AI Governance Institute
← News
Research2025-05-30

Shadow AI and Client-Side Widgets Create an Inventory Gap That Existing Controls Do Not Cover, Kiteworks Analysis Finds

What happened

Kiteworks published AI Visibility Gap: The Defining Governance Problem on May 30, 2025, arguing that most enterprise AI governance failures stem from architectural blind spots rather than missing policies. The research identifies three overlapping problem categories: shadow AI tools adopted outside formal procurement, client-side JavaScript AI widgets and chatbots embedded in vendor-supplied web properties, and fragmented monitoring controls that treat AI systems as isolated applications rather than networked data processors. The analysis recommends specific technical controls including Content Security Policy headers, script allowlists, continuous AI asset inventory processes, contractual and technical third-party AI monitoring programs, and joint incident response runbooks developed with AI vendors before incidents occur. The piece further argues that AI widgets collecting or transmitting user data must be classified as data processors under privacy frameworks such as GDPR and CCPA, triggering formal data processing agreements and transfer impact assessments. The research applies globally and draws on regulatory alignment with the EU AI Act, ISO/IEC 42001, and NIST AI RMF.

Why it matters

  • ·Regulatory exposure is elevated because mandatory inventory and documentation requirements in the EU AI Act and equivalent frameworks are structurally incompatible with compliance programs that rely on annual vendor questionnaires and policy attestations, leaving client-side AI scripts and shadow AI tools undetected.
  • ·Operational impact is significant because client-side AI components served through third-party vendor relationships may already be transmitting user data to external AI providers without signed data processing agreements, creating active GDPR Article 28 and CCPA violations that periodic audits will not surface.
  • ·Organizational risk is compounded by a gap in records of processing activities, as existing data processor classification rules were not written with embedded AI widgets in mind, meaning subprocessors introduced by vendors between contract renewal cycles may never be reviewed or approved by compliance or legal teams.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

PRC-014Shadow AI and Third-Party Widget Inventory and ClassificationPRC-001AI Vendor Due DiligenceDGC-002PII Handling in AI SystemsAGT-019AI Tool and Plugin Supply Chain Risk AssessmentPRC-002AI Contractual Requirements

What to do now

  • ☐Extend the existing AI system inventory process to explicitly include client-side AI components served through third-party vendor relationships, not just internally deployed models.
  • ☐Implement Content Security Policy headers and script allowlists on organizational web properties to block unauthorized client-side AI execution and detect new AI components introduced without procurement review.
  • ☐Add a recurring technical verification step to the third-party AI vendor due diligence program to detect new AI subprocessors introduced by existing vendors between contract renewal cycles, replacing sole reliance on vendor self-attestation.
  • ☐Initiate a focused legal review to determine whether existing data processing agreements with web vendors and CMS providers adequately cover embedded AI widget components, and update records of processing activities accordingly.
  • ☐Update joint incident response runbooks with AI vendors to include scenarios specific to client-side AI component failures and unauthorized data exfiltration through embedded widgets, aligned with the AI incident response playbook.

What to watch next

Compliance teams should monitor the EU AI Act implementation timeline for mandatory AI system registration and inventory requirements that will formalize the visibility obligations Kiteworks describes. Regulators under GDPR are signaling increased scrutiny of subprocessor chains, and enforcement actions targeting undisclosed AI data processors embedded in vendor relationships are a plausible near-term development. Teams should also track updates to ISO/IEC 42001 guidance and NIST AI RMF supplementary publications, both of which are expected to address third-party and supply chain AI visibility in forthcoming revisions.

Related Coverage

Research2026-11-06

Only 15% of Organizations Track Vendor AI Use, Survey Finds

A Compliance Week webcast presented original survey data showing that only 15 percent of organizations track all relevant third parties' AI use or governance. The findings, shared by practitioners James Lindstrom and Andrew McBride, highlight fabricated citations and personal data exposure as recurring vendor AI failures. The gap leaves most enterprises unable to demonstrate regulatory compliance for AI systems their vendors are running on their behalf.

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.

Research2026-11-08

Coding Agents Expand the Security Boundary Beyond What Traditional Tools Cover

A Forrester analyst commentary published November 5, 2026 argues that AI coding agents introduce a security perimeter that traditional tools cannot assess. The expanded boundary includes AI models, MCP servers, skills, hooks, extensions, and plugins. Compliance teams are advised to maintain inventories of agentic dependencies, require workflow-specific vendor testing, validate AI-generated code, and strengthen access and monitoring controls.