Every day, employees in finance, legal and operations use public artificial intelligence (AI) platforms to summarize contracts, analyze financial data, develop code and draft board-level communications — sometimes without executive awareness or formal controls. Most AI-adopting companies already have an AI acceptable use policy on the books; however, we often find that technical controls and monitoring needed to enforce those policies are either immature or not in place at all.
That gap matters more than many leaders realize. Board members and C-suite executives consistently underestimate both the pace and breadth of AI adoption inside their own organizations, which leaves unrecognized exposure sitting inside risk reporting, insurance coverage and regulatory disclosures. This is shadow AI.
A recent SEC cybersecurity disclosure brought this risk into clearer focus when an employee's use of an unsanctioned AI tool triggered a public-company disclosure. We discuss that case in more detail later in this article, but first, it helps to define what we mean by shadow AI.
What Is Shadow AI?
Shadow AI refers to the use of AI tools, applications or services that operate outside an organization's approved technology governance framework. These tools are ungoverned, unmonitored and often unknown to IT, legal or the C-suite. Much like shadow IT before it, shadow AI represents a governance blind spot with direct financial, legal, and reputational consequences for executive leadership and the board.
The behavior driving shadow AI is typically not malicious. Employees across finance, operations, legal and technology are consistently being asked to utilize AI tools to work faster. The problem lies in AI tools being used without the awareness or authorization of chief information officers (CIOs), chief technology officers (CTOs) or compliance leadership. Common examples of shadow AI include:
- Uploading financial models or board materials into public AI platforms
- Using AI-enabled browser extensions that transmit data externally
- Activating AI features embedded in third-party software without review
In each case, sensitive information moves outside of executive visibility before anyone in IT, finance or the general counsel's office has a chance to weigh in.
Why Leaders Underestimate Shadow AI and What They Should Be Asking
The reason shadow AI is so easy to underestimate is structural. AI risk is not a single-function issue — it is a coordination problem across the enterprise, and weakness in any one function creates exposure for the rest. No one “owns AI.” AI is cross-functional by nature:
- Business owns the value AI creates
- Risk and audit own oversight
- IT and cyber own execution and protection
- Legal and compliance own regulatory alignment
- Data and privacy own ethical use
- Procurement owns vendor accountability
Several dynamics compound that fragmentation. Shadow AI delivers productivity gains that employees and managers welcome, which means executives receive no early warning before a data exposure, regulatory inquiry or disclosure obligation surfaces. The cybersecurity programs that chief information security officers (CISOs) and CTOs have built over the past decade were not designed to detect AI-related data exfiltration or AI-influenced decision-making, leaving a real gap in enterprise risk coverage. And because shadow AI incidents typically involve no external attacker or system breach, chief financial officers (CFOs), general counsel, and board members often do not recognize that a reportable event with material financial, regulatory and legal consequences may have already occurred.
For executive leadership and the board, the focus should be on oversight, risk appetite and accountability. A few questions are worth putting on the agenda:
- Is AI governance aligned to enterprise risk appetite?
- Are high-risk AI use cases visible at the board level?
- Is there a central AI governance function or committee?
- Are AI-related risks escalated and monitored consistently?
What Are the Risks of Shadow AI?
AI itself introduces a set of risks that traditional enterprise systems do not, including, but not limited to, algorithmic bias, limited explainability, autonomous decision-making and unpredictable behavior over time. Due to these risks, governments are actively regulating AI through the EU AI Act, U.S. executive orders and sector-specific rules. At the same time, expectations are evolving faster than internal controls can mature.
Still, when AI is approved, inventoried and controlled, those risks are manageable. When AI is operating in the shadows, they are not. The categories that follow — business, compliance and third-party — describe how shadow AI converts known risks into governance and disclosure failures.
Business Risks
Data Exposure
Confidential financial data, M&A materials, customer records and regulated information are routinely being submitted to external AI platforms. Once submitted, that data is outside the organization's control, with disclosure obligations, regulatory exposure and potential liability flowing back to the CFO and the board. Executive leadership typically has no visibility into how those AI vendors retain, store or reuse submitted information, including whether the data feeds model training or is shared downstream.
Visibility and Governance Challenges
Most CIOs and CTOs do not have a complete inventory of which AI tools are active across the enterprise. That gap undermines governance, audit readiness and risk management. Traditional procurement and approval controls are routinely bypassed because many AI tools are free, browser-based and can be adopted by any employee in minutes — without IT, legal or finance ever seeing them.
Decision-making
AI-generated outputs are increasingly shaping financial reporting, board presentations, customer communications and strategic decisions. CFOs and audit committees are often unaware that the analysis in front of them was AI-assisted. When executives act on AI-generated work product that is inaccurate, biased or incomplete, the organization faces material risk, including potential misstatements in public filings, flawed strategic decisions and director liability.
