UK firms lack visibility over AI data processing abroad
A survey of large UK firms found that 61% lack full understanding of how their data is used when processed by AI systems overseas, with data transfers occurring at least weekly at 73% of companies. The lack of visibility creates GDPR compliance risks and potential exposure to regulatory fines, as firms struggle to audit AI-driven data flows across borders.
What happened
A survey by Harbr Data of senior IT and data leaders at UK companies worth £100m or more found that 61% lack full understanding of how their data is used once processed by AI systems overseas. Nearly three-quarters of respondents said their data is transferred out of the UK via AI systems at least weekly, whilst a third reported daily flows.
Employees increasingly upload sensitive company material into tools like ChatGPT via email and messaging apps with limited visibility on what happens to data once processed. Recently reported vulnerabilities in Slack AI and Microsoft 365 Copilot showed how systems could access or summarise data beyond their intended limits, even where safeguards were in place.
Reported impact
Under UK GDPR, firms must show where personal data is processed, on what basis and under what safeguards. A total lack of visibility over AI-driven workflows can amount to non-compliance, as data entered into tools can pass through various jurisdictions or be incorporated into underlying models without clear audit trails.
Nearly half (47%) of respondents said their organisations do not have enough qualified staff to manage cross-border AI, and 28% pointed to unclear ownership with responsibility spread across multiple teams. Half (50%) of respondents warned that limited visibility could lead to breaches of international compliance rules, whilst over a third cited potential fines.
Index analysis
The survey found that 70% of respondents trust UK data handling and 62% trust the EU, but only 31% expressed confidence in North America. Recent Hitachi Vantara research found that 77% of UK leaders think data complexity is growing too quickly, and 67% cite data security as their top concern, whilst 85% of firms now see data sovereignty as critical.
Governance controls
More than 40% of respondents are unsure whether their systems fully comply with international regulations and 38% cite difficulties auditing AI-driven decisions that rely on data from multiple regions. Analysts predict that a growing number of organisations may adopt region-specific AI platforms by 2027 in response to regulatory and geopolitical pressures.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.