Your employees are trying to be more productive. That is a good thing. But the tools they are reaching for, the AI-powered meeting summarizers, the spreadsheet analyzers, the browser extensions that draft investor briefs in seconds, may be quietly creating one of the most significant regulatory exposures your company faces right now.
It is called “Shadow AI,” and it is not just an IT headache. For financial institutions and the businesses that serve them, it is a direct path to regulatory liability under the FTC’s GLBA Safeguards Rule.
What Shadow AI Actually Looks Like
Shadow AI is not the sinister-sounding technology its name implies. It is an employee pasting a customer account summary into ChatGPT to draft a talking-points memo. It is a financial analyst uploading a client portfolio spreadsheet into a free-tier AI tool to generate trend analysis. It is a sales manager using an embedded AI assistant inside a video conferencing platform to auto-generate meeting notes that include client names, account numbers, and loan details.
The behavior is widespread and growing. A 2024 survey of more than 7,000 workers across seven countries found that 38% of employed respondents who use AI tools have submitted sensitive work-related information to AI platforms without their employer’s knowledge. A separate 2024 survey of 6,000 knowledge workers found that half of all employees are, by definition, Shadow AI users, and 46% said they would continue using AI tools even if their employer banned them. Research firm Cyberhaven tracked a 485% increase in corporate data pasted into AI tools between March 2023 and March 2024, with 27.4% of that data classified as sensitive.
I am personally aware of a scenario in which new employees entered sensitive information into ChatGPT to help them learn their jobs. The lack of training and controls has now opened that company to serious data privacy issues.
Among the data categories employees are sharing: financial records (31.2% of sensitive data), client information (24.7%), and legal documents. These are not abstract statistics. For a financial institution, this is your customers’ nonpublic personal information (NPI), the precise category of data that federal law requires you to protect. Ask yourself, do you know what information your employees are sharing with AI?
The Regulatory Framework You May Already Be Violating
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect the NPI of their customers. The FTC’s Safeguards Rule, substantially updated in 2021 and expanded further through 2024, translates that obligation into specific, auditable requirements. Critically, the Safeguards Rule applies not just to banks. It covers a broad range of nonbank financial institutions: mortgage brokers, auto dealers that arrange financing, insurance companies and brokerages, investment advisors, tax preparers, fintech companies, payday lenders, and many others.
When an unmonitored AI tool ingests your customer records, you are likely running afoul of at least three specific regulatory obligations.
Access Controls (16 C.F.R. § 314.4(c)(1))
The Safeguards Rule requires covered entities to implement access controls to “authenticate and permit access only to authorized users” and to “limit authorized users’ access only to customer information that they need to perform their duties and functions.” A third-party AI platform is, by definition, not an authorized user of your customer’s NPI. When an employee uploads that data, your access control framework has failed, not because of a hacker, but because of a well-intentioned productivity choice.
Activity Logging (16 C.F.R. § 314.4(c)(8))
The Rule also requires covered entities to implement “policies, procedures, and controls designed to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information.” If your employees are using personal accounts on free AI platforms, and research shows that 73.8% of ChatGPT usage in enterprise environments occurs through personal accounts, your logging and monitoring systems have no visibility into that activity. You cannot monitor what you cannot see, and what you cannot see creates presumptive liability.
Service Provider Oversight (16 C.F.R. § 314.4(f))
The Safeguards Rule explicitly requires financial institutions to oversee their service providers by selecting only providers capable of maintaining appropriate safeguards and requiring those providers, by contract, to implement protective measures. An AI tool that an employee downloaded without IT approval has no vendor contract, no security assessment, and no GLBA-compliant data handling agreement. That tool is functionally a shadow service provider, and your organization bears responsibility for its access to your customer data.
The Notification Clock Is Already Ticking
Here is where the stakes become acutely concrete for senior leaders.
In October 2023, the FTC amended the Safeguards Rule to add a breach notification requirement. As of May 13, 2024, covered financial institutions must notify the FTC within thirty (30) days of discovering a security breach, defined as the unauthorized acquisition of unencrypted customer information, involving the data of 500 or more consumers. There are no exceptions for breaches that are unlikely to cause consumer harm. There are no exceptions for breaches involving less sensitive information categories.
