Executive Summary
In March 2023, Italy's data protection authority ordered OpenAI to stop processing Italian users' personal data via ChatGPT, citing GDPR transparency and legal-basis failures [13]. Samsung's semiconductor division documented three separate incidents the same spring in which engineers pasted proprietary source code and meeting notes into ChatGPT [14]. Those are not edge cases—they are the default risk when regulated data meets public application programming interface (API) convenience.
Meanwhile, enterprise AI budgets are climbing fast: surveyed U.S. firms reported average monthly AI spend rising from $62,964 in 2024 to a projected $85,521 in 2025—a 36% increase—with only 51% strongly agreeing they can track return on investment (ROI) [15]. The strategic question is no longer which frontier model to call, but which deployment pattern keeps data inside the required jurisdiction while FinOps can attribute every inference dollar [1][16].