Shadow AI Data Risks

EU institutions are actively addressing emerging AI-related risks, particularly concerning "Shadow AI" and the broader impact of advanced models on critical sectors. The European Data Protection Supervisor (EDPS) has already warned organisations about employees using unauthorised AI tools, highlighting the significant data breach risks when sensitive information is fed into these platforms. Concurrently, the European Systemic Risk Board (ESRB), supported by the EBA, EIOPA, and ESMA, issued a formal warning on AI's potential to strain cyber resilience and threaten financial stability. These proactive warnings underscore a coordinated effort to preempt widespread vulnerabilities.

This matters immensely for both citizens and businesses. For citizens, the integrity of their personal data is at stake, alongside the stability of their financial services, as banks and insurers increasingly deploy advanced AI. Businesses face not only potential data breaches from unapproved internal AI use but also systemic cyber risks that could disrupt operations and compromise trust. The EBA, EIOPA, and ESMA are calling for financial institutions to enhance internal governance and risk management, a pre-emptive move to safeguard against systemic risks as AI adoption accelerates.

Looking ahead, this strong regulatory focus signals a push towards more robust frameworks and consistent supervision. The warnings from the ESRB and the financial supervisors suggest potential policy actions are on the horizon, moving beyond guidance to possibly new regulations or amendments within existing frameworks like the AI Act. The aim is clearly to mitigate emerging threats, ensure responsible AI deployment, and maintain financial stability and data protection across the Union.