The efficiency, automation, and productivity benefits generated by artificial intelligence (AI) are undeniable. Yet, as AI tools are increasingly integrated with commonly used collaboration platforms, unrecognized complexities can be introduced, especially when foreign technology providers are involved.
AI adds complexity to existing IT security and compliance structures for 2 reasons. First, AI deployment drives data proliferation through new computational processes. Second, the cross-border distribution of these processes via cloud computing and technology integrations may expose data to the laws of foreign jurisdictions where it transits or resides. Risk emerges because AI tools ingest and transmit information across an interconnected digital ecosystem of vendors, jurisdictions, and other AI platforms, often without the oversight and security measures that exist in traditional IT environments. As a result, global enterprises face underappreciated data sovereignty risk and must reassess existing third-party risk management frameworks to properly account for cross-border data access obligations, evolving geopolitical environments, and national security concerns.
The June 2026 US executive order, Promoting Advanced Artificial Intelligence Innovation and Security, highlights how, “Advanced AI capabilities make our Nation stronger but also introduce new national security considerations.1 The inclusion of national security in the executive order indicates a need to get ahead of vulnerabilities created by AI integration or deployment that lacks oversight, as these gaps can potentially lead to surveillance persistence or intellectual property theft. Organizations must reevaluate the risk posed by connected vendors in order to address this growing systemic issue.
Where Does the Data Go?
Vendor cloud servers may process data across multiple jurisdictions. Processors and subprocessors used for storage or computing or within the AI supply chain are not always revealed. User inputs can be retained by various parties within the AI supply chain to assist with model training. AI computational processes may result in movement and storage to new locations.
The Data Sovereignty Challenge
Consider a hypothetical situation. An organization based in the United States decides to integrate a third-party AI tool into its existing workplace communication platform. Prior to entering into an agreement, the organization carefully reviews the vendor’s privacy and data protection policy, which clearly states that information will not be shared externally and will be hosted in the United States. The United States-based organization assumes its data will be stored domestically and does not fully assess the third-party AI’s supply chain, so it does not realize that the AI tool routes and stores data in servers located in the vendor’s host country, a separate jurisdiction operating under its own data governance rules.
The host country where the vendor of the AI tool sits may have its own national security framework in place that contains mandatory security access requirements. In turn, the data to which the third-party AI vendor has access is subject to the laws of the vendor’s home country, which could require the vendor to grant its government access to the United States-based organization’s data that is now stored and located in that vendor’s home country. This illustrates a concept referred to as data sovereignty.
In this example, is the United States-based organization at fault for unknowingly exposing sensitive information to a potential foreign adversary? What is to stop the nation-state from using the data access to fraudulently enhance its own espionage, cybersecurity tooling, or AI capabilities through profile building or intellectual property theft? Regardless of who is ultimately liable if data is exposed, the potential national security, regulatory, and data privacy risk is significant and could be overlooked by organizations focused solely on the benefits of AI implementation.
Navigating the gap between vendor policies and legal obligations under foreign jurisdictions is complex (e.g., what the vendor says they will do regarding data protection versus what their government legally requires them to do) and introduces unrealized risk. An organization may believe it is doing the right thing by negotiating a strong contract with a vendor, only for it to be overridden by domestic government obligations.
Traditional vendor due diligence focuses on whether an organization has employed data protection policies and clauses and possesses any security certifications. While these are important elements to consider ahead of procurement, failing to assess downstream data flows and legal obligations the vendor faces in their home jurisdiction introduces significant risk in the event of unauthorized access to information and networks. In the era of AI, vendor due diligence must expand to include data transfer risk and impact assessments across the AI supply chain, even where current data privacy laws do not require them.
The Cross-Border Operational Landscape
Without standardized global requirements, rules governing AI tools and the data they touch vary by jurisdiction. Differing rules lead to differing risk levels, and AI tools that operate securely in one location may create exposure in another. This complexity leads to challenges in maintaining adequate security controls and compliance across borders and emphasizes the importance of addressing systemic risk. When vendors are legally obligated to follow the laws of the country in which their data is stored or processed, those obligations can grant foreign governments, and vendors themselves, operational and political leverage over the data. Foreign governments could potentially use private data access to directly or indirectly influence business decisions and operations.
