AI Governance Institute logo
AI Governance Institute

Intelligence for Compliance and GRC Teams

← News
Research2025-05-30

Shadow AI and Client-Side Widgets Create an Inventory Gap That Existing Controls Do Not Cover, Kiteworks Analysis Finds

What happened

Kiteworks published AI Visibility Gap: The Defining Governance Problem on May 30, 2025, arguing that most enterprise AI governance failures stem from architectural blind spots rather than missing policies. The research identifies three overlapping problem categories: shadow AI tools adopted outside formal procurement, client-side JavaScript AI widgets and chatbots embedded in vendor-supplied web properties, and fragmented monitoring controls that treat AI systems as isolated applications rather than networked data processors. The analysis recommends specific technical controls including Content Security Policy headers, script allowlists, continuous AI asset inventory processes, contractual and technical third-party AI monitoring programs, and joint incident response runbooks developed with AI vendors before incidents occur. The piece further argues that AI widgets collecting or transmitting user data must be classified as data processors under privacy frameworks such as GDPR and CCPA, triggering formal data processing agreements and transfer impact assessments. The research applies globally and draws on regulatory alignment with the EU AI Act, ISO/IEC 42001, and NIST AI RMF.

Why it matters

  • ·Regulatory exposure is elevated because mandatory inventory and documentation requirements in the EU AI Act and equivalent frameworks are structurally incompatible with compliance programs that rely on annual vendor questionnaires and policy attestations, leaving client-side AI scripts and shadow AI tools undetected.
  • ·Operational impact is significant because client-side AI components served through third-party vendor relationships may already be transmitting user data to external AI providers without signed data processing agreements, creating active GDPR Article 28 and CCPA violations that periodic audits will not surface.
  • ·Organizational risk is compounded by a gap in records of processing activities, as existing data processor classification rules were not written with embedded AI widgets in mind, meaning subprocessors introduced by vendors between contract renewal cycles may never be reviewed or approved by compliance or legal teams.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentIRC-001AI Incident Response PlaybookPRC-001Third-Party AI Risk AssessmentPRC-002AI Vendor Contract RequirementsPRC-004Vendor Incident Notification RequirementsSEC-005Supply Chain Security for AI Dependencies

What to do now

  • ☐Extend the existing AI system inventory process to explicitly include client-side AI components served through third-party vendor relationships, not just internally deployed models.
  • ☐Implement Content Security Policy headers and script allowlists on organizational web properties to block unauthorized client-side AI execution and detect new AI components introduced without procurement review.
  • ☐Add a recurring technical verification step to the third-party AI vendor due diligence program to detect new AI subprocessors introduced by existing vendors between contract renewal cycles, replacing sole reliance on vendor self-attestation.
  • ☐Initiate a focused legal review to determine whether existing data processing agreements with web vendors and CMS providers adequately cover embedded AI widget components, and update records of processing activities accordingly.
  • ☐Update joint incident response runbooks with AI vendors to include scenarios specific to client-side AI component failures and unauthorized data exfiltration through embedded widgets, aligned with the AI incident response playbook.

What to watch next

Compliance teams should monitor the EU AI Act implementation timeline for mandatory AI system registration and inventory requirements that will formalize the visibility obligations Kiteworks describes. Regulators under GDPR are signaling increased scrutiny of subprocessor chains, and enforcement actions targeting undisclosed AI data processors embedded in vendor relationships are a plausible near-term development. Teams should also track updates to ISO/IEC 42001 guidance and NIST AI RMF supplementary publications, both of which are expected to address third-party and supply chain AI visibility in forthcoming revisions.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-08-16

AI Credit Brokers Create a Silent Supply Chain Breach in Enterprise API Programs

Vectoral researcher Matt Lenhard has documented a functioning secondary market in which brokers purchase unused AI inference credits from startups and resell them at discounts of 30 to 80 percent through marketplaces, Telegram channels, and direct outreach. Buyers route their AI workloads through broker-controlled pools of provider API keys, bypassing direct contractual relationships with the underlying model providers. The arrangement exposes enterprise compliance programs to undisclosed data processing chains, unknown data residency, and potential violations of provider terms of service.

Research2026-08-16

MCP Ruby SDK and File Server Bugs Expose Enterprise Agent Toolchains

Security researchers at Mallory.ai have documented a denial-of-service vulnerability in the MCP Ruby SDK and a file-disclosure flaw in an MCP server component caused by insufficient path validation. The findings indicate that common vulnerability classes — resource exhaustion and directory traversal — are present in MCP ecosystem components that enterprises are deploying as trusted agent infrastructure. Security and compliance teams are advised to treat all custom and third-party MCP components as untrusted and to apply immediate patch management.

Research2026-08-17

Keyrus 2026 Guide Sets a Baseline Operating Model for AI Governance Programs

Consulting firm Keyrus has published a practitioner guide outlining how enterprises should structure AI governance programs in 2026, emphasizing four foundational elements: a complete AI inventory, risk-based prioritization, cross-functional governance teams, and oversight of vendor-supplied models. The guide provides a replicable operating model that compliance teams can adapt and pair with existing controls. It targets organizations at any stage of AI governance maturity.