Anyone else noticed how broken enterprise AI + PII handling actually is?

We've been building an AI gateway for the past few months and hit a problem we didn't expect. Most enterprises we talked to either banned LLM tools completely or are quietly using them and hoping compliance doesn't notice. When we dug into why, it kept coming back to the same thing — they can't send raw customer or patient data to an external LLM, and the tools that claim to solve this only do half the job. They redact before sending. Fine. But the