A team wants to send production records to an external AI service without assessing its retention or training terms. What should happen first?

1. Remove the records' file extensions before transfer
2. Review the data flow, contractual terms, sensitivity, and applicable obligations
3. Rely solely on the model's fluent output
4. Assume every AI service has identical data handling