How to Report Shadow AI Risk to Your Board

If you are the CCO, COO or managing partner of an RIA, broker-dealer or insurance agency, your annual security report probably says little about the AI tools staff signed up for on their own. Shadow AI risk belongs in that report, framed as exposure, decisions and trend that directors can weigh.

Why does shadow AI risk belong in a board report?

Shadow AI risk belongs in a board report because unapproved AI tools are an unmanaged path for customer information to leave the firm, and boards are expected to oversee that kind of risk. The Gramm-Leach-Bliley Act calls for safeguards that protect the security and confidentiality of customer records and guard against unauthorized access (15 U.S.C. 6801(b)). An AI tool nobody approved, holding client data under consumer terms, sits squarely inside that obligation.

Shadow AI also changes quickly. One quarter's discovery pass might turn up a few browser extensions; the next might turn up AI agents connected to mailboxes. Directors cannot weigh that from a list of app names. They need the findings translated into exposure, decisions and trend.

Which rules require a written security report to the board?

It depends on who regulates the firm. The FTC Safeguards Rule, the NAIC Insurance Data Security Model Law in states that adopted it, and the federal banking guidelines (12 CFR part 364, Appendix B) each call for a written report at least annually. Regulation S-P, which covers SEC-registered advisers and broker-dealers, does not itself require a board report, though many firms report to a board or management committee anyway. For the rule-by-rule detail, see does GLBA require an annual security report to your board.

• FTC Safeguards Rule: 16 CFR 314.4(i) requires the Qualified Individual to report in writing, regularly and at least annually, to the board or, if there is none, a senior officer. The report covers the overall status of the program and material matters such as risk assessment, risk management and control decisions, service provider arrangements, testing results, security events and management's responses, and recommended changes.
• Insurance agencies: Section 4E of the NAIC model law requires executive management to report in writing at least annually where the licensee has a board. It binds only in states that adopted it; as of August 2025 the NAIC counted 28 adopting jurisdictions, and California was not one of them. Licensees with fewer than ten employees, including independent contractors, are exempt from Section 4.
• SEC-registered firms: Regulation S-P (17 CFR 248.30) requires written policies and procedures to safeguard customer information, including an incident response program. It does not prescribe a board report, so reporting to the board is a governance choice.

Whichever applies, shadow AI fits under risk assessment and control decisions. Section 314.4(b) of the FTC rule bases the program on a written risk assessment that identifies reasonably foreseeable internal and external risks to customer information, and unapproved AI is now one of those risks. Our guide to updating a GLBA risk assessment for AI and SaaS covers how to add it.

What should the shadow AI section of the report include?

Six items cover it: scope, counts, data exposure, dispositions, incidents and open decisions. Keep the section to one or two pages.

• Scope and method: the period covered and the sources used, such as identity provider sign-in logs, third-party app consents, browser extension inventories, web filter data and expense reports.
• Counts and trend: unapproved AI tools found, users involved by department or role, and the change since the last report.
• Data exposure: for each material finding, which categories of customer information the tool could reach and whether it ran on a consumer or business account.
• Dispositions: how many tools were blocked, approved after vendor review, or accepted as time-limited exceptions with a named owner.
• Incidents: whether any finding involved actual disclosure of customer information, and whether it was handled under the incident response program.
• Open decisions: risks that need board input, such as accepting a residual risk, funding approved AI licenses or adopting an updated AI policy.

How do you make shadow AI risk readable for a non-technical board?

Rate each finding on two plain questions: what data could the tool reach, and who controls the account? A free AI notetaker on a personal account that joins client meetings carries far more risk than a grammar extension on a managed laptop with no file access.

A three-level rating of high, medium and low built from those two questions is enough. Refer to roles instead of names so the discussion stays on controls. If the firm already uses NIST CSF 2.0, its Govern function gives the board a shared vocabulary for setting risk strategy, expectations and policy and monitoring how they are carried out.

What decisions should the board make?

The board should decide whether to accept specific residual risks, approve the AI acceptable use policy, set the reporting cadence, and fund business-grade AI tools where staff use personal accounts because no approved option exists. Each item should reach the meeting as a clear yes or no question.

Record each decision in the minutes and link it to the finding it addresses. Next year's report can then show what changed as a result, which is evidence of oversight in its own right.

What mistakes make a shadow AI report less useful?

Most weak reports fail in one of five ways:

• Listing app names with no data context.
• Treating every sign-up as a breach. Discovery is a control doing its job, and most findings are policy issues.
• Presenting a one-time snapshot with no trend line.
• Naming individual employees in a board document.
• Leaving out AI features built into software the firm already licenses.

What should you do this quarter?

This quarter, run a discovery pass, rate and close what you find, and draft the report section before your next board meeting. Work backward from that date:

• Run a shadow AI discovery pass using sign-in logs, app consents, extension inventories and expense data (how to discover shadow AI from sign-in and spend data).
• Rate each finding by data reach and account control.
• Close what you can: block, approve, or record an exception with an owner and an expiry date. If personal accounts are the main finding, see how to block personal AI accounts on firm devices.
• Draft a one to two page section using the six items above.
• Confirm which board reporting rule, if any, applies to your firm and when the next report is due.
• Put the decisions you need on the board agenda in advance.

How can s90 help?

s90 runs new-app alerts and AI guardrails that surface unapproved AI tools as they appear, and we turn those findings into a plain-language summary leadership can act on. We can help you rate findings, track dispositions and assemble the evidence behind your annual report. This article describes what the rules require and is not legal advice. If a board meeting is coming up, a short call is a good place to start.