar, the thread you are reading. Technically that is not memory, because nothing is stored as a note, but to the user it feels exactly the same. The assistant knows things you never told it. See how AI tools reach files you never uploaded.
Why this is more than a setting
Three consequences that turn up in practice.
Errors get repeated. If the assistant stored a wrong assumption (a role you do not hold, a client you no longer serve), it returns in every conversation and is treated as a given. It is harder to catch than a one-off mistake, because there is no source attached.
Third-party data ends up in it. Memory is meant for facts about you. In practice it also retains what you mention often, and that means client names, matters and cases. That is processing personal data belonging to someone who was never part of the conversation.
Information leaks from one context to another. What you say in one role can surface in a conversation held in another. For anyone serving multiple clients, that is not a theoretical concern.
What to do
For an organisation:
- Choose the memory setting deliberately rather than leaving it at the default. Both choices are defensible; not choosing is not.
- Treat memory as a distinct processing operation in your DPIA, with its own purpose and retention.
- Explain what happens. People who know something is being retained behave differently towards it.
For yourself, if it is on:
Read the memory list once a month. Not because something alarming is in there, but because it shows you what the assistant believes it knows. It usually makes for illuminating reading, and it is the only way to remove a wrong assumption before it gets repeated fifty times.
How memory works in each tool, and how to manage it with each provider, is covered in how AI memory works.
So the question is not whether an assistant remembers, because it does, but who owns the switch and whether anyone has ever looked at it. In most organisations nobody has. That is where you start.
