In short: companies are no longer trusting external AI because every query sent to a cloud provider takes corporate data outside their control, with three consequences that have already been quantified (leaks, extra cost per incident and regulatory exposure). The response gaining ground is to process AI within the organisation's own infrastructure, with private or local models, so that the data never leaves.
52%
Of companies limit the use of external AI because of concerns over the privacy and security of their data
ONTSI / InfoJobs, 2025
1 in 5
Organisations suffered a breach caused directly by the use of external AI without internal oversight
IBM Cost of a Data Breach, 2025
36%
Of organisations hand data over to external AI tools without applying any privacy protection
Kiteworks Data Security Report, 2025
The adoption of AI in business is no longer a question of innovation; it has become a decision with direct consequences for data privacy and sovereignty. As organisations incorporate these tools into their workflows, there is growing awareness of a risk that until recently went unnoticed: every query sent to an external provider means handing information over to an infrastructure the organisation does not control.
The 2025 data mark the turning point. Only 9% of Spanish companies set specific limits on the use of AI and, among those that do, data privacy and security is the main reason, cited by 52%, according to the InfoJobs digital transformation survey. Globally, 83% of organisations lack basic technical controls to prevent their data from ending up in AI tools, according to the Kiteworks 2025 Data Security Report. The gap between adopting AI and controlling it is wide, and the consequences are already being felt.
What happens when a company uses external AI?
When an employee uploads a contract to a cloud AI platform to have it summarised, enters customer data for a model to analyse, or uses an external assistant to draft internal communications, all of that information leaves the corporate network. It moves to a third party's servers, may be stored for an indefinite period, may be used to improve or train the provider's models, and is exposed to any security incident affecting that third party.
The use of unauthorised AI by employees (what the sector calls shadow AI) is today one of the most significant risk vectors. One in five organisations suffered a breach linked to this unsupervised use of AI, according to the IBM Cost of a Data Breach Report 2025. The most common vector for AI-related incidents is the supply chain (third-party applications, APIs and plugins), and in 60% of cases it led to a broad data compromise, according to the same report. This is not a hypothetical risk: it is the channel through which a large share of AI-related leaks are already happening.
As Gartner sums up in its strategic technology trends for 2026, moving workloads to environments with greater sovereignty allows organisations to regain control over data residency, regulatory compliance and governance.
The extra cost of losing control
The economic impact of handing data over to external tools without oversight has also been quantified. Organisations with a high level of unmanaged AI use recorded an average extra cost of 670,000 dollars per incident compared with those that kept control over which external platforms processed their data, according to the IBM report. A figure that does not include reputational damage or possible penalties for non-compliance with the GDPR.
On top of this, public trust in AI providers to protect personal data fell from 50% to 47% between 2023 and 2024, according to the Stanford AI Index 2025. The perception that these services do not offer sufficient guarantees is spreading among consumers and technology leaders alike.
Kiteworks puts it clearly in its 2025 report: organisations cannot track what data their employees have shared with third-party AI services, nor control how it is processed or stored, nor recover it once it has been sent.
What obligations does European regulation impose?
Regulatory pressure adds to business concerns. The European framework (the EU AI Act together with the GDPR) requires organisations to identify and control which external providers process their data and under what conditions. The exposure is not minor: Gartner forecasts that manual AI compliance processes will expose 75% of regulated organisations to fines exceeding 5% of their global turnover through 2027, according to its 2026 prediction.
In Spain, data privacy has become established as the main brake on the use of external AI among companies that set limits. The regulatory framework only reinforces what experience already teaches: delegating the processing of sensitive data to a third party requires guarantees that most cloud AI platforms are not in a position to offer.
The alternative: keeping the data in
The most direct answer to this problem is also the most obvious one: AI processing should take place within the organisation's own infrastructure, without the data ever leaving its network. This is the principle behind local AI, and it explains why its adoption is growing strongly among companies and institutions with strict privacy requirements.
When AI runs locally there is no transfer of data to third parties, no external storage, no risk of the provider using the information to train its models, and no dependence on the terms of use of someone else's platform. The organisation keeps full control over what data the model processes, who can access it and under what conditions it operates.
Gartner estimates that, by 2030, 75% of companies in Europe and the Middle East will have moved their workloads to solutions with greater digital sovereignty, compared with less than 5% in 2025, according to its analysis of digital sovereignty. The question every organisation must answer is not whether this shift is going to happen, but whether its data can afford to wait.
LurNova's response
The problem of external AI is not new to us. Before industry reports quantified it, it was already a constant concern in the organisations we work with: how to harness the full potential of artificial intelligence without exposing information that cannot leave their perimeter. Contracts, customer data, intellectual property, academic records, confidential assessments. Information that, in the wrong hands or simply on someone else's servers, represents a risk no responsible organisation can take on.
That is the reason LurNova AI Model Hub exists. A platform that brings AI into the organisation, not the other way round. The private AI models run on the organisation's own infrastructure. The data does not leave, is not logged in external systems and does not contribute to training anyone else's model. The organisation decides which models it uses, who has access and what gets recorded. No external dependencies and no handing over of control. If you would like to assess how to apply it to your case, you can get in touch with us.
CEO of LurNova, with extensive experience in technology and digital transformation. Involved in developing technology projects and applying artificial intelligence in organisations, he combines technical knowledge with business vision.