US Executive Order 14409 states that “It is the policy of the United States to promote AI innovation.” This is exactly what is at risk in today’s fragmented landscape.2 Enterprises that seek to adopt innovation and grant access to AI tools without governance may unintentionally expose confidential business information, intellectual property, or trade secrets. Once in the hands of a nation-state, breakthroughs or advancements can be leveraged to potentially create commoditization issues by taking an innovative methodology or technology and making it widely available. Or, more concerningly, enhancing the military or surveillance capabilities of a foreign nation.
In a similar context, unintended government access can also create opportunities for observation of employee communications and business activities, especially if third-party AI integration involves digital workspaces used across an organization. Beyond exfiltrating data, nation-states could use this access to covertly monitor an organization’s communications, actions, and decisions in real time. As is often the case with threat actors, once access is gained, the goal is to maintain persistence within networks. So, it is possible that this surveillance could remain undetected, generating perpetual risk.
Considerations Moving Forward
It is widely accepted that the efficiencies gained from AI are genuine, as is the risk, but the extent of the threat is not fully realized when it comes to AI technology providers located in foreign jurisdictions. Navigating these threats requires organizations, especially those with a global presence, to balance innovation and stakeholder demands for AI with risk management that is informed by enhanced assessments and intelligence.
Addressing data sovereignty risk requires more than awareness; it requires a structured, repeatable process embedded into how organizations evaluate and onboard third-party AI tools. Preacquisition due diligence must go beyond reviewing vendor privacy policies and security certifications to reveal an accurate picture of data flows and applicable data privacy laws. This process should include conducting comprehensive reviews of enterprise tool integrations, particularly when the technology provider is operating in a sensitive region or has no restrictions on subcontracting downstream with parties located in sensitive regions. Vendors should be asked directly:
- Have they or their subprocessors ever received a government request for user data?
- What is their legal obligation to comply?
- Can data residency be contractually guaranteed, and is it enforceable under local law?
- What notification, if any, will the organization receive if government access is compelled?
Standard due diligence questionnaires will not surface answers to these questions, so they must be actively sought.
Implementing an Effective Approach
To operationalize a robust approach, organizations should build a cross-functional review process that brings together legal, compliance, procurement, privacy, and security teams before any AI tool integration decision is finalized. This is not a task that can be delegated to a single function. Data sovereignty risk sits at the intersection of legal obligation, technical architecture, and strategic exposure. In-house and outside counsel must assess whether the vendor's home jurisdiction imposes mandatory government access obligations, such as Russia's System for Operative Investigative Activities (“SORM”)3 or analogous frameworks in other sensitive regions, that could grant foreign governments access to organizational data. This is the core of data sovereignty. A vendor's public-facing privacy policy is not a shield against its government's mandatory access requirements. An organization may believe it has negotiated adequate security protections, only for those protections to be rendered meaningless by the laws of the vendor's home jurisdiction.
Separately, counsel must also evaluate how privacy compliance obligations interact with the organization's own regulatory environment, including when technology is acquired from countries that lack robust privacy laws. Critically, organizations must recognize that standard contractual protections and vendor certifications do not override sovereign legal obligations.
For organizations handling controlled information or the data of United States residents, additional compliance obligations regarding data access and location may be in scope when integrating an AI tool. Export controls frameworks, such as the US International Traffic in Arms Regulation (ITAR),4 carry stringent requirements regarding access to technical data and where it is stored. Where the Health Insurance Portability and Accountability Act (HIPAA) applies, organizations must sign business associate agreements with all foreign vendors and may also need to perform risk assessments to meet the HIPAA Privacy and Security Rule requirements.5 Similarly, the US Department of Justice (DOJ) data security rules restrict the transfer of sensitive data on United States residents or government personnel for a list of 6 countries of concern.6 Whether inadvertent or not, controlled information passing through a foreign-hosted AI tool can result in a violation of these regulations. Figure 1 depicts the 5 measures to implementing an effective data sovereignty approach.
