The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For organizations using AI with sensitive data, the model is only one part of the deployment challenge. Access controls, data governance, privacy, incident response, staff readiness, measurable value, and control over vendors and data location all matter. NTT DATA framed its May 2026 findings this way: “AI is running into a wall – and it’s not the model.” That is a useful description of operational barriers, not proof that model capability never matters.
Why AI projects can stall beyond the model
A capable model cannot make a deployment safe or useful by itself. The organization still has to decide which information the system can reach, what it may do with that information, who is accountable for its output, and how to respond when something goes wrong. These conditions shape whether a model can be used reliably in a real workflow.
As an Amazon Associate I earn from qualifying purchases.
NTT DATA’s May 14, 2026 release describes two related concerns. Private AI focuses on protecting sensitive enterprise data, controlling access, and limiting exposure. Sovereign AI focuses on whether AI systems, data, and operating environments meet jurisdictional, regulatory, or national or regional control requirements. Its release describes two studies involving nearly 5,000 senior decision-makers across more than a dozen industries, more than 30 markets, and five regions; those respondents should not be treated as representative of every organization. Read NTT DATA’s findings on Private AI and Sovereign AI.
What does “using data with AI” actually mean?
Different AI operations expose data in different ways. A concern about using business information to train an external model does not, by itself, establish the same level of concern about asking a model to answer a question, retrieve information from an internal source, or take an action in a governed system.
#1 Best Overall
- Training: Data is used to change or improve a model. The UK Business Data Survey 2026 asked businesses how they felt about business data being used to train external AI models, including documents, images, and customer interactions, directly or after anonymisation.
- Inference: A model processes a prompt or input to produce an output. This is not the same question as whether that input is used for external model training.
- Retrieval: A system finds information in a source, such as business files, and supplies relevant material to a model. The key questions include which files it can retrieve and whether the user’s existing permissions remain in force.
- Action: An AI system initiates or recommends a step in a workflow. Access, approval, logging, and the ability to stop or override the system become especially important.
The UK survey found that in 2025–26, among UK businesses handling digitised data, 73% were uncomfortable with business data being used to train external AI models: 25% were somewhat uncomfortable and 48% very uncomfortable. Eighteen percent were comfortable. Separately, 41% of UK businesses handling digitised data reported using AI technologies. These are different measures; the survey does not establish that the businesses using AI were using it for external training. See the UK Business Data Survey 2026.
Policies are not the same as operational control
A written policy can set expectations, but it does not demonstrate that access is correctly configured or that a team can respond quickly to an incident. Organizations need both rules and working procedures: clear ownership, access decisions, escalation paths, and a tested way to pause or override AI systems.
In ISACA’s 2026 AI Pulse Poll, which gathered responses from more than 3,400 digital trust professionals, 38% reported that their organization had a formal, comprehensive AI policy; 30% reported a limited policy; and 25% reported no active policy. In the UK Business Data Survey 2026, 17% of UK businesses using AI reported a policy or guidelines for AI use or development—5% formal written and 12% informal. Among UK businesses with a policy or guidelines, 62% said it covered AI access to business data and files. The populations and questions differ, so these figures should not be compared as if they measured the same thing.
Incident readiness is a separate test. ISACA reported that 56% of respondents did not know how long it would take to halt an AI system during a security incident, and 39% did not know whether a documented shutdown or override process existed. Those answers point to uncertainty among poll respondents, not proof that every organization lacks a stop mechanism. They do show why a policy should be paired with a known, usable response process. Read ISACA’s 2026 AI Pulse Poll findings.
Data locality and vendor dependence affect control
Some organizations must account for where data, models, and computing infrastructure are operated, particularly when legal or regulatory requirements vary by jurisdiction. They may also need to know how difficult it would be to move to another model or provider if requirements, costs, or capabilities change.
An IBM Institute for Business Value study conducted with Oxford Economics surveyed 1,000 senior executives responsible for AI, data, technology, or related capabilities across 16 countries and 17 industries. The survey ran from February to April 2026. IBM reported that 68% of respondents said meeting data residency and sovereignty requirements across geographies was challenging, while 71% said switching their primary AI vendor or model would be difficult. These are executive perceptions reported in IBM-sponsored research, not measurements of every organization’s technical ability to move. Ana Paula Assis, IBM Senior Vice President and Chair, EMEA and APAC, said in the study foreword: “AI has introduced new forms of dependency that evolve faster than traditional governance, procurement, or technology cycles were designed to handle.” Read the IBM Institute for Business Value study.
Skills and returns are part of readiness
Governance and infrastructure do not deliver value on their own: people need to know how to use AI appropriately, and organizations need a way to assess whether its use is worthwhile. ISACA’s 2026 poll found that 78% of respondents said AI skills were very or extremely important to their profession, while 33% said their organization trained all employees on AI.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #4
The same poll found that 22% said AI return on investment had met or exceeded expectations, 23% said it was too early to tell, 22% did not know the ROI, and 20% cited limited ROI so far. These results do not establish one cause for uncertain or limited returns, nor do they show that workforce training alone would resolve the issue. Keith Bloomfield-DeWeese, ISACA Senior Manager of AI Product Development, put the time dimension this way: “The thing with ROI in AI is that it doesn’t arrive on schedule; it’s not a switch that can be flipped: it’s the result of sustained investment in the people, processes, and governance structures that make intelligent systems reliable.”
Data quality and privacy practices are part of that foundation. Ulrika Dellrud, Chief Privacy and Data Ethics Officer at Smarter Contracts and an ISACA Emerging Trends Working Group member, said: “Effective AI governance also starts with mastering your data: without strong data and privacy governance as a foundation, organizations cannot manage AI risk, ensure trust, or unlock sustainable value.”
Best Value
A practical readiness check for sensitive-data AI
Before expanding an AI use case, assess the whole path from input to outcome—not only the model’s answer quality.
- Specify the operation. State whether the use involves training, inference, retrieval, or action. Record what data is involved and whether it leaves a controlled environment or is used by an external service.
- Map access to source data. Identify which people and systems can reach the underlying information. For retrieval, verify that the AI experience respects the permissions users have on the original files and data.
- Check location and jurisdiction. Establish where relevant data, models, and compute are operated, then assess the locality constraints that apply to the use case.
- Name accountable owners. Assign responsibility for data access, policy, deployment approval, monitoring, incident response, and decisions to pause or override the system.
- Test the stop path. Confirm who can halt the system, how they do so, and how the organization would know it had worked. A written process should be accessible to the people expected to use it.
- Prepare staff for the task. Train the employees who use or oversee the system on its intended role, its limits, and how to handle sensitive information and questionable outputs.
- Measure value and portability. Define how the use case’s value will be assessed, and consider how data, workflows, and dependencies could be handled if the organization changes models or providers.
There is no single architecture that resolves all of these concerns. The appropriate controls depend on the data, operation, jurisdiction, workflow, and risk tolerance involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
