Your data-loss-prevention tools watch for sensitive files and patterns moving where they shouldn't. They're good at it. But they were built for a world where risk lives in the file and AI doesn't live in that world.
Consider how a model actually answers a question. It retrieves many fragments, combines them and generates a new conclusion. Each fragment might be perfectly permitted on its own. The conclusion might not be. A model can infer a person's identity, a deal's price or a strategic direction from pieces that were never individually sensitive. No restricted file was opened. No pattern matched. Your access logs look clean. That's semantic leakage and it is invisible to controls built around files and permissions.
This is not a hypothetical edge case; it's the normal behavior of useful AI. The more capable the system, the better it is at synthesis; and synthesis is exactly the mechanism that produces leakage. Aggregation risk, where harmless data points combine into sensitive ones, is the same problem viewed from the input side.
File-level and pattern-based controls can't catch this because the sensitive thing never exists as a file or a pattern until the model creates it. Catching it requires governing the meaning being assembled, not just the data being moved. That means attaching sensitivity and semantic labels to content at a fine-grained level, then evaluating during retrieval and reasoning, what is being combined and concluded, for whom and for what purpose. When the assembled meaning crosses a line, the system redacts, blocks or annotates before the answer is formed.
It also means keeping evidence. Because semantic leakage is invisible to traditional logs, you need a record of what the AI was prevented from inferring, not just what it accessed. That record is what turns "we think it's safe" into "we can show it's safe."
The uncomfortable truth is that most enterprises deploying AI today have no control at this layer. They've extended access controls to the model and assumed that's enough. It isn't, because the model's job is to go beyond access and produce understanding. Governing understanding is a different discipline and it's the one that closes the gap DLP leaves open.