DataGrail report finds your vendor may be sending data to AI models you never approved

DataGrail Report Highlights Challenges in Trusting Data Processing Agreements

According to DataGrail’s Privacy and AI Trends Report 2026, the data processing agreement (DPA) that companies rely on to assess how vendors handle personal data can no longer be taken at face value. The report reveals that 63.6% of vendors promoting AI capabilities fail to disclose third-party AI subprocessors in their legal documents, raising concerns about the exposure of customer data to unreviewed AI models and pipelines.

DataGrail’s analysis of 2,400 business software providers highlights the gap between AI vendor contracts and actual practices. The report indicates that companies may unknowingly be breaching data privacy regulations by using AI-enabled software with undisclosed subprocessors. This finding is particularly alarming given the high costs associated with data breaches, especially for organizations with shadow AI.

CEO Daniel Barber emphasized the need for more robust AI governance, as the current reliance on DPAs is insufficient to mitigate AI-related risks. The report’s methodology involved cross-referencing DPA disclosures with product documentation, GitHub environments, API connections, and marketing materials to uncover discrepancies in AI subprocessors.

Risks Associated with AI Vendor Contracts

The report also highlights the risks associated with AI systems that process sensitive data or enable automated decision-making. It points out that 32.8% of AI systems with disclosed capabilities also engage in high-risk activities, such as processing sensitive personal information. The report suggests that the actual exposure may be higher, as vendors may underreport data access or fail to anticipate risky applications of their AI tools.

These findings have regulatory implications, particularly under the CCPA’s new risk assessment requirement. Privacy teams are urged to engage early with AI projects to ensure compliance with privacy regulations and prevent potential data privacy concerns.

Challenges in Consent Management and Data Deletion Requests

The report also addresses challenges in consent management and data deletion requests, which have surged by 567% since 2021. It highlights the high costs associated with manual DSR management and emphasizes the need for automated privacy workflows to streamline compliance processes.

Despite enforcement efforts, the report reveals that many websites still fail to comply with universal opt-out mechanisms, posing regulatory risks. Companies are advised to improve consent management practices to avoid privacy violations and potential fines.

State Regulators’ Focus on Privacy Enforcement

The report underscores the increasing focus of state regulators on privacy enforcement, with $3.4 billion in privacy fines issued last year. It highlights the bipartisan nature of privacy enforcement and predicts further regulatory activity at the state level.

Privacy teams are facing challenges in managing their workloads, as headcounts have decreased even as demands for AI governance have increased. The report suggests that AI tools like DataGrail’s Vera can help automate privacy workflows and improve efficiency in privacy operations.

The Future of Privacy Challenges

Looking ahead, the report warns of the growing risks associated with agentic AI workflows, which could spread unvetted data across organizations autonomously. As enterprise applications increasingly feature AI agents, governance mechanisms must evolve to address the potential risks posed by these autonomous systems.

Overall, the report highlights the evolving landscape of data privacy and the need for organizations to adapt to new challenges in AI governance and data protection. By staying informed and leveraging automated privacy tools, companies can navigate the complex regulatory environment and protect customer data effectively.