Insight
Privacy engineering for models on sensitive data
Most AI risk in a regulated firm is a data question: what reaches the model, and who can see what comes back.
QCT Studio team1 min read
Most AI risk in a regulated firm is a data question: what reaches the model, and who can see what comes back.
Why this matters now
Regulators have moved from asking whether firms are aware of the risk to asking what they have done about it. That shift changes the conversation from research to delivery, and delivery needs an inventory, an owner and a date.
- Inventory first. You cannot migrate what you have not found.
- Rank by shelf life. Data that must stay secret longest moves first.
- Prove it continuously. A one-off report goes stale the day after it is filed.
The question is not whether the risk is real, but whether your migration finishes first.
What good looks like
| Stage | Output | Owner |
|---|---|---|
| Assess | Exposure by data class | CISO |
| Discover | Cryptographic inventory | Platform teams |
| Migrate | Hybrid designs in pilots | Architecture |
| Assure | Drift watch, board reports | Risk |
A note on hybrids
Hybrid schemes pair a classical algorithm with a post-quantum one, so the result is at least as strong as the stronger of the two:
shared_secret = KDF(x25519_secret || ml_kem_768_secret)
This is sample content generated by pnpm mockdata:up to show the layout. Remove it with pnpm mockdata:down.
- ai and privacy
