AI Governance Institute logo
AI Governance Institute

Practical Governance for Enterprise AI

← News
Research2025-05-30

Shadow AI and Client-Side Widgets Create an Inventory Gap That Existing Controls Do Not Cover, Kiteworks Analysis Finds

What happened

Kiteworks published AI Visibility Gap: The Defining Governance Problem on May 30, 2025, arguing that most enterprise AI governance failures stem from architectural blind spots rather than missing policies. The research identifies three overlapping problem categories: shadow AI tools adopted outside formal procurement, client-side JavaScript AI widgets and chatbots embedded in vendor-supplied web properties, and fragmented monitoring controls that treat AI systems as isolated applications rather than networked data processors. The analysis recommends specific technical controls including Content Security Policy headers, script allowlists, continuous AI asset inventory processes, contractual and technical third-party AI monitoring programs, and joint incident response runbooks developed with AI vendors before incidents occur. The piece further argues that AI widgets collecting or transmitting user data must be classified as data processors under privacy frameworks such as GDPR and CCPA, triggering formal data processing agreements and transfer impact assessments. The research applies globally and draws on regulatory alignment with the EU AI Act, ISO/IEC 42001, and NIST AI RMF.

Why it matters

  • ·Regulatory exposure is elevated because mandatory inventory and documentation requirements in the EU AI Act and equivalent frameworks are structurally incompatible with compliance programs that rely on annual vendor questionnaires and policy attestations, leaving client-side AI scripts and shadow AI tools undetected.
  • ·Operational impact is significant because client-side AI components served through third-party vendor relationships may already be transmitting user data to external AI providers without signed data processing agreements, creating active GDPR Article 28 and CCPA violations that periodic audits will not surface.
  • ·Organizational risk is compounded by a gap in records of processing activities, as existing data processor classification rules were not written with embedded AI widgets in mind, meaning subprocessors introduced by vendors between contract renewal cycles may never be reviewed or approved by compliance or legal teams.

Governance controls affected

AGT-019AI Tool and Plugin Supply Chain Risk AssessmentIRC-001AI Incident Response PlaybookPRC-001Third-Party AI Risk AssessmentPRC-002AI Vendor Contract RequirementsPRC-004Vendor Incident Notification RequirementsSEC-005Supply Chain Security for AI Dependencies

What to do now

  • ☐Extend the existing AI system inventory process to explicitly include client-side AI components served through third-party vendor relationships, not just internally deployed models.
  • ☐Implement Content Security Policy headers and script allowlists on organizational web properties to block unauthorized client-side AI execution and detect new AI components introduced without procurement review.
  • ☐Add a recurring technical verification step to the third-party AI vendor due diligence program to detect new AI subprocessors introduced by existing vendors between contract renewal cycles, replacing sole reliance on vendor self-attestation.
  • ☐Initiate a focused legal review to determine whether existing data processing agreements with web vendors and CMS providers adequately cover embedded AI widget components, and update records of processing activities accordingly.
  • ☐Update joint incident response runbooks with AI vendors to include scenarios specific to client-side AI component failures and unauthorized data exfiltration through embedded widgets, aligned with the AI incident response playbook.

What to watch next

Compliance teams should monitor the EU AI Act implementation timeline for mandatory AI system registration and inventory requirements that will formalize the visibility obligations Kiteworks describes. Regulators under GDPR are signaling increased scrutiny of subprocessor chains, and enforcement actions targeting undisclosed AI data processors embedded in vendor relationships are a plausible near-term development. Teams should also track updates to ISO/IEC 42001 guidance and NIST AI RMF supplementary publications, both of which are expected to address third-party and supply chain AI visibility in forthcoming revisions.