Tom discusses critical data sovereignty considerations when using AI platforms like Microsoft Foundry, especially for regulated industries. Learn about the risks of deploying LLMs with sensitive data and how to ensure compliance with geographic and contractual data agreements.

Data Sovereignty in AI: Microsoft Foundry and Regulated Industries

Key Topics Covered

Data Sovereignty Fundamentals

What data sovereignty means in the context of AI and cloud platforms
Geographic and vendor-specific data restrictions
Contractual obligations around data processing

Microsoft Foundry Considerations

Overview of Microsoft Foundry's LLM deployment capabilities
Understanding the Foundry marketplace for models
Critical distinction: Azure-hosted vs. third-party hosted models
How data flows through different model providers

Organizational Risk Factors

The gap between infrastructure teams and compliance requirements
Why systems administrators may not be aware of data sovereignty agreements
PII (Personally Identifiable Information) handling concerns
Intellectual property risks

Best Practices

Verify data sovereignty requirements before model deployment
Review contractual agreements for data usage restrictions
Ensure communication between technical and compliance teams
Understand where your data is being processed

Main Takeaways

Not all models in Microsoft Foundry are created equal - Some are Azure-hosted, others are third-party, affecting where your data goes
Team alignment is critical - Infrastructure engineers need visibility into data sovereignty requirements
Regulated industries must exercise extra caution - Healthcare, finance, and other regulated sectors face additional compliance risks
Check before you deploy - Always verify data agreements before spinning up new AI models

Resources Mentioned

Microsoft Foundry
Azure cloud environment

Who Should Listen

Data engineers and infrastructure teams
Compliance officers and legal teams
IT decision-makers in regulated industries
Anyone working with sensitive or regulated data
AI project managers and technical leaders

Chapters

0:02 - Introduction to Data Sovereignty in AI
0:31 - Working with Regulated Industries
0:53 - Microsoft Foundry Marketplace Insights
1:24 - The Infrastructure and Compliance Gap
1:51 - Third-Party Model Hosting Risks
2:34 - Practical Recommendations and Conclusion

What is The AI Briefing?

The AI Briefing is your 5-minute daily intelligence report on AI in the workplace. Designed for busy corporate leaders, we distill the latest news, emerging agentic tools, and strategic insights into a quick, actionable briefing. No fluff, no jargon overload—just the AI knowledge you need to lead confidently in an automated world.

Hi folks, welcome to another AI briefing.

My name is Tom.

It's good to see you all once again.

Today we're going to take a quick discussion

about data sovereignty and in

the world of AI and just general sort

of big data processing or data

cloud -based data processing platforms, what you do

with data sovereignty.

I work a lot in the regulated industry

space and so I have to deal with

an awful lot of regulated data on

a regular basis,

not a regulated basis.

And so you have to be wary about

where you're going to send this stuff.

I just wanted to raise a point I

actually had with a chat with someone earlier

today where we were discussing Microsoft Foundry.

Now, for anyone who doesn't know, Microsoft Foundry

allows you to deploy LLMs into an Azure

environment that allows you to then process your data.

So you think when I was prodding

around in Foundry a while ago, the thing

that I noticed, so Foundry also has a

marketplace for different models.

So companies can sell access to specific models

into that marketplace.

Now, it may be that you have an

infrastructure engineer systems administrator doing the

model deployment for you, and they're not necessarily

aware of the data sovereignty agreements that you

have with whatever project you're working on.

So for example, you may only be allowed

to deploy certain data

into a geographic region or into a certain

cloud vendor in a geographic region, which is

so not quite a regular occurrence.

And so be aware that when you do

stuff like spin up additional models, that data

isn't necessarily staying entirely within Azure.

Some of those models are hosted by Azure,

some of those models, I believe are hosted

by third party providers.

And of course, eventually your data makes your

way to them, gets processed and model and come back.

But the majority of users and use cases

is probably of minor concern.

Unless of course, you're worried about IP risk

and that type of thing as well.

But like obviously, from a regulated industry's

perspective, it's definitely something to be aware of

and something that you should be a little

cautious of when spinning up different LLMs inside

of projects like Foundry, where you're going to

send potentially sensitive PII type regulated data.

That's what I wanted to say.

Hopefully, that is of use.

Just something to be aware of when you're

spinning these things up.

Just bear in mind if you have any

agreements in your contract with whoever's data you are using,

make sure you've heard some.

I hope that's been useful.

I will speak to you all tomorrow.

Have a good rest of the day.