Critically, the rule presumes unauthorized acquisition has occurred any time there is unauthorized access to unencrypted customer information, unless the institution can prove otherwise. If an employee pastes 600 customer records into an AI tool operating through a personal account with no enterprise data handling agreement, and you discover that fact, you are arguably looking at a notification event and a 30-day countdown. There are also state-level data breach laws that could require you to disclose the information to the customer, the attorney general’s office, and the national credit bureaus.
Why “We Didn’t Know” Is Not a Defense
For executives who are tempted to treat this as an IT department problem, consider the Safeguards Rule’s governance requirements carefully.
The amended rule requires covered institutions to designate a single “Qualified Individual” (QI) to oversee and implement the information security program. In my opinion, the QI requirement is one of the most ignored legal requirements. That person must report in writing to the board or senior governing body at least annually. The board or senior leadership is expected to review and approve that report. Oversight is not delegated; it is owned at the leadership level.
This creates direct accountability for executives and board members when Shadow AI incidents occur. “We didn’t know” is not a defense when the regulatory framework required you to have a program in place to detect, prevent, and respond to exactly this kind of unauthorized access. The question regulators will ask is not whether you had perfect visibility, but whether your information security program, including your service provider oversight, your access controls, and your employee training, was reasonably designed to prevent this kind of data exposure.
It was not, if AI tools are running unchecked across your enterprise.
What Executives Should Do Right Now
The good news is that this is a solvable problem. Shadow AI proliferates because employees have real productivity needs, and legitimate AI tools that meet those needs have not been sanctioned and deployed. The governance gap is as much a business problem as it is a legal one.
Here is a practical framework for closing it:
- Conduct a Shadow AI audit. You cannot govern what you cannot see. Network monitoring tools can detect traffic to AI platforms. Employee surveys, conducted with care and an amnesty period for voluntary disclosure, can surface current usage patterns. Your IT team likely already knows more than leadership does about where AI tools are in use.
- Classify your data before you govern your tools. The Safeguards Rule’s access control and logging obligations tie back to customer information. You need a current, accurate data classification policy that distinguishes regulated NPI from general business data. That classification governs which AI tools may, and may not, interact with which data categories.
- Vendor-vet and contract your approved AI tools. Every AI tool that touches customer data must be evaluated as a service provider under the Safeguards Rule. That means security assessments, written data handling agreements, and contractual commitments to implement GLBA-compliant safeguards. Many enterprise AI platforms can satisfy these requirements, but they must be formally engaged, not casually adopted.
- Retrain employees with specificity. General cybersecurity training is not enough. Employees need to understand which specific data categories are regulated, what tools are and are not approved, and what the consequences of Shadow AI usage are, for the company and for them personally. The Safeguards Rule’s training requirements call for instruction that is both role-appropriate and periodically updated.
- Test your incident response plan against this scenario. Your plan was likely written with external hackers in mind. Run a tabletop exercise built around a Shadow AI data leakage scenario and map your response against the 30-day FTC notification window and the four-business-day SEC disclosure clock. If your plan cannot respond within those timelines, you have a gap that regulators will find before you do.
The Bottom Line
The GLBA Safeguards Rule was designed for a world where the primary threat to customer data came from outside the organization. The Shadow AI problem is an inside threat that looks like productivity. That combination, well-intentioned employees, powerful tools, and unmonitored data flows, is precisely the kind of risk that the 2021 and 2023 amendments to the Safeguards Rule were designed to address.
The regulatory framework already anticipates the problem. What it requires is that your organization’s governance program anticipate it too. The cost of closing that gap is manageable. The cost of discovering you failed to close it, measured in FTC notification obligations, civil penalties, and the reputational consequences of a customer data incident, is not.
Your employees are not trying to create a compliance crisis. But without executive-level governance of AI tools, that is exactly what they may be building, one meeting summary at a time.
