We have spent a decade hardening the perimeter that no longer exists, then rebuilding it around identity. Conditional access, phishing-resistant MFA, device compliance, EDR on every endpoint, DLP rules that fire on national insurance numbers and bank details. And then a developer pastes a stored procedure containing customer email addresses into ChatGPT to ask why it runs slowly. The user authenticated successfully. The device is compliant. Every control fired correctly, and the data still left the building.
The Control Surface Has Moved
For twenty years, security architecture assumed data moves between known systems over known channels: file shares, email, SaaS APIs, sanctioned cloud tenancies. The DLP industry was built on that assumption: match a pattern, classify a document, block the transfer, alert the SOC. Generative AI breaks the model in three ways at once. The transfer surface is now a text box on a public web page; the data is reformatted, summarised and abstracted before it leaves, defeating signature-based DLP; and the destination is a model whose training, retention and access policies you do not control and cannot meaningfully audit.
The boundary that matters is no longer the firewall, the proxy or the identity provider. It is the prompt box and the upload button. Most organisations have no telemetry there at all.
What "Lost to the Organisation" Actually Means
Once a prompt is submitted to a consumer-tier AI service, the content is transmitted to the provider's infrastructure, almost always outside the UK and EU. Under the US CLOUD Act, US-headquartered providers can be compelled to disclose data held anywhere in the world. The content may be retained for service improvement, abuse monitoring, or model training, depending on the tier and the small print of the day, and the default for a personal account is the worst-case default. Even where training is disabled, the content sits in someone else's logging infrastructure for a retention period you did not negotiate. And the original document, the one your DLP rule was watching, never moved. Only its contents did, transformed into a prompt.
Why the Existing Controls Do Not Catch This
Identity controls answer "should this person be using this application?" They do not answer "what is this person doing inside the application?" Endpoint DLP can in theory watch the clipboard and browser, but the rule sets are tuned for card numbers, not for "the first three paragraphs of a confidential strategy paper, paraphrased". Network inspection is largely defeated by TLS and by the legitimacy of the destinations; block one AI service and the user moves to their phone. Application-layer controls inside sanctioned tools are genuinely useful, but they only apply to the tools you have sanctioned.
The Shadow AI Problem Is the Real Problem
Sanctioned, licensed, enterprise-tier deployments are tractable: you can configure, audit, train against, and contractually bind them. The harder question is the long tail of free-tier and consumer-tier use, what the industry now calls shadow AI. A majority of knowledge workers use AI tools at work, and a substantial minority use tools their employer has neither sanctioned nor heard of. Treating this as a simple "block and educate" problem misreads it: the productivity gains are real, the staff know it, and an outright ban produces only better-hidden usage.
What Actually Helps
- A written AI use policy that names permitted and prohibited platforms, defines what data may go into each tier, and is written so a non-technical reader actually understands it. The risk register should be platform-specific.
- Sanctioned, licensed, enterprise-tier provision of the tools staff actually want, with training opt-out and appropriate retention, made genuinely easy to access. If the sanctioned tool is harder to reach than the unsanctioned one, you have already lost. Pair it with a three or four tier data classification scheme staff can apply without a degree in information governance.
- Monitoring at the browser layer where the prompt actually leaves. This is the newest and least mature control, but browser-isolation and browser-DLP products are becoming the closest thing to telemetry on the new control surface.
The Sovereignty Question Underneath
Even with perfect policy, training, tooling and user behaviour, the dominant AI providers are headquartered in jurisdictions whose legal frameworks, principally the US CLOUD Act and FISA Section 702, grant their governments lawful access to data on those providers' infrastructure regardless of where the servers sit. For European organisations handling European data, that is not a configuration issue; it is a structural one. The mitigations exist, locally hosted open-weights models for sensitive workloads, European-headquartered providers for general use, careful segmentation, but all require a deliberate choice about where, geographically and legally, your data is allowed to go.
The Point of Access Control, Restated
Access control, MFA and application security are still worth doing; they prevent a category of attack that has not gone away. What they were never designed to do is govern what an authenticated, authorised, well-meaning user does with the data once they have legitimate hands on it. The new control problem is not "who got in" but "what left, in what form, to where, under whose jurisdiction". The organisations that take that question seriously now will spend the next five years building useful capability. The ones that do not will spend it explaining why their carefully audited identity perimeter was guarding an empty room.
