Enterprise AI trust gap in regulated industries: what teams need to act on

TL;DR: 93% of AI leaders in regulated industries are concerned about exposing prompts, models or intellectual property to AI infrastructure providers, according to Fortanix, yet 61% still send sensitive data to public cloud AI services and only 50% can fully verify protection during processing. The governance gap is now proof, not awareness: organisations need verifiable control at inference time, not confidence by policy alone.

Editorial analysis by NHI Mgmt Group, based on content published by Fortanix: “The Enterprise AI Trust Fall: Why Regulated Companies Send Sensitive Data to Infrastructure They Don't Trust”.

By the numbers:

• 93% of AI leaders are concerned about exposing proprietary prompts, models or intellectual property to AI infrastructure providers.
• 61% of organisations send sensitive data to public cloud AI services anyway.
• Only 50% of AI leaders can fully verify that sensitive data stays protected while a model is processing it.

Key questions

Q: How should organisations govern access to data used by AI systems?

A: Treat AI data access as an identity governance problem, not just a data storage problem.

Q: Why is encryption not enough for AI systems processing sensitive data?

A: Encryption protects data at rest and in transit, but AI must decrypt and process data to generate outputs.

Q: What are the signs that AI security controls are failing in production?

A: Common warning signs include unapproved model behavior, unexpected data access, prompt leakage, suspicious outbound calls, and runtime actions that do not match the workload’s intended function.

Practitioner guidance

• Define inference-time trust as a gating control Require proof that the AI runtime is trustworthy before sensitive data, prompts or model weights are allowed into production inference paths.
• Bind key release to environment attestation Do not release decryption keys unless the workload, firmware and software stack all match the approved trusted state for that AI deployment.
• Limit sensitive inputs before model processing Classify and reduce customer data, financial data and proprietary prompts before they reach the AI service so the runtime sees less exposed information.

Bottom line: Regulated enterprise AI is creating a trust gap because organisations can use public cloud AI services without being able to prove that sensitive data remains protected during processing.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →