You've been paying for enterprise AI in two currencies—and nobody told you about the second one. The first currency is money. You know that bill. The second currency is your company's most irreplaceable asset: the proprietary knowledge, workflows, and institutional intelligence that took years to build. And unlike the subscription fee, that second payment compounds quietly in the background every time an employee hits send.
Microsoft CEO Satya Nadella put a name to this problem in a blog post published Sunday—and the fact that it came from him makes it impossible to ignore. This is the CEO of a company that has invested billions in OpenAI and Anthropic. This is the person who bet Microsoft's entire AI strategy on proprietary models. And yet here he is, warning enterprise leaders to protect themselves from exactly that arrangement.
That's not a contrarian hot take. That's a signal.
The Mechanics of Paying Twice
Nadella's warning centers on what he calls the "reverse information paradox." The more value you want to extract from an AI model, the more proprietary context you have to feed it. And that context doesn't disappear when the session ends.
"You essentially pay for intelligence twice," Nadella writes, "once with money, and again with something even more valuable: the proprietary knowledge you must reveal to make that intelligence useful. The better you want the model to perform, the more of that knowledge you have to feed it."
The second payment is invisible and unbounded. You pay it every time you write a detailed prompt. Every time an agent corrects a model's mistake. Every time a workflow runs and the model observes which steps matter. Nadella calls this the "exhaust" of AI usage—and it turns out to be rocket fuel for the model provider.
"Models learn from 'exhaust'—the prompts people write, the tools agents use, and especially the corrections people make when the model is wrong. Every correction is distilled into institutional know-how," he writes.
That institutional know-how is, in his words, "the kind of knowledge a competitor could never buy."
Until now. Now they can get it for free. From you.
Why This Matters More Than Your AI Bill
Finance teams are laser-focused on AI spend. Token costs, API fees, seat licenses—these show up on the P&L and get scrutinized. But the second payment is off-balance-sheet, and that's exactly why it's dangerous.
Think about what actually makes your company defensible. It's not the software you subscribe to. Competitors can subscribe to the same tools. What you have that competitors don't is the accumulated operational intelligence inside your organization: the edge cases your teams have learned to handle, the customer-specific nuances embedded in your sales playbooks, the workflow optimizations your operations team refined over years, the compliance patterns your legal team developed the hard way.
That knowledge is now being systematically fed into AI prompts. And with every prompt, with every correction, with every workflow execution, that knowledge gets absorbed into model training data—or at minimum, retained in fine-tuning datasets—that benefits the model provider's broader intelligence.
In conversations with enterprise leaders across industries, I hear versions of the same concern: "We're training these models on our most valuable processes, and we don't own what comes out the other side." The math is straightforward. You spent a decade building institutional expertise. Now you're handing it to a third party at the cost of a few API tokens.
What Makes Nadella's Warning Land Differently
This critique isn't new. VCs like Jason Calacanis and enterprise skeptics like Palantir CEO Alex Karp have been raising similar concerns for months. What makes Nadella's version significant is the source.
Microsoft has billions riding on OpenAI. The company built Copilot as a flagship AI product. Nadella is not an AI skeptic—he's the person who moved faster on enterprise AI than any CEO in tech. For him to publicly warn enterprises to protect their data ownership and consider "orchestration layers" that allow model-switching is a remarkable statement.
It also signals something the market hasn't fully priced in: the current vendor dynamics are unstable. Model providers that "reserve the right to learn from customer usage and interaction data"—Nadella's words—are operating under terms that most enterprise legal teams haven't scrutinized carefully enough.
Read the fine print on the AI contract sitting in your legal queue right now. You may find that what looked like a tool subscription reads more like a knowledge transfer agreement.
The Technical Reality: How Model "Exhaust" Actually Works
For technical leaders, it's worth grounding this in operational reality rather than treating it as theoretical.
When your teams use a proprietary AI model in production, several data flows emerge:
Prompt content: The detailed context employees write into prompts—customer details, process steps, exception handling logic, domain-specific terminology—reveals the shape of your operations. Even without direct retention, prompt patterns expose organizational structure.
Correction signals: Every time a user marks a model output as wrong and provides the correct answer, that correction signal is extraordinarily valuable. It's human-labeled training data, specific to your domain, generated at your expense.
Agent tool usage patterns: As AI agents become the interface layer, the sequence of tools they use, the APIs they call, and the decisions they make create a detailed map of your business logic. That map has significant competitive value.
