The EU AI Act now holds organizations responsible for AI tools their vendor risk process never saw coming. A Samsung engineer pasted proprietary source code into ChatGPT in March 2023, and two colleagues did similar things within 20 days - none of them thought they were adding a vendor, and Samsung's vendor risk program had no record of the tool because nothing about typing a question into a chatbot resembled procurement.
The gap has not closed. It has widened, and most AI vendor risk management programs still are not built to catch it. A shadow AI tool does not need a contract to create vendor-level risk. It needs your data, and most of them already have it.
What makes shadow AI different from a shadow vendor
Third-party risk management already knows this problem. Someone signs up with a third party that never went through procurement, and the vendor risk program never finds out. Shadow AI is that same problem under a new name. The difference is what people do once they're in. An AI writing tool, a coding assistant, a chatbot - all of them invite the user to paste in exactly the confidential data a formal vendor review exists to protect.
Vendor risk management was built around a single moment: a signature. Procurement logs the vendor, a risk tier gets assigned, and a review cadence begins. Shadow AI skips that moment entirely, which is why it feels new even though the underlying question - who is touching our data - is not new at all.
Three doors that skip vendor review
AI tools enter an organization through three doors that skip vendor review entirely. Shadow sign-ups happen when an employee subscribes to an AI tool directly. Feature flips happen when an already-approved vendor turns on a new AI capability inside a product you already trust. Business-unit integrations happen when a team connects an AI feature to existing software on its own.
Door one, the shadow sign-up, looks exactly like the Samsung case. No one signed anything. There was no vendor record to tier, no contract to review, and no monitoring assigned. Door two, the feature flip, is quieter. Zoom auto-enabled its AI Companion for meeting hosts on July 25, 2024, and again on September 13, 2024, giving admins roughly four days' notice each time to opt out. Nothing about the vendor relationship changed on paper. But the moment that feature started drafting meeting summaries, a new question existed that no one had been assigned to answer.
Door three, the business-unit integration, is the one most likely to touch a customer directly. A sales team connects a generative AI plug-in to the CRM to draft outreach emails. IT never approved it. Procurement never saw it. The moment that plug-in starts writing something a customer receives, it has crossed into territory the EU AI Act already regulates.
The cost of missing all three compounds quickly. Breaches involving unauthorized AI tools cost organizations $670,000 more on average than other breaches - $4.63 million versus $3.96 million - and take longer to detect: 247 days versus 241, according to IBM's 2025 Cost of a Data Breach Report. Mitratech's December 2025 research found most organizations assess fewer than 100 vendors for AI risk, and many do not require any vendor to disclose its AI governance policies at all.
What the EU AI Act requires right now
Two separate obligations get treated as one, and the difference matters. Article 26's deployer duties - monitoring a high-risk system, reporting incidents, keeping six months of logs - now apply from December 2, 2027, after the EU's Digital Omnibus pushed back the original date. Article 50's disclosure duties took effect on schedule, August 2, 2026, and apply the moment AI creates content or talks to a customer.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026, six days before the original deadline, and deferred Article 26's obligations for standalone high-risk systems by 16 months. Several obligations stayed on schedule regardless: Article 50's transparency duties, the general-purpose AI provider obligations in force since August 2025, and the prohibited-practices regime in force since February 2025. If a sales team's CRM plug-in is generating outreach a customer reads, that is not a high-risk monitoring question. It is a disclosure question, and the clock on it did not move.
Where AI governance and third-party risk overlap
AI governance and third-party risk management run as separate programs at most organizations, but the frameworks that govern them do not draw that line. The EU AI Act, NIST's AI RMF, and ISO 42001 all treat a vendor's AI use as squarely in scope. NIST's AI Risk Management Framework addresses this directly under Govern 6.1, third-party AI policy, and Govern 6.2, contingency planning for third-party AI failures.
Most vendor contracts signed before a vendor added AI features say nothing about how that AI handles data, who trained it, or what happens if it fails. Ask what happens if a vendor's AI feature produces something wrong on a customer's behalf, and most compliance teams do not have an answer. The contract was signed before the question existed. A vendor risk assessment that stops at security and financial stability is answering yesterday's question. The same evidence that feeds a vendor risk record - what the vendor does, whose data it touches, what happens if it fails - is exactly what an AI governance review needs to know about that same vendor. Treating them as two separate reviews means asking a vendor the same underlying questions twice, or asking once and hoping it covers both.
Five changes that close the gap
Closing this gap does not require a new team or new software built to watch for AI. It requires redefining what triggers a vendor review, and adding one new question to the reviews already running. Five changes handle most of it before your next renewal cycle.
- Review existing vendor contracts to confirm they have appropriate coverage for AI-specific risk, starting with your highest-risk vendors.
- Redefine what triggers an intake review, so a subscription or an integration triggers the same immediate reassessment a signed contract would.
- Set a reassessment cadence tied to risk tier, so an approved vendor's new feature re-triggers review instead of aging quietly for a year.
- Confirm your log retention meets the six-month standard Article 26 will eventually require, and the disclosure practice Article 50 already does.
- Add one question to every vendor questionnaire: does this vendor use AI to process our data, and what changes when it does.
None of this requires a new program. It requires treating the front door as wide as the vendors are actually using it. Mitratech's research found organizations rate their confidence managing third-party AI risk at 2 to 3 out of 5. That number describes how mature a program feels. It does not explain why AI keeps getting in anyway. For AI for Management professionals, the structural fix is not a separate AI governance overhaul - it is making vendor intake notice what is already walking through.
Why this matters for management
The fastest way to find out how many unreviewed AI vendors your organization already has is to pull expense reports for AI-related subscriptions, ask three business units what they have connected to their CRM or ticketing system in the last year, and compare both lists against your vendor record. Most companies are surprised by how short that vendor record looks next to the other two. The EU AI Act's Article 50 disclosure duties are already in force, and they apply the moment AI creates content a customer sees - regardless of when Article 26's monitoring deadline arrives. The gap that let a shadow AI tool in without a review did not move. Fixing the front door is a management decision, not a software purchase.
Your membership also unlocks:
