Sovereignty

The Hidden Cost of AI Hesitation

September 28, 2026 · 8 min read · Pierre-Yves Dehon

A senior associate in a mid-sized legal firm spends six hours on a Friday afternoon reviewing a set of discovery documents. The task is precise: identify every instance where a specific liability clause was modified across forty different versions of a contract. It is tedious, manual work that consumes a significant portion of the billable day.

The associate knows that a large language model could perform this extraction in seconds. However, the firm’s policy is absolute: no client data is to be uploaded to public AI tools. The data is sensitive, the regulatory environment is strict, and the risk of a leak is unacceptable.

This is the wall where most EU professional services firms currently stand. On one side is a productivity gain that feels like a leap in species; on the other is a legal and compliance barrier that feels impassable. For the CEO or COO, the safest move appears to be hesitation. If the technology is volatile and the risks are high, the logical choice is to wait for a standardised, "enterprise-ready" solution.

This hesitation is based on a false premise. It assumes that by not deploying an official AI strategy, the firm is avoiding risk. In reality, the gap between the demand for efficiency and the restriction of corporate policy is not a void. It is a space that employees fill themselves.

The Reality of Shadow AI

When a professional is faced with a mounting workload and a looming deadline, they do not prioritise the firm's data sovereignty over their own performance review. They use the tools available to them.

This is "Shadow AI"—the use of AI tools within an organisation without explicit corporate approval or oversight. This is not a theoretical risk or a fringe behaviour. The data is clear: 60% of employees will use shadow AI to meet deadlines. This is not an act of rebellion; it is a pragmatic response to an operational bottleneck.

The danger is not the use of the tool, but the loss of control over the data. When an employee uses a public AI tool to summarise a client transcript or analyse a contract, that data leaves the firm's infrastructure. It is processed on servers owned by third parties, often outside the EU, and may be used to train future iterations of the model.

The scale of this leakage is significant: 38% of employees have shared sensitive company data with AI tools without permission. For a firm in healthcare, finance, or legal services, this is not a minor policy breach. It is a catastrophic compliance failure. The "safe" path of waiting for the technology to mature has created a scenario where the firm's most sensitive assets are being leaked into the public cloud daily.

The Compliance Paradox

The irony of this hesitation is that the more regulated a firm is, the more urgent the need for private AI infrastructure becomes.

In the financial sector, the regulatory environment is not just strict; it is becoming more prescriptive. The Digital Operational Resilience Act (DORA) establishes a framework for digital operational resilience for all EU financial entities. Crucially, this includes the oversight of critical ICT third-party providers.

If a firm relies on a public AI provider, it introduces a third-party dependency that is nearly impossible to audit to the standards required by DORA. The resilience of the firm becomes tied to the uptime, the terms of service, and the policy whims of a handful of companies in Silicon Valley.

This creates a paradox: to remain compliant with EU law and resilience frameworks, the firm cannot use public AI. However, to remain competitive and prevent employees from using public AI in secret, the firm must provide an AI alternative.

The only way to resolve this is to move the AI to the data, rather than the data to the AI. This means deploying models on the firm's own servers or within a private, sovereign cloud environment where the data never leaves the perimeter.

The Efficiency Gap: 6 Hours vs 60 Seconds

To understand why employees are risking their careers and the firm's security to use these tools, one must look at the concrete difference in workload.

Take the "first-pass" document review mentioned earlier. A compliance officer in a bank may spend six hours reviewing 50 documents to extract specific anomalies. This is a linear, human process prone to fatigue. After the fourth hour, the error rate increases.

A properly configured AI system, running locally on the firm's infrastructure, can perform the same extraction in 60 seconds. It does not "read" in the human sense, but it can query the data with a precision that removes fatigue-related errors.

The shift is not from 6 hours to 4 hours. It is from 6 hours to 60 seconds. When the productivity gain is this extreme, the lack of an internal tool is not a "conservative" business choice; it is a decision to operate with a massive operational overhead that competitors are already stripping away.

Why Closing the Gap is Harder Than it Looks

If the risk of Shadow AI is clear and the solution is local AI, why is the transition not happening overnight?

The difficulty lies in a common misconception: the belief that AI is a software package you buy, install, and activate. It is not. AI is a pipeline. Most firms believe they can simply "plug in" a model and start querying their data. This is where the majority of AI projects fail.

The primary obstacle is not the model, but the state of the data. For an AI to be useful, the data must be in a state worth querying. Most professional services firms of 10-250 people do not have a pristine data lake. They have "data silos"—fragments of information scattered across legacy file servers, old email archives, and PDFs that were scanned ten years ago with poor OCR (Optical Character Recognition).

If you point an AI model at a folder of poorly scanned PDFs and fragmented Word documents, the model will either "hallucinate" (invent plausible-sounding but false facts) or fail to find the relevant information. This is the "garbage in, garbage out" problem.

Closing the gap requires three distinct engineering stages, each of which presents a specific friction point for a mid-sized firm.

