BREACH WATCH BRIEF Medium ☁️ Threat intel

Google Cloud Adds OpenAI Models, Promises Business Data Won’t Train AI

Google Cloud introduced a private‑preview of OpenAI’s GPT‑6 models, billing them through the Marketplace and pledging that customer prompts and outputs will stay within designated data boundaries and will not be used to train the foundation models. This creates a concrete AI‑governance control that organizations must evidence for audit readiness.

SeverityMedium
Type☁️ Threat intel
ConfidenceHigh
ReportedOct 23, 2026
Cloud & Infrastructure Providers Technology & SaaS providers Enterprises using cloud‑based generative AI Unknown

What happened

Google Cloud announced a private preview that makes OpenAI’s GPT‑6 family available via its Marketplace. Customers can purchase usage on a single invoice, switch between Google and OpenAI models, and are told that all prompts, context, and outputs will remain within defined data boundaries and will not be fed back into model training. Google also previewed future zero‑data‑retention and Confidential Compute options.

Why it matters for trust and compliance

  • The data‑boundary promise maps directly to the control objective of restricting AI model training data, a requirement for continuous‑control‑assurance programs that need verifiable evidence of AI governance.
  • Demonstrate data‑boundary controls for AI model usage to satisfy AI‑governance requirements across frameworks.
  • Collect continuous evidence (API logs, retention settings, Confidential Compute attestations) for audit‑ready documentation.

Who is affected

Technology & SaaS providers Enterprises using cloud‑based generative AI

Recommended actions

  1. Map your AI data‑handling policy to the VCF control objective for model training data isolation.
  2. Enable detailed logging of all model API calls and verify zero‑retention configurations are active.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analysed for practitioners, in one email.