AI Governance Institute logo
AI Governance Institute

Practical Governance for Enterprise AI

← News
Research2025-05-30

Shadow AI and Client-Side Widgets Create an Inventory Gap That Existing Controls Do Not Cover, Kiteworks Analysis Finds

What happened

Kiteworks published AI Visibility Gap: The Defining Governance Problem on May 30, 2025, arguing that most enterprise AI governance failures stem from architectural blind spots rather than missing policies. The research identifies three overlapping problem categories: shadow AI tools adopted outside formal procurement, client-side JavaScript AI widgets and chatbots embedded in vendor-supplied web properties, and fragmented monitoring controls that treat AI systems as isolated applications rather than networked data processors. The analysis recommends specific technical controls including Content Security Policy headers, script allowlists, continuous AI asset inventory processes, contractual and technical third-party AI monitoring programs, and joint incident response runbooks developed with AI vendors before incidents occur. The piece further argues that AI widgets collecting or transmitting user data must be classified as data processors under privacy frameworks such as GDPR and CCPA, triggering formal data processing agreements and transfer impact assessments. The research applies globally and draws on regulatory alignment with the EU AI Act, ISO/IEC 42001, and NIST AI RMF.

Why it matters

  • ·Regulatory exposure is elevated because mandatory inventory and documentation requirements in the EU AI Act and equivalent frameworks are structurally incompatible with compliance programs that rely on annual vendor questionnaires and policy attestations, leaving client-side AI scripts and shadow AI tools undetected.
  • ·Operational impact is significant because client-side AI components served through third-party vendor relationships may already be transmitting user data to external AI providers without signed data processing agreements, creating active GDPR Article 28 and CCPA violations that periodic audits will not surface.
  • ·Organizational risk is compounded by a gap in records of processing activities, as existing data processor classification rules were not written with embedded AI widgets in mind, meaning subprocessors introduced by vendors between contract renewal cycles may never be reviewed or approved by compliance or legal teams.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentIRC-001AI Incident Response PlaybookPRC-001Third-Party AI Risk AssessmentPRC-002AI Vendor Contract RequirementsPRC-004Vendor Incident Notification RequirementsSEC-005Supply Chain Security for AI Dependencies

What to do now

  • ☐Extend the existing AI system inventory process to explicitly include client-side AI components served through third-party vendor relationships, not just internally deployed models.
  • ☐Implement Content Security Policy headers and script allowlists on organizational web properties to block unauthorized client-side AI execution and detect new AI components introduced without procurement review.
  • ☐Add a recurring technical verification step to the third-party AI vendor due diligence program to detect new AI subprocessors introduced by existing vendors between contract renewal cycles, replacing sole reliance on vendor self-attestation.
  • ☐Initiate a focused legal review to determine whether existing data processing agreements with web vendors and CMS providers adequately cover embedded AI widget components, and update records of processing activities accordingly.
  • ☐Update joint incident response runbooks with AI vendors to include scenarios specific to client-side AI component failures and unauthorized data exfiltration through embedded widgets, aligned with the AI incident response playbook.

What to watch next

Compliance teams should monitor the EU AI Act implementation timeline for mandatory AI system registration and inventory requirements that will formalize the visibility obligations Kiteworks describes. Regulators under GDPR are signaling increased scrutiny of subprocessor chains, and enforcement actions targeting undisclosed AI data processors embedded in vendor relationships are a plausible near-term development. Teams should also track updates to ISO/IEC 42001 guidance and NIST AI RMF supplementary publications, both of which are expected to address third-party and supply chain AI visibility in forthcoming revisions.

Related Coverage

Insight2026-06-27

Mythos 5 Partial Reinstatement Creates Government-Controlled AI Access Tiers With No Transparent Process

The US government on June 27 granted roughly 100 approved companies access to Claude Mythos 5, partially reversing a June 12 export control suspension, while Fable 5 and organizations outside the approved list remain locked out with no published selection criteria or recourse. The action is the first commercial enforcement under a new executive order framework requiring government pre-release review of frontier models, making tiered access structural rather than ad hoc.

Insight2026-06-13

Fable 5 and Mythos 5 Suspended by U.S. Export Control Directive: Three Governance Gaps Enterprise AI Programs Have Not Planned For

On June 12, 2026, a U.S. government export control directive required Anthropic to suspend all access to Fable 5 and Mythos 5 for foreign nationals, effectively disabling the models for all customers overnight. The immediate trigger was a narrow code-analysis jailbreak technique, but the directive exposes deeper gaps: most enterprise AI governance programs have no continuity plan for government-mandated model suspension, no process for nationality-based access controls, and no export control review in their AI vendor assessment workflow.

Research2026-06-30

Ambient AI Clinical Documentation Lawsuit Targets Sutter Health and MemorialCare Over Consent Failures

A class action lawsuit has been filed against Sutter Health and MemorialCare alleging that an ambient AI clinical documentation tool recorded confidential physician-patient conversations, transmitted them to third-party servers, and entered transcriptions into electronic health records without obtaining informed patient consent. The complaint identifies failed pre-implementation data pathway mapping and consent process validation as the root governance failures. The case signals material litigation exposure for healthcare organizations that deploy ambient AI tools without documented consent workflows.