{"id":168361,"date":"2026-04-27T10:47:40","date_gmt":"2026-04-27T09:47:40","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=168361"},"modified":"2026-04-27T10:47:41","modified_gmt":"2026-04-27T09:47:41","slug":"majority-of-large-uk-firms-cannot-account-for-how-ai-uses-their-data-overseas-leaving-boards-exposed","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2026\/04\/27\/majority-of-large-uk-firms-cannot-account-for-how-ai-uses-their-data-overseas-leaving-boards-exposed\/","title":{"rendered":"Majority of large UK firms cannot account for how AI uses their data overseas \u2013 leaving boards exposed"},"content":{"rendered":"\n

New research reveals widespread governance gaps as UK enterprises struggle to track how AI systems use sensitive data across borders, exposing boards to compliance and geopolitical risks.<\/em><\/p>\n\n\n\n

New research from Harbr Data, based on a survey of large UK organisations, shows that the majority cannot fully explain how sensitive data is used once it is processed by AI systems overseas \u2013 even as boards remain legally responsible for the outcomes.<\/p>\n\n\n\n

The survey included senior IT and data leaders – CIOs, CTOs, CDOs, Heads of Data and IT Directors – at organisations with revenue of around \u00a3100m or more. The findings highlight a widening governance gap as AI adoption increases both the frequency and complexity of cross-border data access and processing.<\/p>\n\n\n\n

Cross-border data movement is not an exception. Nearly three-quarters of respondents say their data is processed by AI systems outside the UK at least weekly and one third report this happens daily. As these flows scale, oversight depends not only on technical safeguards but on whether organisations have a clear and consistent operating model for how external data access is governed.<\/p>\n\n\n\n

Governance challenges<\/strong><\/p>\n\n\n\n

Nearly half (47%) of respondents say their organisations do not have enough qualified staff to manage cross-border AI while 28% point to unclear ownership with responsibility spread across multiple teams. More than 40% are unsure whether their systems fully comply with international regulations and 38% cite difficulties auditing AI-driven decisions that rely on data from multiple regions.<\/p>\n\n\n\n

As analysts predict that a growing number of organisations may adopt region-specific AI platforms by 2027 in response to regulatory and geopolitical pressures, these findings suggest many large UK enterprises are unprepared to manage increasingly complex cross-border data flows without a defined operating model for external data access.<\/p>\n\n\n\n

Consequences of limited visibility<\/strong><\/p>\n\n\n\n

These governance challenges carry tangible risks. Half (50%) of respondents warn that limited visibility could lead to breaches of international compliance rules. Over a third cite potential fines or regulatory investigations (36%) and strategic or geopolitical exposure (35%). Commercial or contractual disputes are cited by 31% of organisations.<\/p>\n\n\n\n

Confidence in managing AI-driven data drops sharply outside the UK and EU. While 70% of respondents feel confident within the UK and 62% within the EU\/EEA, confidence falls to 31% in North America and just 12% in Asia-Pacific.<\/p>\n\n\n\n

Misaligned accountability and external pressures<\/strong><\/p>\n\n\n\n

Responsibility for cross-border AI governance is most often seen as resting with CIOs or CTOs rather than boards, despite boards retaining legal and fiduciary responsibility if AI-driven decisions are challenged.<\/p>\n\n\n\n

The research also highlights the impact of external constraints on enterprise data strategy. Data localisation laws have influenced AI architecture decisions for 91% of organisations while 87% report that geopolitical factors are shaping how and where data is processed.<\/p>\n\n\n\n

Anthony Cosgrove MBE, founder of Harbr Data, said: “AI systems are global by design, but accountability remains national. Cross-border AI processing is fundamentally an issue of how to govern data sharing. Organisations need a robust operating model for how sensitive data is accessed and used across systems, legal entities and national borders. Without that, boards risk being caught off guard by compliance breaches, fines or international disputes.”<\/p>\n","protected":false},"excerpt":{"rendered":"

New research reveals widespread governance gaps as UK enterprises struggle to track how AI systems use sensitive data across borders, exposing boards to compliance and geopolitical risks. New research from Harbr Data, based on a survey of large UK organisations, shows that the majority cannot fully explain how sensitive data is used once it is […]<\/p>\n","protected":false},"author":58,"featured_media":168362,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[21064,18793,93],"tags":[22565,24215,6284,25181,7242,22743,2109,76,25180,22677],"class_list":["post-168361","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai","category-europe","category-top-stories","tag-ai-governance","tag-ai-risk","tag-cio","tag-cross-border-data","tag-cto","tag-data-compliance","tag-data-security","tag-digital-transformation","tag-harbr-data","tag-uk-enterprises"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/168361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/58"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=168361"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/168361\/revisions"}],"predecessor-version":[{"id":168363,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/168361\/revisions\/168363"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/168362"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=168361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=168361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=168361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}