When a business sends documents to an AI service, it depends on more than the model’s answers. The service’s contracts, infrastructure and legal environment also become part of the operating decision.
The dispute between Anthropic and the US defence department brought that dependence into public view. In its 5 March 2026 statement, Anthropic said a supply-chain-risk designation concerned specific defence contracts and that it intended to challenge the decision. That is the company’s account of the dispute, rather than evidence that every customer’s data had been exposed.
For a South African team, the practical task is to understand its own information flows and supplier arrangements.
Map the information before selecting a model
List the information each proposed workflow needs. Separate public content from customer records, staff details and confidential business documents. A tool summarising public product descriptions has different requirements from one processing employment records.
Record where prompts, attachments, results and logs are stored. Check whether information reaches additional suppliers through monitoring, support tools or connected services. The model endpoint is only one part of the flow.
Review the contract and configuration together
Ask what the agreement says about retention, training use, deletion, support access and subcontractors. Then confirm which settings apply to the product and plan you actually use. A provider’s consumer application and its business API may have different arrangements.
Keep a dated copy of the relevant terms with the project records. Recheck them when the integration, account plan or type of information changes.
Understand the local obligations
Section 72 of the Protection of Personal Information Act sets conditions for transferring personal information outside South Africa. It is not a blanket rule that every database must be hosted locally.
Have the person responsible for information protection assess the proposed transfer and its legal basis. A South African server location alone does not settle every obligation, particularly if support staff, logs or connected services are elsewhere.
Compare managed and self-hosted options honestly
Self-hosting can give your team more control over deployment and access. It also makes your team responsible for patching, monitoring, backups and incident response. Confirm that you have the people and infrastructure to do that work.
For either option, test export and deletion using sample records. Document how staff continue working if the service becomes unavailable. Keep the fallback small enough that it can be used under pressure.
Speak to webrack about mapping an AI workflow before connecting it to confidential business information.