Shadow AI and third-party risk: what practitioners are missing

TL;DR: Shadow AI is not just employee misuse but an unreviewed third-party channel, with unapproved AI tools appearing in 43% of security incidents and almost seven in ten breached organisations lacking AI governance or detection processes, according to Panorays. That shifts the control problem from internal policy alone to vendor inventory, SaaS assessment, and supply chain oversight.

Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Shadow AI Is Creating Vendors You Never Onboarded”.

By the numbers:

• unapproved AI tools figured in 43% of security incidents, more than double the share a year earlier

Key questions

Q: What is the failure mode when shadow AI is treated only as an employee policy issue?

A: The failure mode is that sensitive data leaves the organisation through unreviewed external services while governance teams look only at user behaviour.

Q: Why does shadow AI create third-party risk even when the supplier was already approved?

A: Approval at onboarding only covers the service that was reviewed at the time.

Q: What are the signs that an AI vendor is not being governed effectively?

A: Common warning signs include unclear data use terms, no visibility into what data the model consumes, weak answers on training rights or retention, and no process for ongoing review after launch.

Practitioner guidance

• Expand third-party reviews for AI processing paths Update supplier assessments to ask whether customer, employee, or support data can be routed into public chatbots, embedded copilots, or external model APIs.
• Inventory supplier AI features and dependencies Require vendors to disclose browser extensions, summarisation tools, model providers, and any AI functionality added after onboarding.
• Reclassify shadow AI as data transfer risk Treat unapproved AI use as an external data flow problem, with retention, access, and disclosure questions in the review record.

Bottom line: Shadow AI becomes materially different once unapproved tools or embedded features start processing enterprise data outside the approved supplier inventory.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →