The context window, and why the model does not know you

A language model has no memory. What it has is a context window: the stretch of text it can take into account when producing the next piece of output. Everything the model appears to know about your situation is in that window, and nothing outside it exists as far as the model is concerned.

What is actually in the window

Typically four things, concatenated into one body of text before the model ever runs. A system prompt written by whoever built the product, which you usually cannot see. Any material the application has retrieved and inserted on your behalf, such as documents from a knowledge base. The conversation so far. And your latest message.

The model treats all of it the same way. It does not distinguish an instruction from the vendor, a sentence from a retrieved document, and a sentence you typed, because they arrive as one undifferentiated stretch of text. That single fact is the root of prompt injection: text placed inside a document can read as an instruction when the document is pulled into the window. Prompt injection has its own entry in the OWASP Top 10 for LLM Applications 2026, and it is not a bug to be patched, because the property it exploits is how the system works.

The window is finite

Context windows are large and growing, and they are bounded. When a conversation exceeds the limit, something has to give. Applications handle this in different ways: dropping the oldest turns, summarising earlier exchanges into a shorter note, or retrieving only the fragments deemed relevant. You are usually not told which, and you are usually not told when it happened.

The practical consequence is specific. The constraint you gave at the start of a long session, the one about never quoting figures without a source, may no longer be in the window by the end of it. The model has not decided to ignore you. It has stopped being able to see the instruction, and it will not say so, because a model cannot report the absence of text it never received.

Longer conversations are therefore less reliable than short ones in a way that runs against intuition. It feels as though the assistant is building understanding as you go. What is happening is that early material is being pushed towards the edge.

Everything in the window has left your control

Whatever you paste goes to wherever the model runs. If that is a commercial service, personal data has been disclosed to a third party, and the question of what happens to it afterwards is a contractual one rather than a technical one. The revised Swiss Federal Act on Data Protection, in force since 1 September 2023, requires processing to be lawful, proportionate and limited to the purpose it was collected for, and Article 19 requires people to be told who receives their data and, for transfers abroad, the state involved and the safeguard relied on. A claim narrative pasted into a public assistant engages all of that, and the deployment happened at the moment of pasting rather than at the moment anyone approved it.

What the window is good at

None of this makes the mechanism weak. Material you place in the window is material the model is working directly from, and that is the most reliable way to use one of these systems. Asking a model to summarise a document you supplied is a fundamentally safer operation than asking it to recall a fact, because in the first case the source is present and checkable and in the second it is a pattern in parameters you cannot inspect.

Two habits follow. Supply the source rather than relying on recall. And keep sessions purposeful: start a new one for a new task rather than extending a conversation that has drifted, because a fresh window is a window you can account for.

The oversight consequence

Article 14 of the EU AI Act requires human oversight by people who understand the system's capacities and limitations, can monitor its operation, remain aware of automation bias, can correctly interpret output, and can decide not to use it or to disregard, override or reverse it. Someone who does not know that their standing instruction fell out of the window cannot do the third of those things. Understanding the context window is not a technical nicety; it is a precondition for the oversight the Act requires.

As of 24 September 2026.