AI data ownership: Nadella warns buyers pay twice for intelligence

Satya Nadella, CEO of Microsoft, published a blog post warning that enterprises using proprietary AI models are paying twice: once for token usage and again by handing over proprietary knowledge through prompts, feedback, and corrections. This warning has direct implications for how AI builders and enterprise operators approach AI data ownership, model selection, and data governance.

What happened

In a blog post, Nadella joined a growing chorus of voices concerned that AI labs like OpenAI and Anthropic act as Trojan horses, gaining access to company secrets through model usage. He wrote: "You essentially pay for intelligence twice, once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful." He specifically warned that models learn from "exhaust" -- the prompts, agent tools, and corrections that enterprises feed them. Every correction is distilled into institutional know-how that a competitor could never buy.

Nadella also criticized the asymmetry in data rights. He pointed out that model makers freely train on public data but then impose restrictive terms on model distillation, the practice of using a model's outputs to train a new model. He called for fair use of public data while enabling enterprises to distill models in return.

Why AI builders should care

For teams building AI products or workflows, Nadella's warning underscores a structural risk: relying on a single proprietary model exposes your organization's data and creates lock-in. His proposed solution is to retain ownership of data by building proprietary learning environments on the cloud (conveniently Azure) and introducing orchestration layers that allow switching between providers. This directly aligns with the growing trend of multi-provider AI workflows and data governance practices.

The message is clear: if you depend on a single model provider, you are not just paying for tokens -- you are also training a competitor. Builders should architect their systems to be model-agnostic from the start.

Practical implications

Enterprises are already moving toward on-prem AI models and open-source alternatives. Idit Levine, CEO of Solo.io, notes that her customers ask: "Can I take an open source model and run it on-prem? It will do almost 90% of what the big one's doing. It will cost way less." Solo.io powers the Linux Foundation's Agentgateway project, used by companies like T-Mobile, ADP, and SAP.

Vercel and OpenRouter report a surge in traffic to open-source models. Last month, open models accounted for 29% of all traffic routed through Vercel's gateway. This shift toward cost parity and control is accelerating. The table below summarizes the key differences between the two approaches:

Approach	Data control	Cost	Vendor lock-in
Proprietary models	Low: data is shared with provider	Pay per token + hidden data cost	High
On-prem open-source models	High: data stays on infrastructure	Lower, near 90% of proprietary cost	Low
Multi-provider gateways	Medium: orchestration layer governs data	Variable, but can optimize cost	Low

Nadella's own investment in OpenAI and Anthropic makes his warning especially notable. He is telling his own partners' customers to be cautious.

Caveats

Nadella is the CEO of Microsoft, which profits from Azure and its own AI services. His proposed solution -- building on Azure -- has a clear self-interest. The warning applies equally to Microsoft's own models. The analysis here is based on secondary reporting; direct quotes and figures should be verified against original Microsoft statements. Additionally, the shift to on-prem models requires infrastructure and expertise that not all enterprises have.

FAQs

Nadella argues that organizations should retain ownership of their data, including prompts, feedback, and corrections, to protect competitive advantage. He warns that when enterprises use proprietary models, they are effectively training those models on their own business knowledge, which could be used against them. The solution is to build proprietary learning environments on the cloud where data stays under the organization's control.