Home / Technology / AI Data Risk: Contracts Can't Be Trusted
AI Data Risk: Contracts Can't Be Trusted
27 May
Summary
- Most vendors with AI capabilities hide AI subprocessors.
- DataGrail report reveals a significant vendor disclosure gap.
- Privacy teams face shrinking staff amid AI governance demands.
DataGrail's 2026 Privacy and AI Trends Report indicates that Data Processing Agreements (DPAs) are no longer reliable for assessing AI-related data risks. Researchers found that 63.6% of vendors prominently advertising AI capabilities do not disclose third-party AI subprocessors in their legal documentation.
This lack of transparency means many businesses are unaware of how their customers' data is being processed by AI models. The report highlights that 32.8% of AI systems with disclosed capabilities also process sensitive data or power automated decision-making.
In parallel, privacy teams are facing increased workloads and shrinking headcounts, losing up to 33% of staff last year. This occurs as AI governance demands surge, with 90% of privacy programs expanding due to AI adoption.
