Shadow AI and PII: The Breach Risk Many Companies Are Overlooking
Most companies have spent years preparing for traditional cybersecurity incidents. A growing number now face a different kind of exposure: employees entering sensitive business or personal information into unapproved artificial intelligence tools. This practice, often called shadow AI, can create serious legal and operational risk. If those tools receive personally identifiable information (PII), confidential business records, or regulated data, the result may be an unintended disclosure event with consequences that look very similar to a traditional third party data breach.
Why Shadow AI Creates Legal Risk
Many publicly available AI tools reserve broad rights in their terms of use to process submitted information for model training, product improvement, or other internal purposes. Once employees input sensitive data into those tools, a company may lose control over how that information is stored, used, or disclosed. The underlying risk is not hypothetical. CB Financial Services, Inc. disclosed on May 5, 2026, that an unauthorized AI software application exposed sensitive customer information, and that the company reported the matter as material in an SEC Form 8-K. For public companies, that means shadow AI may raise more than privacy and consumer protection concerns. Depending on the facts, it may also trigger cybersecurity governance, incident response, and public disclosure obligations.
Common Exposure Points
Shadow AI problems usually do not begin with a hacker or a system intrusion. They start with an employee using a public AI tool to summarize an email, draft a customer response, analyze a spreadsheet, or upload internal documents for convenience. Even routine workflows can create risk if the underlying content includes PII, confidential information, or other restricted data. A company can therefore face a reportable exposure event without experiencing a conventional network compromise.
Practical Steps Companies Should Take Now
Companies assessing shadow AI risk should:
Adopt an AI acceptable-use policy that identifies approved tools, features, and use cases.
Prohibit the entry of PII, confidential information, and other restricted data into unapproved AI tools and platforms.
Classify data so employees understand what can and cannot be used with external AI systems.
Update employee training to address AI-specific misuse scenarios, including AI features embedded in ordinary workplace software.
Review vendor terms and negotiating restrictions on model training, secondary use, and disclosure of submitted data.
Incorporate AI tools into cybersecurity, privacy, and vendor-risk assessments.
Conduct periodic audits to identify unauthorized AI use and test compliance with internal policies – do not rely on vendor provided certifications.
For public companies, integrate shadow AI into cybersecurity governance and materiality review processes.
Why This Matters Now
AI adoption often moves faster than internal policy, legal review, and contract controls. That gap can leave companies exposed to privacy incidents that do not fit the traditional breach model but can still create many of the same downstream consequences. Organizations that address shadow AI early are generally better positioned to reduce inadvertent disclosures, strengthen internal controls, and respond effectively when questions arise about how employee-used AI tools handle sensitive information.
Suggested Call to Action
If your organization is evaluating AI governance, privacy exposure, or vendor terms for employee-facing AI tools, legal review can help identify hidden risk areas before they become reportable incidents.
Klemchuk stands ready to assist its clients in crafting AI use policies and in analyzing AI tool agreements.
For more information about shadow AI data breach risk, see our data breach and hacking services practice page.
Klemchuk PLLC is a leading IP law firm based in Dallas, Texas, focusing on litigation, anti-counterfeiting, trademarks, patents, and business law. Our experienced attorneys assist clients in safeguarding innovation and expanding market share through strategic investments in intellectual property.
This article is provided for informational purposes only and does not constitute legal advice. For guidance on specific legal matters under federal, state, or local laws, please consult with our IP Lawyers.
© 2026 Klemchuk PLLC | Explore our services