When you paste a contract into an AI, who else can read it?

A lawyer reviewing a draft acquisition agreement wants to check its wording against German and EU law before it is signed. She pastes the full text into an AI assistant and asks whether any clause conflicts with the relevant statutes. The answer returns in seconds, and it is useful. In that same moment, the entire unsigned agreement has left the building and now sits with the assistant’s provider, which may be a company on the other side of the Atlantic.

The prompt is the disclosure

There is a habit of thinking about AI risk in terms of the answer: whether it is accurate, whether it is biased, whether it can be trusted. The more immediate risk is on the way in. Every evaluation an institution runs transmits the material it is evaluating. Ask a foreign model whether an unsigned contract complies with member-state law, and you have disclosed the contract. Ask it to assess the exposure created by a live regulatory incident, and you have disclosed the incident, along with your own reading of how serious it is, to whoever operates the model.

For most everyday queries this is immaterial. For the work that compliance and legal teams actually do, it is not, because that work concentrates precisely the material an institution is obliged to protect: unsigned deals, privileged assessments, incident records, and the internal view of its own liabilities.

What foreign jurisdiction means in practice

The reason this weighs more heavily with a US-controlled provider than with a European one is law.

Definition

The CLOUD Act, and the gag order

The US Clarifying Lawful Overseas Use of Data Act allows American authorities to compel a US-based provider to hand over data it holds, regardless of where in the world that data is stored. A non-disclosure order can be attached to the demand, legally barring the provider from telling the affected customer. In Microsoft’s own account of its litigation, most such orders arrived with no expiry date, which means the customer may never learn that the data was produced.

This exposure is documented, and it is worth being precise about the evidence. On 10 June 2025, asked before the French Senate’s commission of inquiry whether he could guarantee that French citizens’ data would never be handed to the US government without French consent, Microsoft France’s director of public and legal affairs answered: “No, I cannot guarantee it, this has never yet happened.” A data centre in Europe does not change the jurisdiction of the company that operates it.

The reach of US jurisdiction over US companies is not hypothetical either. In May 2026, according to reporting by the Dutch magazine Vrij Nederland, a US Congressional committee investigating alleged “censorship” of American platforms obtained internal records from Microsoft, and the documents named civil servants at two Dutch regulators, the competition authority (ACM) and the data-protection authority (AP), who work on implementing the EU’s Digital Services Act, with their names unredacted. The material reportedly came from Microsoft’s own corporate systems rather than data it hosts for those bodies, and the disclosure ran through US Congressional process rather than any European one, with the Dutch government learning of it only afterwards. Microsoft was not the only US firm named in the reporting. Where a non-disclosure order applies, even that much awareness is not guaranteed.

The rule this points to

None of this is an argument against using AI for compliance work, which is quickly becoming indispensable. It is an argument for a boundary. Evaluations that expose an institution’s regulated material, an unsigned contract, an incident assessment, a candid view of its own exposure, should run under European data-protection law and, wherever possible, on models operated within European jurisdiction, the direction European policy is already moving. Better still, they should run on an architecture in which the sensitive material never leaves the institution’s control at all, so that there is nothing for a foreign authority to compel. That protection does not depend on the maturing of European models. It holds whatever the model is, because the material a foreign authority might reach was never sent to it.

The question to ask before entering anything into an AI system is who else is entitled to read what you are about to show it, and whether you would ever be told if they did.