VFF - The signal in the noise
VFF - The signal in the noise
News

Majority of AI Vendors Hide Subprocessors From Contracts

VentureBeat AI
Read original
Share
Majority of AI Vendors Hide Subprocessors From Contracts

A DataGrail analysis of 2,400 business software vendors found that 63.6% of those advertising AI capabilities do not disclose third-party AI subprocessors in their legal documentation. This means companies purchasing AI-enabled software may unknowingly expose customer data to undisclosed AI models and systems they never reviewed or approved. The finding highlights a critical gap between what vendors claim in contracts and what they actually deploy in production.

TL;DR

  • 63.6% of AI-enabled vendors fail to disclose third-party AI subprocessors in data processing agreements
  • DataGrail cross-referenced DPAs against product documentation, GitHub, API connections, and marketing materials to identify gaps
  • Organizations with high shadow AI exposure face average breach costs of $4.63 million, $670,000 more than those with low shadow AI
  • The disclosure gap creates compliance risk, particularly for automated decision-making in hiring and other regulated domains

Why It Matters

Data processing agreements are the primary legal mechanism enterprises use to evaluate vendor data handling. If the majority of AI vendors are not disclosing their actual AI subprocessors in these contracts, the entire trust framework for vendor risk assessment breaks down. Companies could unknowingly violate FTC regulations on automated decision-making while exposing sensitive personal data to unvetted AI systems.

Business Impact

Enterprises relying on vendor DPAs to manage AI risk are operating with incomplete information. A company might approve one AI model for a recruiting tool while the vendor secretly uses two others, creating compliance exposure and potential liability. With U.S. states issuing $3.425 billion in privacy fines in 2025 alone, this disclosure gap represents a material financial and legal risk.

Key Implications

  • DPAs can no longer serve as reliable standalone documents for evaluating vendor AI risk, requiring additional due diligence on product documentation and API integrations
  • Enterprises face potential FTC violations if undisclosed AI systems make automated decisions on sensitive data without proper vetting
  • The gap between disclosed and actual AI subprocessors creates shadow AI risk that correlates with significantly higher breach costs

What to Watch

Monitor whether regulators begin enforcing disclosure requirements for AI subprocessors in vendor contracts. Watch for enterprise adoption of supplementary vendor assessment tools that go beyond DPAs to verify actual AI deployments. Track whether major software vendors update their standard DPA language to include comprehensive AI subprocessor disclosure in response to this research.

Share
AI SecurityGovernance & PolicyAI Risk & Security

Subscribe to the newsletter

The latest stories and analysis, delivered to your inbox.

Free. No spam. Unsubscribe any time.

Related stories

Instinct AI Assistant Draws Praise and Privacy Concerns
AI SecurityTrendingNews

Instinct AI Assistant Draws Praise and Privacy Concerns

Instinct, an AI assistant in early testing, is drawing user enthusiasm for its capabilities but also raising red flags around privacy and security. The tool's broad access permissions, expansive terms of service, and ability to take autonomous action on behalf of users create potential risks that testers say warrant scrutiny. The tension between functionality and user protection highlights ongoing challenges in how AI assistants balance capability with safeguards.

by Sarah Perez· TechCrunch AI
AWS Bedrock Enables Adaptive Security for Healthcare APIs
AI SecurityNews

AWS Bedrock Enables Adaptive Security for Healthcare APIs

AWS published a technical guide for building intelligent security monitoring into FHIR healthcare APIs using Amazon Bedrock foundation models. The approach separates security analysis from the API request path to avoid latency impact, and uses AI to detect anomalies, classify data sensitivity automatically, and generate compliance reports. The solution addresses the manual maintenance burden of static security rules in healthcare environments where clinical workflows constantly evolve.

by Durgesh Nath· AWS Machine Learning Blog
AWS Bedrock AgentCore Adds Payment Layer for Autonomous Agents
AI SecurityNews

AWS Bedrock AgentCore Adds Payment Layer for Autonomous Agents

AWS and the OpenClaw Foundation have integrated payment capabilities into OpenClaw agents through Amazon Bedrock AgentCore, enabling autonomous agents to conduct transactions with services that require HTTP 402 Payment Required responses. The integration uses protocols like x402 and Machine Payments Protocol (MPP) to allow agents to initiate payments within pre-approved spending limits without human intervention at each transaction. This addresses a key operational gap for long-running agents that encounter pay-per-use APIs and content services while operating autonomously.

by Daniel Wirjo· AWS Machine Learning Blog
ChatGPT Now Tracks Your Keystrokes on macOS
AI SecurityNews

ChatGPT Now Tracks Your Keystrokes on macOS

OpenAI has introduced Computer History, a new feature in ChatGPT's macOS desktop app that tracks user clicks and keystrokes to build activity timelines for AI reference. The feature is opt-in and allows users to exclude specific apps and websites, with automatic filtering of incognito and private browsing content. This capability enables ChatGPT to suggest automations and resume incomplete tasks based on observed user behavior.

by Terrence O’Brien· The Verge AI