Most large UK companies do not know how their sensitive data is used when AI systems process it abroad, according to research highlighting risks from fast-moving tech.
A Harbr Data survey of senior technology and data leaders at UK companies with revenues exceeding £100mn (€116mn) found that 61 per cent lack a full understanding of how data is handled abroad, with boards taking most of the blame.
Nearly three-quarters of respondents said data is transferred out of the UK through AI systems at least weekly, with a third reporting daily flows.
In milder cases, ignorance about where and how data is processed can trigger regulatory and compliance issues related to privacy, residency rules, and security. In worst cases, it can lead to leaks or malicious use, which is a sure way to ruin your quarter.
In August 2024, researchers disclosed a vulnerability in Slack AI, an add-on to the messaging platform, in which malicious instructions were planted in public channels to manipulate the AI and access private data. Slack said at the time it found no evidence of active exploitation or unauthorised access to customer data.
In February, Microsoft confirmed a bug in Microsoft 365 Copilot Chat had allowed it to process and summarise email messages, even those with a confidential label.
Half of respondents to the Harbr survey said limited oversight could lead to breaches of international regulations, while 36 per cent cited fines or investigations and 35 per cent pointed to geopolitical exposure.
When systems process personal data outside their country of origin, such as transfers from the EU to other jurisdictions, strict legal frameworks apply and often require specific safeguards.
Confidence in AI data handling drops sharply outside Europe: 70 per cent of respondents said they are confident about the UK and 62 per cent about the EU, yet only 31 per cent in North America and 12 per cent in Asia-Pacific.
Analysts expect more companies to adopt region-specific AI systems by 2027 as regulatory pressure tightens.
Harbr Data, co-founder Anthony Cosgrove said: “We’re potentially talking about a whole range of critical business processes that now leverage AI and are exchanging data and sharing data with these AI tools.”
