The Snowden disclosures made data location a board-level question in 2013. AI adds new layers to it. Here are three questions to put to any AI vendor before you sign.
In June 2013, the Snowden disclosures turned a technical detail into a board-level question. Two months later, ITIF estimated that US cloud providers could lose $21.5 billion to $35 billion in foreign business over three years as overseas customers reconsidered where their data lived.
Firms that had already asked where their data lived had their answers ready. The rest started from scratch.
AI asks the same question with more parts. A cloud contract had to say where your files sat. An AI contract also has to say where the model runs, who built it, and what happens to the prompts and documents you feed it. Governments have raised the stakes on each of those details. The US restricts exports of advanced chips, several countries are funding national AI programs, and the EU AI Act’s transparency rules began to apply in August 2026.
For an SME, the practical step is to put these questions into procurement, next to price and security. Before you sign any AI contract, get written answers to three questions:
- Where does the model run? Ask for the hosting provider and region, including any subprocessors.
- Where is our data stored? Prompts, uploaded files and outputs all count.
- How long is it kept? Ask about retention periods, deletion on request, and whether your data trains the vendor’s models.
A vendor that can’t answer all three in writing isn’t ready for your data.
The Second Migration covers the rest of a sound AI buying stance: matching the model to the task, keeping switching costs low, and using open models as a price benchmark.
Read the full paper:
The Second Migration – What the Cloud Years Teach SME Leaders about AI
