You confirm your organization owns or has explicit authorization to run phishing-awareness simulations against the users you upload.
This is a serious responsibility.
An audit record of this confirmation is stored with your account.