In a recent New York Law Journal article, Harter Secrest & Emery partners F. Paul Greene and Margaret K. Rhoda examined the growing compliance, cybersecurity, and disclosure risks associated with the use of unsanctioned generative AI tools, commonly known as “Shadow AI.”
Greene explained that organizations cannot effectively assess or manage cybersecurity risks when employees use unknown AI applications to process company data, emphasizing the regulatory expectation that businesses understand where and how sensitive information is being stored, transmitted, and processed.
Rhoda highlighted that the use of personal or self-learning AI platforms can create significant legal exposure, potentially triggering state data breach notification requirements, SEC cybersecurity disclosure obligations, and HIPAA reporting duties when regulated information is improperly disclosed. Drawing on recent regulatory developments, including the first known public company disclosure of a cybersecurity incident related to unauthorized AI use, they explained that shadow AI incidents may be considered material even when they do not result in significant financial harm.