Traditional DLP and governance tools were designed mainly for data at rest, such as databases, file shares, and scheduled scans. Generative AI creates risk in motion through pasted prompts, retrieved context, model outputs, and agent tool calls. If controls do not inspect content at the moment of use, they will miss the highest-risk exposure paths.
Why legacy DLP sees the wrong layer of generative AI risk
Traditional DLP and data governance tools still matter, but they were built around repositories, transfers, and scheduled review. Generative AI changes the control problem because the sensitive event often happens at the point of interaction: a user pastes text into a prompt, a retrieval step assembles context, a model returns an output, or an agent invokes a tool with authority. That makes the exposure more transient, more contextual, and easier to miss if inspection only happens before storage or after the fact. NIST’s NIST AI 600-1 Generative AI Profile is relevant because it frames GenAI as a distinct governance and risk problem, not just another data repository.
Security teams often assume that a blocked upload or classified document scan is enough, but GenAI can surface the same information through prompts, retrieved snippets, or generated summaries that were never present in a traditional file path. In practice, many security teams discover the gap only after users have already normalised AI-assisted workflows around the old control boundary.
How the exposure moves through prompts, retrieval, outputs, and agent actions
generative ai risk is usually created by a chain, not a single event. A user may start with a prompt that includes confidential material, the system may add hidden or semi-hidden context from retrieval, the model may transform that input into an output that preserves or re-expresses sensitive content, and an agent may then act on that output by opening a ticket, sending a message, changing a record, or calling an external service. Traditional DLP is often strongest at known egress points, but GenAI workflows blur the boundary between input, processing, and disclosure.
The practical issue is timing. If inspection only occurs when data is saved, synced, or exported, it will miss the moment when the sensitive decision is made. That is especially true when the payload is not a neat file but a mixture of user text, retrieved context, system instructions, and machine-generated content. Governance tools can also struggle when the material is not directly classified at the source, because AI systems reassemble content from multiple fragments that are individually benign but collectively risky.
- Prompt-time inspection is needed for what users paste or ask the model to process.
- Retrieval-time controls are needed for what context the system assembles from connected sources.
- Output controls are needed for what the model reveals, summarizes, or rephrases.
- Tool-call governance is needed when an agent can trigger downstream actions with business impact.
This is why GenAI control design often shifts from static data location to live content handling, authorization, and action constraints. The guidance breaks down when the AI system can access valuable context but the organisation cannot inspect what was sent in, what was added by retrieval, or what the model was allowed to do next.
Where conventional controls still help, and where they need a different assumption
Tighter controls often increase friction, so organisations need to balance visibility against workflow speed and user adoption. Traditional DLP still has value for endpoint, email, storage, and exfiltration monitoring, but it should be treated as one layer rather than the whole answer. The main assumption that must change is that the meaningful risk is no longer only where data lives; it is also where data is transformed and acted on.
There is still some industry disagreement about how much control should sit at the AI gateway versus the endpoint, but there is broad agreement that controls limited to stationary data are incomplete for GenAI. The better question is whether the organisation can see and govern the interaction itself, not just the files underneath it.
For teams operating in regulated or highly sensitive environments, that means treating AI usage as a distinct policy domain with its own inspection points, escalation rules, and exceptions. The same content may require different handling when it is stored in a document library, pasted into a chat interface, or passed into an agent that can take action.
Risk and Threat Considerations
Generative AI creates a control gap when sensitive content is exposed in motion rather than at rest. The main risk is not simply accidental disclosure, but ungoverned transformation of sensitive input into model output or agent action that bypasses conventional review points.
Failure mechanism: Traditional DLP often depends on known repositories, files, or outbound channels. GenAI workflows can combine user prompts, retrieval, and generation in a way that hides the sensitive moment inside an interactive session, where inspection is weaker or absent.
Impact: Confidential material can be disclosed, reconstituted, or operationalised without ever passing through the control points that legacy governance tools were designed to monitor, weakening confidentiality, compliance, and downstream action control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI RMF, NIST AI 600-1, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 42001:2023 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | MAP — Measure, Assess and Manage AI Risks | GenAI risk is governed as an AI lifecycle and use-case risk, not just a storage problem. |
| Recommendation — Assess AI interaction points and apply controls where prompts, retrieval, outputs, and actions create risk. | ||
| NIST AI 600-1 | GenAI Profile — Generative AI Profile | This profile addresses the distinct risk profile of generative AI workflows and outputs. |
| Recommendation — Map GenAI workflows to profile guidance and close gaps at prompt, retrieval, output, and agent stages. | ||
| ISO/IEC 42001:2023 | A.6 — AI System Impact Assessment and Treatment | AI governance must account for operational impacts introduced by GenAI use cases. |
| Recommendation — Perform impact assessments for GenAI use cases and define controls before deployment expands. | ||
| CIS Controls v8 | 14 — Security Awareness and Skills Training | Users often create exposure by pasting sensitive data into AI tools without recognising the risk. |
| Recommendation — Train users to avoid pasting sensitive material into GenAI tools unless controls are verified. | ||
| NIST CSF 2.0 | PR.DS — Data Security | GenAI exposes data security gaps when protection stops at stored data instead of live use. |
| Recommendation — Extend data security controls to cover content in use across GenAI prompts, outputs, and actions. | ||
Practitioner Guidance
What to prioritise: Treat prompt ingress, retrieval context, model output, and agent tool calls as separate control points. If a control only covers storage or file movement, it is not yet addressing the GenAI exposure path that matters most.
What to verify: Confirm whether the organisation can inspect the actual content being sent to the model and the content being returned from it, not just the source repository that originally held the data. Also verify whether agent actions are constrained independently of content inspection.
What practitioners underestimate: The most common blind spot is assuming classification is enough. In GenAI, a fragment can become sensitive only after it is combined with context or transformed into an output, so the governance decision has to follow the interaction, not just the data label.
Practitioner takeaway: Legacy DLP is a necessary background control, but GenAI requires content-aware governance at the moment of use; if the organisation cannot inspect or constrain that interaction, it is protecting the archive while leaving the workflow exposed.
Related resources from NHI Mgmt Group
- Why do proxy-only DLP controls miss part of the AI data risk?
- Why do AI-driven enterprise workflows increase data security risk in ways traditional controls miss?
- Why do traditional DLP controls miss so much SaaS data risk in BYOD and GenAI workflows?
- When does AI create more governance risk than traditional data systems?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
