The Vendor Risk Nobody Signed Off On: Shadow AI in Your Supply Chain

Shadow AI is the use of AI tools, models, or agents inside a company without the knowledge or approval of IT or security teams. Companies have faced the challenge of dealing with shadow IT for years, due to employees quietly using unapproved software.

Old shadow IT tools mostly just stored or moved your data around. Shadow AI tools process it, read it, generate new outputs from it, and in a lot of cases retain it to improve somebody else's model down the line. That is a fundamentally different kind of exposure.

Employee access to AI tools jumped by 50% over the past year alone. Despite this only about one in five companies has anything like a mature AI security governance model for these tools, especially the more autonomous, agent-style ones. In practice, this risk shows up in ordinary moments: an employee pasting customer data into a free AI chatbot, or a support team dropping tickets into a translation tool, just to get through the day faster.

For example, you approve a vendor to manage customer support data. Months later, the vendor introduces AI-powered analytics feature that relies on an external AI model provider. Customer data is now being processed by a fourth party that was never reviewed during due diligence, creating new security, privacy, and compliance risks.

This is how shadow AI often enters an organization: through trusted vendors, not only by unauthorized tools.

Hidden Fourth-party Risks

Even approved AI vendors often depend on other AI providers behind the scenes. This can introduce hidden fourth-party risks, where organizations unknowingly rely on AI services they have neither assessed nor approved.

This is fourth-party risk in its purest form, and it is a growing blind spot precisely because a conventional vendor questionnaire was never built to ask, "and what does your AI vendor do with our data?" Regulators are starting to notice this gap too. FINRA's 2026 guidance specifically calls for ongoing due diligence into vendors' generative AI use, inventories of vendor technology touching firm data, and explicit consideration of fourth-party exposure, because point-in-time reviews can't keep pace with how quickly vendor products change.

Why the TPRM Playbook Misses Shadow AI Risks

Traditional third-party risk management (TPRM) was built around a stable assumption: you assess a vendor once, revisit annually, and in between, nothing fundamental changes about what that vendor does with your data. AI has quietly broken that assumption in two directions simultaneously.

First, speed. New AI tools and integrations are appearing far faster than any security team can manually review them, and even a vendor you approved last year can change without triggering anything resembling a formal reassessment. Risk is often introduced through what seems like a routine release. This includes new AI features, new sub processors, and new dependencies on other AI products.

Second, invisibility. Shadow AI usage, almost by definition, does not show up in procurement records, because it was never procured through the normal channel in the first place. Employees adopt free tiers, personal accounts, or tools paid for on a personal card. This lies completely outside the process that would normally bring a vendor through formal review and risk assessment. Unsanctioned AI tools now show up in half of security incidents, and their usage has climbed fast enough that it is now one of the more common non-malicious insider actions security teams see in their data-loss-prevention systems.

How to Tackle This Challenge

The encouraging part is that none of this requires reinventing TPRM from scratch. It mostly requires extending it to ask questions it never used to ask and doing so more continuously than once a year.

A few things that are proving genuinely useful in practice:

• Cross-Functional AI Governance: Aligning TPRM, cybersecurity, privacy, legal, and AI governance teams to ensure clear ownership, accountability, and oversight of third-party AI risks.
• Build an actual AI vendor registry. Not a procurement list: This entails building a real inventory of every AI tool touching company data, including free tiers and tools that individuals signed up for personally. Organizations that do this formally tend to uncover more third-party AI exposure than the ones relying on procurement records alone, since so much of this usage never went through procurement in the first place.
• Update vendor questionnaires to actually ask about AI:  Data handling practices, model training policies, data retention timelines, and whether the vendor embeds any third-party AI models or APIs of its own. None of this was standard TPRM language even a couple of years ago, and most legacy questionnaires still don't ask it.
• Treat "approved vendor adds an AI feature" as a trigger event: This is not something to file with the next annual review. If a vendor's product changes meaningfully, new AI capability, new sub-processor, or a new data flow, it should kick off a fresh look, not wait twelve months.
• Get comfortable with continuous monitoring over one-time sign-off: Point-in-time assessments simply cannot keep pace with how quickly AI-embedded products evolve. The organizations overseeing this best have accepted that vendor risk, and especially AI-related vendor risk, is something to watch continuously rather than certify once and move on.
• Update contracts going forward: Do this even if it feels premature. Adding explicit AI-use clauses such as covering model training, data retention, and sub-processor disclosure into standard vendor agreements is a lot easier than trying to renegotiate them later, after a vendor has already quietly shipped an AI feature nobody asked about.

At LTM, we believe shadow AI and fourth-party AI risk should be assessed as part of third-party and fourth-party risk management, rather than as a standalone technology issue. Organizations should embed AI transparency into existing TPRM processes by requiring vendors to have visibility, disclose AI usage, downstream dependencies, and material AI-related changes. This enables continuous assessment and governance of AI risks while supporting innovation in a transparent, controlled, and risk-informed manner.

Conclusion

Shadow AI is no longer just an IT concern. As AI becomes embedded in third-party services, organizations risk losing visibility into how their data is used and who is processing it. The answer is not to slow innovation, but to strengthen governance. By continuously monitoring AI use across the vendor ecosystem, organizations can embrace AI's benefits while ensuring transparency, accountability, and alignment with their risk appetite.

References

• The Invisible Expansion of the Attack Surface: Shadow AI, MCP, and Third-Party Risk. Bitsight. https://www.bitsight.com/blog/shadow-ai-and-the-expanding-attack-surface
• The AI You Didn't Approve: The Auditor's Role in Managing Hidden Vendor Risk. EisnerAmper. https://www.eisneramper.com/insights/risk-compliance/auditors-role-in-managing-hidden-vendor-risk-0826/
• 4 Lessons From the 2026 Verizon DBIR. Nudge Security. https://www.nudgesecurity.com/post/what-the-2026-dbir-reveals-about-risks-from-shadow-ai-and-saas-sprawl
• What Is Shadow AI? How It Happens and What to Do About It. Palo Alto Networks. https://www.paloaltonetworks.com/cyberpedia/what-is-shadow-ai
• What Is Shadow AI? Risks, Governance, & How to Take Control. Wiz. https://www.wiz.io/academy/ai-security/shadow-ai
• Understanding Shadow AI and How to Protect Against It. Ampcus Cyber. https://www.ampcuscyber.com/knowledge-hub/what-is-shadow-ai-risks-challenges-prevention-strategies/
• AI Vendor Risk Management: Complete TPRM Guide 2026. LearnTPRM. https://blog.learntprm.com/2026/04/26/ai-vendor-risk-management-tprm-guide-2026/
• Shadow AI Statistics and Risks 2026 Guide. Questa AI. https://www.questa-ai.com/privacy-cafe/shadow-ai-the-biggest-data-risk-in-2026
• Shadow AI & Purpose Creep: Auditing Privacy Risks in Your Data Supply Chain. Optro. https://optro.ai/blog/shadow-ai-purpose-creep-privacy-risks
• Shadow AI in 2026: The Enterprise Risk and Governance Guide. Seimless. https://www.seimless.com/shadow-ai-2026-enterprise-playbook/