Shadow AI And PII: The Breach Risk Many Companies Are Overlooking

Most companies have spent years preparing for traditional cybersecurity incidents. A growing number now face a different kind of exposure: employees entering sensitive business or personal information into unapproved artificial intelligence tools. This practice, often called shadow AI, can create serious legal and operational risk. If those tools receive personally identifiable information (PII), confidential business records, or regulated data, the result may be an unintended disclosure event with consequences that look very similar to a traditional third party data breach.

Why Shadow AI Creates Legal Risk 

Many publicly available AI tools reserve broad rights in their terms of use to process submitted information for model training, product improvement, or other internal purposes. Once employees input sensitive data into those tools, a company may lose control over how that information is stored, used, or disclosed. The underlying risk is not hypothetical. CB Financial Services, Inc. disclosed on May 5, 2026, that an unauthorized AI software application exposed sensitive customer information, and that the company reported the matter as material in an SEC Form 8-K. For public companies, that means shadow AI may raise more than privacy and consumer protection concerns. Depending on the facts, it may also trigger cybersecurity governance, incident response, and public disclosure obligations.

Common Exposure Points 

Shadow AI problems usually do not begin with a hacker or a system intrusion. They start with an employee using a public AI tool to summarize an email, draft a customer response, analyze a spreadsheet, or upload internal documents for convenience. Even routine workflows can create risk if the underlying content includes PII, confidential information, or other restricted data. A company can therefore face a reportable exposure event without experiencing a conventional network compromise.

Practical Steps Companies Should Take Now 

Companies assessing shadow AI risk should: 

• Adopt an AI acceptable-use policy that identifies approved tools, features, and use cases.

• Prohibit the entry of PII, confidential information, and other restricted data into unapproved AI tools and platforms. 

• Classify data so employees understand what can and cannot be used with external AI systems. 

• Update employee training to address AI-specific misuse scenarios, including AI features embedded in ordinary workplace software. 

• Review vendor terms and negotiating restrictions on model training, secondary use, and disclosure of submitted data. 

• Incorporate AI tools into cybersecurity, privacy, and vendor-risk assessments. 

• Conduct periodic audits to identify unauthorized AI use and test compliance with internal policies – do not rely on vendor provided certifications.

• For public companies, integrate shadow AI into cybersecurity governance and materiality review processes.

Why This Matters Now 

AI adoption often moves faster than internal policy, legal review, and contract controls. That gap can leave companies exposed to privacy incidents that do not fit the traditional breach model but can still create many of the same downstream consequences. Organizations that address shadow AI early are generally better positioned to reduce inadvertent disclosures, strengthen internal controls, and respond effectively when questions arise about how employee-used AI tools handle sensitive information.

Suggested Call to Action 

If your organization is evaluating AI governance, privacy exposure, or vendor terms for employee-facing AI tools, legal review can help identify hidden risk areas before they become reportable incidents.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.