• by Admin

Shadow AI Is Already at Work. Who Owns the Risk?

The Shortcut Nobody Reported

Picture a finance analyst on a Thursday evening, three hours from a reporting deadline. She pastes a spreadsheet of customer payment data into a free AI assistant and asks it to summarise the trends. The summary is good. She meets the deadline. Nobody ever finds out, including the security team, and a copy of that data now sits on a server the company has no contract with.

None of this takes bad intent. It takes a deadline and a browser tab. That is what makes AI governance so awkward: the risk grows out of ordinary, well-meaning work.

Why It Is Becoming a Security Job

For a while, governing AI looked like a policy exercise for legal or compliance. Write the guidelines, circulate them, move on. The trouble is that a guideline cannot see what people actually do. Security teams can. They already watch where data travels, who holds which permissions, and which applications are quietly talking to the outside world.

AI adds new questions to that list. Which AI tools are being used, officially or not? What data are they allowed to touch? If an AI agent can read a shared drive and send emails, who decides what it may do on its own? These are access and data-protection questions, and that is why the conversation keeps ending up with security.

For organizations in Indonesia there is an extra reason to act. Law No. 27 of 2022 on Personal Data Protection (UU PDP) makes organizations accountable for how personal data is handled, including when it ends up in an AI tool. An employee pasting customer records into an external assistant is no longer just a policy slip. It can become a compliance question.

Start With What You Can Actually See

Most organizations do not need a grand framework on day one. They need a first honest picture. Which AI services show up in network and browser traffic? Which departments lean on them most? Which of those touch customer data, contracts, or source code?

From there, the rules write themselves in plain language. Some data never goes into an external AI tool. Some tools are approved for some teams. Agents get the least access that still lets them do the job. Then someone checks, regularly, that reality matches the rules.

How Perkom and OneTrust Close the Gap

Perkom and OneTrust help turn that first picture into something your team can run day to day. In practice, that means three things.

• Find it. Discover which AI tools and models are in use across departments, including the ones nobody registered.

• Rule it. Put your data and access rules into AI governance workflows, so approvals and risk reviews stop living in email threads.

• Prove it. Keep a record that shows auditors, regulators and your own board what is in use and why it was allowed.

Perkom handles the groundwork, from mapping current usage to rolling out the platform and training the people who will own it. A short assessment is enough to see where your biggest gap sits.

Author: Ghea Devita

Marketing Communication PT Perkom Indah Murni