Most large UK companies have no idea how their sensitive data is being used when AI systems process it overseas. A survey of senior technology and data leaders at companies with revenues above £100mn found 61 per cent lack a full understanding of how data is handled abroad. Nearly three-quarters of respondents said data transfers out of the UK through AI systems happen at least weekly, with a third reporting daily flows.

The knowledge gap creates real risks. In August 2024, researchers discovered a vulnerability in Slack AI where malicious instructions embedded in public channels manipulated the system to access data from private channels. Microsoft confirmed in February that a bug in Microsoft 365 Copilot Chat had allowed it to process emails marked as confidential. "People seem to have very little idea of how the data governance works," said Matthew Hodgson of Element.

Half of respondents warned that limited oversight could trigger international regulatory breaches, while 36 per cent cited risks of fines or investigations. Confidence drops sharply outside Europe: 70 per cent feel assured about the UK, 62 per cent about the EU, but only 31 per cent about North America and just 12 per cent about Asia-Pacific.