Figure 1—Implementing an Effective Data Sovereignty Approach
Conclusion
As organizations increasingly integrate AI and other technology providers into their systems, across borders, the importance of data sovereignty has also increased. When data is transferred between jurisdictions via technology providers, it may still become subject to data laws, and organizations may encounter unexpected risk or exposures as a result. Traditional third-party risk management frameworks are not designed to identify and address data sovereignty risk; therefore, organizations must reassess their frameworks to account for cross-border data movement and obligations.
Before integrating AI tools, global organizations should adopt due diligence processes that account for data flows and jurisdictional obligations and provide actionable information to guide the decision-making process. Due diligence needs to extend beyond first-tier suppliers and encompass the entire AI computational process and supply chain. Organizations should determine what tools and technologies their vendors and any associated vendors are using because an AI tool from a foreign provider carries the same data sovereignty risk regardless of where in the supply chain it is embedded. What is permissible today may represent unacceptable exposure tomorrow. The integration of AI into enterprise operations is not slowing down and neither is the scrutiny foreign governments apply to the data those tools manage and generate.
Endnotes
1 The White House, “Promoting Advanced Artificial Intelligence Innovation and Security,” USA, 2 June 2026
2 The White House, “Promoting Advanced Artificial Intelligence”
3 James Andrew Lewis, “Reference Note on Russian Communications Surveillance,” Center for Strategic and International Studies, 18 April 2014
4 US Department of State Directorate of Defense Trade Controls, “The International Traffic in Arms Regulation (ITAR),” USA
5 US Department of Health and Human Services, “Summary of the HIPAA Privacy Rule,” USA
6 US Department of Justice, “Data Security,” USA
Mike Driscoll is a Senior Managing Director at FTI Consulting with nearly 30 years of leadership and investigative experience in cybersecurity, intelligence, complex financial crime and national security. He leads FTI Consulting’s National Security offering and works closely with clients to provide comprehensive solutions that protect their interests and national interests. Prior to joining FTI Consulting, Driscoll served as the Assistant Director in Charge of the Federal Bureau of Investigation’s (“FBI”) New York office, where he directed more than 2,400 employees and task force personnel from 60 different agencies.
Jenn Christian has more than 15 years of experience in national security, geopolitical risk management, complex investigations and threat assessment across the public and private sectors. Christian has specialized training in collecting and evaluating disparate streams of all-source intelligence to support complex international investigations. She has advised C-Suite executives, board members and business leaders on how to navigate geopolitical developments to reduce risk and maximize opportunities. Prior to joining FTI Consulting, Christian was a Senior Intelligence Manager at bp, where she evaluated geopolitical risks and performed investigations associated with project development and asset management in the oil, gas and renewable energies space.
Stephanie Dorsey is a Managing Director in FTI Consulting’s Risk & Investigations practice and is based in Washington, D.C. Dorsey specializes in intelligence collection and analysis, security program management and risk mitigation strategy and advisory, with experience spanning the national security, defense and intelligence sectors. A former Intelligence Community executive, she advises clients in strategic decision-making by providing intelligence and analysis that allows them to critically assess and mitigate legal, financial, regulatory and reputational risks. Before joining FTI Consulting, Dorsey built a distinguished 28-year career in federal service, where she shaped policies and operational frameworks addressing counterproliferation, insider threats and crisis management.
Breck Heidlberg is a Managing Director in FTI Consulting’s International Trade practice. He has nearly 20 years of experience advising global corporate clients and senior government policymakers on complex matters related to sanctions, export controls, financial crime compliance, public policy, intelligence and national security. Heidlberg has deep experience leading high-risk global projects, conducting cross-border investigations, and managing cross-functional teams across the Americas, Europe, Asia, the Middle East and Africa.
Dera Nevin, Managing Director at FTI Technology, is a data lawyer and expert with more than 20 years of experience addressing digital risk issues, including privacy, data protection, information risk management, e-discovery, advertising technology and the application of emerging technologies to the delivery of legal services and compliance programs. Supporting clients in the U.S. and Canada, Nevin specializes in applying artificial intelligence, automation and synthetic data strategies to complex client challenges. She is also an experienced client advisor in the field of AI governance and the risk and opportunities at the intersection of AI and data privacy.