1. Data Sanitisation
This is the process of cleaning and standardising disparate sources. For a firm with 200 employees, this often means dealing with inconsistent naming conventions across different departments or converting legacy formats into something a machine can actually parse. If a document is a "flat" image of a page rather than searchable text, the AI is blind to it. The effort is not just technical, but an audit of how the firm has historically stored its knowledge.

2. Indexing (Vector Embeddings)
An AI does not search for keywords like a basic search bar. It uses "embeddings"—mathematical representations of meaning. This requires creating a vector database where every paragraph of the firm's knowledge is mapped by its conceptual relationship to other paragraphs. Building this index for thousands of documents without losing the context of the original file is a precise technical task. For a firm with 250 people, the volume of legacy documents is often high enough to make manual curation impossible, yet too small to justify the cost of a full-scale data engineering team.

3. Orchestration
This is the system that sits between the user and the model. The orchestrator must translate a user's natural language question into a mathematical query, retrieve the exact relevant snippets from the vector index, and feed those snippets into the local model. It must then instruct the model to answer only using the provided snippets to prevent hallucination. This requires a layer of middleware that must be maintained and tuned to the specific jargon of the firm's industry.

This is not "plug-and-play." It is an engineering effort to ensure the system is accurate, secure, and scalable.

The Validity of Hesitation

It is fair to ask why a CEO should act now rather than waiting for the hardware and software costs to stabilise. There is a genuine argument for hesitation: the volatility of the AI market.

The cost of the GPUs (Graphics Processing Units) required to run these models locally can fluctuate. The "best" open-source model today may be superseded in six months. Investing heavily in a specific hardware stack today carries the risk that the stack will be inefficient by next year. From a pure procurement perspective, waiting for a more stable price floor for local AI hardware is a rational move. If a CEO is concerned about wasting capital on hardware that will be obsolete in eighteen months, that is a valid concern.

However, this rationality only applies to the hardware. It does not apply to the data.

The Hidden Cost of Data Debt

AI infrastructure is not like a fleet of company cars that you replace every five years. It is more like the plumbing of a building. The way you organise, clean, and index your data today determines how effectively you can use every future model.

If a firm waits two years to begin this process, they are not just missing out on two years of efficiency. They are allowing their data to continue accumulating in an unstructured, unqueryable state. Every new contract, every new email, and every new report adds to the "data debt."

By the time a firm decides to move, the task of cleaning and indexing their archives will be exponentially more difficult. The "wait and see" approach does not freeze the risk; it compounds the eventual cost of the solution. The time spent sanitising a decade of fragmented PDFs is far greater than the time spent sanitising five years of them.

Furthermore, the talent gap is widening. The ability to govern and manage AI infrastructure is becoming a core competency for operations directors and CTOs. Firms that avoid the technology now will find themselves in a position where they eventually have the budget to buy the tools, but no internal understanding of how to implement them without compromising security.

The Path Forward: Smart Unloading

"Unloading" work to AI should not be viewed as a replacement for professional judgement, but as a replacement for professional drudgery. The goal is to shift the human workload from finding and summarising to analysing and deciding.

A smart shift in a professional services environment looks like this:

  • The Research Task: Instead of a junior analyst spending eight hours reading 20 separate regulatory updates to find a common theme, the local AI produces a thematic summary of those 20 documents in seconds. The analyst then spends one hour verifying the findings and drawing a strategic conclusion for the client.
  • The Compliance Audit: Instead of a compliance officer manually checking a new EU regulation against 150 internal policies, the AI flags the 12 policies that are now out of alignment. The officer then spends their time rewriting those 12 policies.
  • The Onboarding Process: Instead of a project manager spending four hours reviewing a new client's historical file to get up to speed, the AI provides a concise briefing note of all key decisions made in the last three years, allowing the manager to start the first client call with full context.

This is how the gap is closed. By providing a secure, internal alternative to public AI, the firm eliminates the incentive for Shadow AI. By investing in the data infrastructure now, they stop the growth of data debt. And by running the system on their own servers, they satisfy the requirements of frameworks like DORA and the GDPR.

The Choice

The choice facing the decision-maker is not between "AI" and "No AI". That choice has already been made by the employees who are using these tools in secret to survive their workloads.

The real choice is between unmanaged risk and managed infrastructure.

One path involves ignoring the problem and hoping that employees do not upload a sensitive client file to a public server. This path accepts a hidden tax of thousands of wasted billable hours and a growing mountain of unstructured data debt.

The other path involves accepting that AI is now a basic utility of professional work. It involves building the private infrastructure necessary to use it safely, ensuring that the data remains within the firm's perimeter and that the efficiency gains are captured by the business, not leaked to a third-party provider.

The shift in operational efficiency is not a trend; it is a change in the baseline of how professional services are delivered. Those who wait for a "perfect" moment will find that their competitors have not only moved faster, but have built a foundation of organised data that makes them impossible to catch.

If this is your situation, get in touch.

Sources

Sovereignty Compliance Infrastructure LLMs
← All posts