|
You’re not behind on AI. You just haven’t started. (Sponsor)
 |
Feeling behind on AI is the default mood right now. Building something with it shouldn’t be. Bolt.new turns “I should probably learn this” into a working app by dinner. Type in your messiest business problem... the lead tracker you keep meaning to set up, the onboarding flow you’re still doing by hand... and watch it come together. No tutorials, no setup, no AI degree required.
For years, enterprise software buyers relied on a simple assumption: if it’s not written in the contract, it’s probably not happening.
That assumption is starting to break.
A new 2026 report from privacy platform DataGrail delivers a troubling message to companies racing to adopt AI-powered software: the vendor you approved may already be sharing customer data with AI systems you never evaluated, never signed off on, and may not even know exist.
The finding sounds dramatic, but the numbers behind it are hard to ignore. After analyzing 2,400 software providers, DataGrail found that nearly 64% of vendors advertising AI capabilities failed to disclose third-party AI subprocessors in their legal agreements. In plain English: companies buying AI-enabled tools may believe they understand where their data goes, while in reality, it may be flowing through multiple unseen AI pipelines behind the scenes.
And if that’s true, one of enterprise privacy’s most foundational safeguards—the Data Processing Agreement (DPA)—may no longer be enough.
The contract problem nobody expected
Traditionally, the DPA has been the trust layer of enterprise software procurement. Security, legal, and compliance teams examine these agreements to understand exactly how vendors process customer data, who touches it, and what risks exist.
But AI is changing the equation.
Software companies are evolving into AI companies almost overnight. Features once powered by internal logic are now routed through large language models, external APIs, copilots, embeddings, and agent frameworks. Vendors are adding intelligence faster than governance processes can document it.
The result is a widening gap between what contracts say and what products actually do.
According to DataGrail, researchers didn’t stop at reading legal documents. They cross-checked vendor claims against GitHub environments, API connections, product documentation, integrations, and marketing materials. In some cases, a DPA referenced one AI provider, while product documentation suggested multiple external AI systems operating behind the scenes.
That distinction matters more than many executives realize.
Imagine a recruiting platform that claims to use one vetted AI model. Your legal team reviews the risks, procurement signs off, and HR begins processing thousands of resumes. Months later, you discover the vendor quietly routes portions of candidate data through several additional models that were never evaluated internally.
Now sensitive information—employment history, financial details, even protected personal data—has been processed by systems your company never formally approved.
This is not merely a governance issue. It is a liability issue.
Shadow AI is becoming an enterprise tax
The term “shadow AI” usually refers to employees secretly using tools like ChatGPT or unauthorized copilots. But DataGrail’s findings suggest something more unsettling: shadow AI may already be embedded inside approved enterprise software.
That changes the conversation entirely.
Because unlike rogue employee behavior, vendor-level AI exposure is invisible. Procurement teams may believe controls are in place when, in practice, those controls were outdated the moment a vendor quietly shipped an AI feature update.
IBM’s 2025 breach data already suggests the cost of unmanaged AI risk is measurable. Organizations with high levels of shadow AI reportedly face breach costs hundreds of thousands of dollars higher than organizations with tighter oversight.
In other words, AI governance failures are beginning to show up on balance sheets.
And regulators are paying attention.
Privacy regulation is moving faster than companies think
For years, privacy compliance felt like something large tech companies worried about while everyone else watched from the sidelines.
That era appears to be ending.
State-level privacy enforcement in the U.S. has accelerated dramatically, with billions in fines issued in 2025 alone. California, in particular, is becoming a blueprint for aggressive enforcement around consent, tracking, and automated decision-making.
What makes this especially relevant to AI is that many of the highest-risk use cases—automated hiring, customer scoring, personalization, and sensitive data analysis—now intersect directly with privacy law.
The challenge for enterprises is straightforward but uncomfortable: you cannot govern risks you cannot see.
And if vendor documentation is incomplete, businesses may unknowingly violate obligations tied to automated decision systems or sensitive data processing.
For CIOs, CISOs, legal teams, and privacy officers, the lesson is becoming painfully clear: vendor trust can no longer stop at the contract.
Why this matters beyond privacy teams
It is tempting to frame this as a compliance problem.
It isn’t.
This is a business architecture problem.
Because AI systems are increasingly interconnected. One vendor feeds another. Models call APIs. Agents trigger downstream workflows automatically. Data no longer sits neatly inside a single application.
What begins as a harmless productivity feature could evolve into an invisible chain of AI subprocessors touching customer information across systems.
The bigger risk isn’t just hidden models.
It’s hidden dependencies.
And this becomes even more dangerous as agentic AI spreads across enterprise software. Gartner predicts a massive jump in task-specific AI agents over the next two years—systems capable of autonomously accessing information, making decisions, and coordinating actions without constant human approval.
If companies already struggle to track today’s AI subprocessors, tomorrow’s autonomous workflows could multiply that complexity exponentially.
The scary scenario is not one rogue chatbot.
It is an ecosystem of agents passing sensitive data across tools at machine speed while governance teams scramble to understand what happened after the fact.
But here’s the balanced reality: AI vendors are moving fast because customers demand it
There is an important nuance here.
Most vendors are not intentionally hiding AI risks.
They are operating inside an innovation cycle moving faster than traditional governance frameworks can keep up with.
Customers demand smarter features. Competitors race to release copilots. Investors reward AI roadmaps. Product teams integrate new capabilities in weeks, while legal reviews and do