Compliance, Legal and Reporting Implications
The SEC's disclosure obligation turns on materiality — not intent or method. Whether the triggering event is a ransomware attack, an insider threat, or an employee using an unapproved AI tool to process sensitive data, the materiality question remains the same: was this a cybersecurity incident, and did it rise to a level that matters? An incident is material when a reasonable shareholder would be substantially likely to consider it important in making an investment decision.
The more immediate concern is the cascade that follows once sensitive or regulated data is involved. A single unsanctioned tool touching personal, confidential or regulated information can simultaneously activate state breach-notification obligations, increase public visibility, draw regulator scrutiny and create litigation exposure — all before the organization has had time to assess what happened. That cascade is what converts a policy violation into an enterprise-level event.
SEC Disclosure Considerations
Under the SEC's cybersecurity disclosure rules, public companies must report material cybersecurity incidents on Item 1.05 of Form 8-K within four business days of determining materiality, and annually describe their cybersecurity risk management, strategy and governance on Form 10-K. Materiality is assessed through the lens of a reasonable investor and turns on whether the event affected the confidentiality, integrity or availability of information — language broad enough to capture an unauthorized AI use case.
Data Privacy and Breach Notification
State breach-notification obligations are determined by where the affected individuals reside, not where the company is headquartered or where the incident occurred. With all 50 states having enacted breach notification laws, each with its own definition of sensitive information, its own notification timelines and its own regulatory triggers, a single shadow AI incident can simultaneously create obligations across dozens of jurisdictions. That layered exposure can also make the incident appear more material in the SEC analysis by increasing notification obligations, public visibility, response cost and claims exposure.
For boards and executives, the practical takeaway is that shadow AI events should be treated as enterprise governance and disclosure issues from the outset, not technology policy violations to be handled by IT. The organization needs a coordinated process across legal, compliance, privacy, cyber, risk and investor relations to assess materiality and respond consistently. That process needs to be defined before the incident, not built under pressure with a disclosure deadline approaching.
Third-party Risks
A growing share of the third-party vendors that CFOs, CIOs and procurement leaders rely on are embedding AI capabilities into their products, often without proactive disclosure and frequently without adequate safeguards over how client data is handled. This is where shadow AI most often slips into trusted environments — through features that are switched on quietly inside familiar software.
The board, CFO, and general counsel should keep in mind that the SEC holds organizations accountable for cybersecurity and disclosure obligations regardless of whether the incident originated in an internal system or a vendor platform.
When Shadow AI Becomes an SEC Disclosure Event
A recent SEC cybersecurity disclosure underscores that a reportable event does not have to involve a classic cyberattack, ransomware event or malicious outsider. In this case, an employee used an unsanctioned AI tool in a way that exposed sensitive company information outside established controls. Management determined that the resulting loss of data control was material enough to require public disclosure under the SEC's framework, which focuses on whether an unauthorized occurrence affected the confidentiality, integrity or availability of information.
That matters because reportable incidents can arise from non-nefarious, internally driven behavior — shadow AI, shadow IT, unauthorized SaaS tools, employee workarounds or other technology use that moves sensitive information beyond established governance and monitoring. The Wilson Sonsini analysis of the filing specifically called out unauthorized AI use as a prominent example of this broader and growing category of risk.
What makes the incident notable is what was absent. There was no system downtime, no malicious outsider and no traditional operational disruption, and yet the event still crossed the disclosure threshold. From an executive perspective, what made it disclosure-worthy was the sensitivity of the information involved, the loss of control over that information and the legal, regulatory and reputational consequences that followed. A governance lapse or an unauthorized internal activity can become a public-company disclosure issue even while operations continue normally.
How To Detect and Control Shadow AI: A Practical Response
Containing shadow AI is less about restricting AI and more about closing the visibility, governance and response gaps that allow shadow AI to operate undetected. The actions below sit across four areas: governance and policy, technical controls, incident response and disclosure, and third-party risk.
Governance and Policy
An AI governance policy sets the governance, risk management and control requirements for responsible AI use across the organization. A well-built policy works to:
- Align AI use with business strategy
- Maintain compliance with regulatory and legal requirements
- Protect data, systems and stakeholders
- Support ethical and transparent AI deployment
Technical Controls
Establish Visibility First
Visibility comes before governance. Without knowing which platforms employees are using and what data is being submitted, the organization cannot assess its exposure or meet its duty of care to the board.