Workflow execution data: Multi-step agentic workflows reveal which business processes are being automated, how they're structured, and where the error rates are highest. This is operational intelligence at scale.
Whether model providers use this data directly for training or simply retain it is somewhat beside the point. The data exists, it's outside your control, and the contractual terms governing its use are written by the provider—not by you.
What Enterprises Are Actually Doing About It
The market response is already forming, and the data points are clear enough to act on.
On-premise open source deployment is accelerating. Idit Levine, CEO of Solo.io—which powers networking and security for enterprise AI systems and counts T-Mobile, ADP, and SAP among its customers—describes the pattern she's seeing consistently: enterprises experiment with proprietary cloud models, then start asking whether they can run capable open source alternatives on their own infrastructure.
The economic case is compelling. "Can I take an open source model and run it on-prem? It will do almost 90% of what the big one's doing. It will cost way less," she explains. "They understand that, and they can control it."
The usage data supports this trend. Open source models accounted for 29% of all AI traffic routed through Vercel's AI gateway last month. That's not a niche behavior—it's nearly a third of enterprise AI traffic already shifting toward models where the data ownership equation is fundamentally different.
AI gateways and orchestration layers are becoming standard infrastructure. The ability to route workloads across multiple models—switching based on cost, capability, or data sensitivity—gives enterprises meaningful leverage. It also prevents the kind of deep vendor lock-in that makes data ownership terms impossible to negotiate.
The Practical Framework for Enterprise Leaders
Nadella's recommendations are clear, even if he frames them diplomatically. Translated for enterprise decision-makers:
1. Audit your current AI contracts for data usage clauses. Every major AI provider has different terms around training data, fine-tuning, and retention. Your legal and procurement teams need to scrutinize these before you're years into a deployment. Look specifically for clauses that allow the provider to "improve services" using your interaction data—that language often means training.
2. Classify data sensitivity before it touches AI. Not every prompt carries equal risk. A customer support bot answering billing questions exposes different data than a sales agent working your enterprise deal pipeline. Build a classification framework and route sensitive workloads accordingly.
3. Build a model-agnostic orchestration layer. If your AI strategy is built on a single provider, you have no negotiating position when contracts come up for renewal. An orchestration layer—using tools like AI gateways, routing infrastructure, or multi-model frameworks—gives you genuine optionality. That optionality has direct financial value.
4. Evaluate on-premise for high-sensitivity workloads. The performance gap between frontier proprietary models and capable open source alternatives has closed substantially. For workloads where data sensitivity is highest—finance, legal, HR, competitive intelligence—the on-prem math deserves serious evaluation. The cost savings are often compelling; the data control benefit is strategic.
5. Own your institutional intelligence layer. Nadella's core recommendation is to build "proprietary learning environments" where your fine-tuning data, prompt libraries, and correction signals stay under your control. This means treating your AI training data as an enterprise asset with governance and access controls, not as ephemeral session logs.
The Broader Implication: The Rules Are Being Written Now
We're in a window where enterprise AI contract terms are being normalized across the industry. The behaviors enterprises accept now—data retention, training rights, fine-tuning terms—will be the baseline that providers use to write tomorrow's standard agreements.
Nadella's framing of the distillation debate is worth sitting with: he argues that if AI providers can claim fair use of the internet's publicly available data to train their models, then enterprises should have equivalent rights to "distill" model outputs for their own learning purposes. Whether that argument holds legally is an open question, but the underlying principle matters for the contracts you're signing today.
"In consuming intelligence, you are creating intelligence," Nadella writes. "And what you create should belong to you."
That's a principle enterprise legal teams should be putting in front of AI vendors before the next contract cycle.
What This Means Right Now
The practical takeaway isn't to abandon AI—that would be strategically disqualifying. The takeaway is to treat AI data governance with the same rigor you apply to any other sensitive asset.
Your AI prompts are business documents. Your correction signals are training data with strategic value. Your agent workflows are a map of your most defensible processes. And the contracts governing what happens to all of it deserve the same scrutiny as any other enterprise software agreement that touches your intellectual property.
Satya Nadella didn't publish that blog post to be contrarian. He published it because the enterprise customers asking him these questions are running out of time to get the governance right.
The bill for the second payment comes due eventually. Unlike the token costs, you won't see a line item for it.
Enterprise AI governance is one of the most consequential decisions leaders will make this decade. The choices made in the next 12-18 months will determine which companies own their AI advantage and which companies built it—then handed it away.
