Where does your data go after you hit Enter?

Here’s an uncomfortable question: if an AI model is safe enough to sell to customers, shouldn’t it be safe enough for your own employees to use?

Recent reports suggested a large technology company restricted internal use of a leading AI model over concerns about data retention and the handling of prompts. Whether that’s the full story isn’t the point.

The point is this: most organisations are evaluating AI on what the model can do. Very few are evaluating it on what happens to the data after the prompt is submitted.

We’ve entered a phase where AI procurement is moving faster than AI governance.

• The business sees productivity.
• The security team sees data flows.
• The legal team sees liability.

And the company often sees none of it until something goes wrong.

What concerns me is how many organisations can answer detailed questions about model performance, yet struggle with basic questions such as:

• Who retains our prompts?
• How long are they retained?
• Can they be reviewed by the vendor?
• What contractual protections exist if sensitive data is exposed?

These are not privacy questions. These are business risk questions.

The biggest AI risk today isn’t hallucination. It’s organisations deploying tools they don’t fully understand because everyone is afraid of being left behind.

The companies that win with AI won’t be the fastest adopters. They’ll be the ones that know exactly where their data goes after they hit “Enter”.