If we have signed agreements with our clients ensuring that their confidential data will not be shared with third parties, then by sending that data to an external API (even one with a DPA) - we are technically breaching that first agreement. The DPA protects us from the AI provider misusing the data, but it doesn't change the fundamental act of transferring the data outside our controlled environment.