CIOs and CTOs should:
- Conduct an enterprise-wide assessment of sanctioned and unsanctioned AI tool use
- Deploy network monitoring, cloud security posture, browser-level and endpoint controls
- Maintain a real-time view of AI adoption patterns across the workforce
Implement Data Protection Controls
Once sensitive financial, legal or customer information is submitted to an unauthorized AI platform, it cannot be retrieved. CFOs, CIOs, CTOs and CISOs should jointly:
- Set data classification standards that define which categories — financial, regulated, proprietary, customer-related — are prohibited from use in external AI tools
- Strengthen data loss prevention (DLP) controls to monitor and restrict submission of sensitive data to unauthorized AI platforms
- Review identity and access management so AI tool access is provisioned and deprovisioned in line with role-based business requirements
Manage AI as an Enterprise Technology Risk
Boards and executive teams should require that AI-enabled applications go through the same review as any other enterprise technology investment. The CIO or CTO should:
- Require documented review of every AI tool across security, privacy, regulatory compliance and contractual risk before production use
- Maintain a live inventory of approved AI tools that gives executive leadership visibility into what is in use, by whom and under what controls
Monitor for Emerging Risk
The AI landscape moves faster than annual risk assessments can capture. Board-level risk committees, chief risk officers (CROs), CIOs and CTOs should:
- Build continuous monitoring rather than relying on point-in-time reviews
- Track new AI deployments, third-party integrations and evolving usage patterns as part of ongoing operational discipline
Incident Response and Disclosure
Update Incident Response Plans
Most incident response plans were built before AI-related risk existed at scale, and few are adequately aligned with the SEC's Form 8-K cybersecurity disclosure requirements.
CFOs, general counsel and the CISO should:
- Evaluate readiness to respond if sensitive financial or operational data were exposed through an AI platform
- Confirm the plan addresses disclosure timelines, stakeholder notification obligations and potential restatement risk
Define Escalation Criteria
Pre-defined escalation criteria help confirm that AI-related events reach the right executives at the right moment. Leadership should:
- Define materiality and reporting thresholds for AI-related incidents in advance
- Document impact scenarios across financial exposure, regulatory obligations and reputational risk
- Confirm escalation paths reach the CFO, general counsel, CISO, chief compliance officer and board audit or risk committee
Evaluate Materiality Readiness
Under SEC guidance, materiality is assessed through the lens of a reasonable investor. CFOs, general counsel and audit committees should:
- Establish and document a materiality determination framework for incidents before regulators or plaintiffs define it
- Assess how an AI-related event could affect public financial reporting, material contracts, intellectual property ownership, regulatory standing and reputation
- Apply the framework regardless of whether a traditional system breach occurred
Practice Through Tabletop Exercises
Tabletop exercises that incorporate AI-related incident scenarios stress-test decision-making, escalation paths and disclosure readiness under realistic conditions. They equip the CFO, general counsel, CIO and Board members to make faster, better-informed calls on escalation, regulatory notification and investor communications, reducing both legal exposure and response time when an actual incident occurs.
Leverage Insurance and Risk Transfer Resources
Most cyber and professional liability policies include services that go well beyond claims payment, and many organizations do not engage them until after an incident. CFOs and risk managers should:
- Review existing cyber and professional liability policies for gaps across ransomware, data exfiltration, business email compromise, vendor failures and shadow AI
- Engage pre-incident resources early, including breach coaches, forensic response teams, legal panel resources and crisis communications firms
- Understand procedural obligations — timely reporting, pre-approved vendor panels and consent requirements — that, if missed, can jeopardize coverage
- Integrate insurance into the incident response plan rather than treating it as a separate workstream
Third-party and Vendor Risk
A growing share of vendors are embedding AI capabilities into their products, often without proactive disclosure. Organizations can be held accountable for cybersecurity and disclosure obligations regardless of whether the incident originated internally or with a vendor.
Assess Data Handling Practices
CFOs, CIOs, general counsel and the chief privacy officer should:
- Require a complete accounting of confidential, regulated and proprietary information being transmitted to AI-enabled vendors, including data flowing through automated integrations or embedded AI features
- Assess whether vendor AI systems may incorporate client or proprietary data into model training, which could constitute a material breach of data protection obligations
Expand Vendor Due Diligence
Standard vendor questionnaires were not built for AI-specific risks. Procurement, legal and technology leadership should:
- Expand vendor evaluation criteria to include AI governance maturity, model oversight, data handling, explainability and regulatory alignment
- Report findings to the CIO and CFO as part of the ongoing third-party risk program
Monitor Ongoing Changes
AI capabilities are being added to enterprise software products at a pace that outstrips annual vendor reviews. Vendor risk programs should flag material changes in AI functionality — new data access, model updates or expanded AI features — as trigger events that require executive review and re-assessment.
Strengthen AI Oversight Before Risk Escalates
What separates AI from earlier waves of shadow IT is the combination of scale, speed and consequence. An unsanctioned AI tool can ingest, analyze and surface sensitive information in ways that are harder to detect, harder to remediate and immediate in their legal and regulatory implications.
That is why AI risk cannot rest with a single function. Business, technology, legal, compliance, privacy, cyber and risk teams each have a defined role in how AI is approved, monitored and escalated, and none of those roles can substitute for the others. The governance question worth asking is how the organization coordinates ownership of technology risk across functions at the speed these risks actually move. Organizations that answer it in advance will manage AI incidents as operational events. The ones that do not will manage them as crises.
Let Us Be Your Guide Forward
Cherry Bekaert's Risk Advisory & Cybersecurity Services teams help organizations assess exposure, improve transparency into AI usage and build governance, response and disclosure readiness frameworks aligned to regulatory expectations.
Contact us to strengthen your approach to managing AI-related risk before it becomes a disclosure issue.
