Managed platforms generally encrypt the disks under your database and file storage for you. Google Cloud, for example, documents that customer content is encrypted at rest by default. This protects against one specific threat: someone getting hold of the physical disk or a raw copy of it.
It does not protect against the threats an AI-built app usually faces. When an attacker reaches your data through your own application, by using a leaked service key, a missing access policy or an injection flaw, the database decrypts the data for them exactly as it does for you. Ticking the box that says encrypted at rest is therefore not a reason to relax about access control.
For your most sensitive fields, such as government ID numbers, health details or third-party access tokens, add encryption inside the application so the database only ever sees ciphertext. OWASP's guidance is to use an established authenticated algorithm such as AES in GCM mode, never to design your own scheme, and to store the key separately from the data, in a secrets manager rather than in the same database or the code repository. Passwords are a different case: they should be hashed, not encrypted.