Share with your CISO
European enterprises are treating EU AI Act compliance as a finished product rather than a floor, and Proofpoint’s AI governance framework analysis makes the stakes plain: a company can satisfy every documentation requirement and still hemorrhage customer data through a carelessly configured Microsoft 365 Copilot or an employee uploading sensitive records to a public AI tool. The post maps NIST AI RMF, ISO/IEC 42001, and the EU AI Act as complementary instruments rather than competing checklists, and proposes a five-step programme connecting governance objectives to operational controls like data loss prevention and access management.
What this means for your business
The organizations most exposed here aren’t the ones ignoring AI governance, they’re the ones who finished it. Getting to EU AI Act compliance created a false summit: the paperwork is done, the legal box is checked, and attention moves elsewhere. But AI risk runs through the seams of daily behavior, which employee uploaded what to which tool, which content permissions weren’t tightened before Copilot went live, which phishing email got polished by a generative model. CISOs whose mandate is framed as regulatory adherence will chronically underfund the operational layer where incidents actually originate.
The article’s sharpest claim, written by a vendor whose security platform sits directly in front of these exact data flows, is that AI risk is primarily a human and data risk rather than a model risk. That framing conveniently positions endpoint behavior monitoring and data loss prevention above model auditing on the priority list, which is where Proofpoint’s products live. The tilt is real, but the underlying argument isn’t wrong. The historical pattern in enterprise security is consistent: controls built around how systems are supposed to be used fail when employees route around them, and AI dramatically accelerates the blast radius when they do. Shadow AI, meaning employees adopting unapproved AI tools without IT visibility, is the current version of shadow IT, and shadow IT caused genuine breaches long before anyone called it that.
The decision this reframes isn’t whether to invest in AI governance. Most large European enterprises have already committed budget there. It’s whether that budget is allocated against compliance artifacts or against instrumentation: actual telemetry on what data is moving through which AI tools, who approved it, and whether access controls held. A CISO defending an existing DLP or identity governance renewal should be pricing in AI-specific coverage now, because the next contract cycle will assume it’s table stakes and won’t pay a premium for it.
Concept deep-dive: Shadow AI
Shadow AI is the organizational equivalent of employees expensing personal software and calling it productivity, except the exposure isn’t financial, it’s informational. When staff use AI tools that haven’t been vetted or approved, the data they input, customer records, contracts, internal strategy, travels through systems the security team has no visibility into and the legal team never reviewed. Governance frameworks that only cover approved systems leave this entire surface unaddressed, which is why usage inventory precedes policy in any credible AI risk programme.
Based on reporting from AI Governance in Europe: Why Compliance Isn’t Enough, originally published 2026-07-24 06:36:00.
