Survey finds UK firms unclear on how AI sends data overseas

In short: Many large UK companies say they do not fully understand what happens to their data when AI tools process it in other countries.

What's going on

A survey by Harbr Data asked senior technology and data leaders at UK companies with revenue above £100 million about how their data moves through AI systems. It found 61% do not have a full understanding of how their data is handled overseas.

The survey also suggests that cross-border data movement is common. Nearly three-quarters of respondents said data is transferred out of the UK through AI systems at least weekly, and about a third said it happens daily.

This matters because data rules can change when information leaves a country. Moving personal data abroad can trigger extra legal requirements, like needing specific safeguards, similar to needing special paperwork when shipping goods across borders.

Some recent incidents show why companies worry. Researchers disclosed a weakness in Slack AI in August 2024 where hidden instructions in public channels could influence the AI and potentially expose summaries of private information, although Slack said it found no evidence of customer data being accessed without permission. In February, Microsoft confirmed a bug in Microsoft 365 Copilot Chat that let it process and summarise emails, including messages marked confidential.

What to watch

Harbr Data and analysts expect more companies to adopt region-specific AI setups by 2027, as rules and enforcement tighten. Watch for boards and regulators pushing companies to map where data goes, who can access it, and whether information fed into AI tools could be reused to train those tools and later show up in other outputs.

Source: Financial Times