Sooner or later, every organisation that uses AI gets asked the same question: where does our data go? It might come from a client, a partner, an insurer or a regulator. It might come from your own board. Whoever asks, the organisations that can answer clearly are the ones that move fastest, because nothing is holding them back.

That is the good news. Data sovereignty, meaning you decide where your information lives, who can reach it and what happens to it, is not a burden to carry. It is a position of strength, and it is available to organisations of any size. This post explains how to get there.

Why the question is arriving now

AI has moved quickly from something people read about to something people use before lunch. In most organisations, someone is already pasting a draft, a spreadsheet or a client email into a tool to get a quicker result. That is understandable, and it is usually well meant.

What tends to be missing is the shared picture. Which tools are in use? What goes into them? Where does that information end up, and who can see it there? Without clear answers, you have the benefits of AI without the control.

Clients, partners and insurers are also starting to ask these questions in writing. A clear answer shortens procurement conversations, builds trust early and lets your team adopt AI with confidence instead of caution.

For 23 years I worked as a technical lead inside large companies and government departments, where those questions are asked before a tool is adopted, not after. Smaller organisations can borrow that discipline without the bureaucracy. The aim is simple: when someone asks where your data goes, you can answer in a sentence and back it up with documented evidence.

Four levels of control

Every AI setup sits somewhere on a scale. These are the four levels I use when I talk to organisations about it.

Level 1: standard cloud AI

Mainstream providers on a normal business account. Setup takes minutes, which is its great strength. Control is low and trust is high: your data is handled under the provider’s terms, and you rely on their policies and settings. It suits general tasks with nothing sensitive in them, such as brainstorming, public-facing copy and research on public topics.

Level 2: hosted private models

Open models run by a hosting service that does not log your prompts, such as Ollama cloud. Setup is easy and the privacy is a real step up. But your data still passes through someone else’s infrastructure, so you are still trusting their word and their practices, and provider terms change, so check them before relying on them. It suits everyday work that touches internal information.

Level 3: self-hosted on a cloud VPS

A private AI model running on a virtual server that you control. You choose the software, who has access and which country the server sits in. The hardware belongs to a hosting company, but the AI environment is yours, so the trust you need drops to low or medium. It suits organisations that need to say clearly where their data lives and who can reach it.

Level 4: on-site computer

A private model running on a physical computer in your own premises. Data never leaves your building or your corporate network, as you own the machine and the environment, so the trust required is minimal. It takes the most setup and gives the most control. It suits your most confidential material, or any situation where “it never left the premises” is the answer you need to give.

Choosing the right level

There is no single right level. It depends on what goes in and who is entitled to see it. A useful way to think about it is to match each type of work to a level, rather than picking one for the whole organisation.

One point often surprises people. A private setup at Level 3 or 4 is not only for sensitive work. The same model can handle your public-facing tasks too, such as marketing copy, website content and research. You do not need standard accounts at Level 1 or 2 alongside it. That means one environment to manage, one set of rules for your team to learn and one answer to give about where your data goes.

Levels 1 and 2 remain sensible starting points, particularly for low-risk work. The point is to choose them deliberately, not by default.

It is also worth knowing that you can move between levels. Many organisations begin at Level 2 to learn what their team actually uses AI for, then move to Level 3 or 4 once the patterns are clear. Nothing you learn along the way is wasted, and each step gives you more control than the last.

A practical first step

You do not need to start with technology. Start with a short list of questions:

• Which AI tools does your team use today, officially or otherwise?
• What kinds of information go into them?
• Who is entitled to see that information?
• Which level of control would you be comfortable explaining to a client?

Answering those four questions puts you ahead of most organisations. To make it easier, I have put them into a short AI Readiness Checklist that shows where you stand across the four levels.

Let’s talk it through

The aim is never to slow your team down. It is to give them tools they can use freely, because the boundaries are clear and the answers are already in place. When you know where your data goes, AI becomes something you can plan around and grow with.

If you would like to talk it through, I would be glad to meet for half an hour over coffee and map your organisation to the four levels. I am a one-person consultancy based in Coventry, so you deal with me directly, from the first conversation to the final training session.