Topic

Enterprise AI Risk

Enterprise AI risk refers to the potential negative outcomes and uncertainties associated with deploying artificial intelligence systems across an organization, including operational failures, financial losses, reputational damage, and regulatory penalties. This encompasses technical risks like model bias and performance degradation, as well as broader organizational risks such as inadequate governance, insufficient training, and misalignment with business objectives. Understanding and managing enterprise AI risk is critical for governance because it directly affects compliance with regulations, stakeholder trust, and the organization's ability to derive sustainable value from AI investments.

1 item

ResearchUS2026-04-19

82% of Top 100 GenAI SaaS Tools Rated Medium to Critical Risk as Employees Routinely Enter Sensitive Data, Cyberhaven Labs Finds

Cyberhaven Labs released its 2026 AI Adoption and Risk Report on February 5, 2026, drawing on analysis of billions of real-world data movements across generative AI SaaS platforms, endpoint AI applications, and AI agents used in enterprise environments. The report finds that 82% of the top 100 GenAI SaaS tools are classified as medium to critical risk, and that employees are entering sensitive data into AI tools on average once every three days. A significant shadow IT dimension is documented: 32.3% of ChatGPT usage and 24.9% of Gemini usage occurs through personal accounts rather than corporate-managed accounts, placing that activity outside enterprise data governance controls. For compliance teams, the findings underscore a structural gap between the pace of AI adoption and the maturity of data loss prevention, acceptable use policies, and third-party risk management programs. Organizations lacking visibility into AI tool usage at the endpoint level may face exposure under data protection obligations in multiple jurisdictions, including the EU AI Act, various US state privacy laws, and sector-specific regulations governing sensitive data handling.

Cyberhaven ChatGPT Gemini OpenAI Google EU AI Act EU United States shadow IT data governance data loss prevention third-party risk management transparency enterprise AI risk