Great question. I work for a small AI consulting firm, every large corporate client we've approached asked us to work within their own systems. They would never let data outside their network for us to work on. Worse, they would make us engage with the lowest, least skilled ranks for the organisation.

HOWEVER, I also know management consultants who also do work for these corporations and they seem to get the data no strings attached. Apparently all the security/privacy policy is ignored when someone who reports to the CEO says 'Give BCG all the data they want'.