Summary: View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to upload arbitrary malicious firmware to the device.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: The Federal Trade Commission and the Department of Justice’s (DOJ) Antitrust Division released their 48th Annual Hart-Scott-Rodino (HSR) Report.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] FTC Competition Press Releases

Summary: The Federal Trade Commission finalized an order with Publishing.com LLC and its two principals, settling allegations that they misled consumers about how much money consumers were likely to earn using their self-publishing products.Under the order finalized by the Commission, Publishing.com and its principals, CEO Christian Mikkelsen and Chief …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] FTC Consumer Protection Press Releases

Summary: View CSAF Summary Successful exploitation of these vulnerabilities could allow unauthenticated users to access and control IoT Hub managed devices.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access to device information or cause a denial-of-service condition.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: The companies that operate the Hopper travel apps have agreed to pay $35 million and will be prohibited from deceiving consumers about fees to settle the Federal Trade Commission’s allegations that they unfairly charged consumers hidden fees and misrepresented the total prices consumers would pay and the benefits …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] FTC Consumer Protection Press Releases

Summary: The Securities and Exchange Commission’s Division of Economic and Risk Analysis (DERA) published updated statistics and data visualizations covering key segments of the U.S.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] SEC Press Releases

Summary: CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: CISA Announces New Advisory Council to Strengthen Partnerships and Secure Critical Infrastructure

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA News

Summary: Brussels/Frankfurt, 1 July – The EDPB and the Anti-Money Laundering Authority (AMLA) are working together to bring greater clarity to a question of growing importance for industry and authorities alike: how to share information to fight financial crime while protecting personal data.Why information sharing mattersThe fight against financial …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:EDPB News

Summary: The Federal Trade Commission is seeking public comment on a proposed policy statement addressing concerns that AI companies may be manipulating the behavior of their AI systems contrary to reasonable consumer expectations for objectivity and accuracy.As the proposed policy statement explains, the FTC Act prohibits businesses from engaging …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] FTC Consumer Protection Press Releases

Summary: The Securities and Exchange Commission today issued a request for public comment on exchange-traded funds (ETFs) seeking to invest in innovative asset classes or engage in novel investment strategies.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] SEC Press Releases

For years, shadow IT meant unsanctioned SaaS, unmanaged devices, and business teams adopting systems faster than central governance could track them.

Now the same pattern is happening again through AI.

Employees use public chat tools for work tasks. Teams wire AI features into workflows through vendor platforms. Product groups buy embedded AI capabilities that legal, security, and compliance only discover later. Internal tools call external models through lightweight integrations nobody formally registered because the work felt too small to justify process.

This is not a future problem. It is already normal enterprise behavior.

That is why AI usage discovery is becoming the new shadow IT problem.

AI adoption is easier to hide than traditional software adoption

Old shadow IT often left visible traces. Someone bought a tool. A domain appeared. A contract existed. A login pattern changed. A device showed up.

AI usage can be much lighter weight and therefore easier to miss.

A team might:

• paste internal data into a public AI interface
• turn on an AI assistant inside an existing SaaS platform
• build a low-code workflow that calls a model API
• use browser extensions or productivity plugins with AI features
• start relying on embedded generation or classification without any standalone procurement signal

Each decision may feel small. Collectively they create a new layer of operational dependence and data movement that many organizations are only partially able to see.

Governance cannot work on systems it does not know exist

This should sound familiar because it is the same failure pattern seen in other domains.

You cannot review what you have not discovered.

You cannot assign ownership to a workflow nobody declared.

You cannot assess data handling, vendor posture, prompt risk, retrieval behavior, or model dependency if the use case entered production through convenience and stayed there through habit.

That is whyAI access control is not the same thing as AI governance. Restricting tool access does not help much if the actual workflows and dependencies were never discovered in the first place.

Many organizations are already trying to govern AI with intake forms, review committees, and policy language while lacking a credible inventory of where AI is actually being used. That is not a small gap. It means the formal governance program is operating on a curated subset of reality.

The real issue is not forbidden use. It is invisible dependence.

Some AI governance conversations are still stuck on prohibition: how do we stop people from using unsanctioned tools?

That matters, but it is not the whole problem.

The deeper issue is invisible dependence. Workflows start leaning on AI outputs before anyone has decided whether the use is important enough to govern differently. Internal expectations change. Customer responses get shaped by generated text. Analysts rely on model summaries. Support teams trust AI-assisted search. The organization acquires hidden dependencies before it acquires visibility.

That is exactly what made shadow IT hard the first time. The technology was not just present. It became useful before governance arrived.

Discovery has to include platforms, vendors, and workflows

AI usage discovery is also harder than traditional software inventory because “the AI system” is often not a single product.

It may be:

• a feature inside a major SaaS platform
• a vendor workflow powered by a hidden foundation model
• a prompt layer inside an internal application
• an API dependency attached to a business automation
• a retrieval system grounded in internal documents

If the discovery model only looks for direct model contracts, it will miss a large share of the real exposure.

This is really the AI version of the older inventory failure described inwhy asset inventory remains so embarrassing in large organizations: the systems of record feel mature right up until someone asks what is actually in use.

This is why AI governance inventories need to look more like a combination of software inventory, third-party risk mapping, and workflow discovery. They have to ask not just which models are approved, but where AI-mediated behavior is now influencing decisions, content, support, or operations.

What serious discovery looks like

A better AI discovery program usually combines several questions:

• where are public AI tools being accessed from managed environments?
• which enterprise SaaS platforms have enabled AI features?
• which internal systems call model APIs directly or through vendors?
• where is internal or customer data being routed into AI-assisted workflows?
• which business processes now depend on AI output, even informally?

This is not about building a perfect inventory on day one. It is about admitting that AI governance without usage discovery is mostly ceremonial.

Bottom Line

AI usage discovery is becoming the new shadow IT problem because adoption is diffuse, low-friction, and increasingly embedded inside tools the enterprise already trusts.

The organizations that handle this well will not be the ones with the prettiest policy documents. They will be the ones that can actually see where AI is being used, what data and workflows it touches, and which dependencies have formed before those dependencies become governance surprises.

Summary: View CSAF Summary Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to enumerate all user accounts and role assignments on a FUXA SCADA/HMI instance.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: Amazon will pay $2.25 million in civil penalties to settle Federal Trade Commission allegations that the online retail giant knowingly violated the Fair Credit Reporting Act (FCRA) by refusing to provide transaction records to consumers whose personal information was used by identity thieves to commit fraud.The complaint, filed …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Executive Risk] FTC Consumer Protection Press Releases

Summary: View CSAF Summary Successful exploitation of these vulnerabilities could allow a local attacker to tamper with or destroy information in the affected product, cause a denial-of-service condition in the affected product, or execute arbitrary code when a specially crafted archive file is decompressed by the 7-Zip component included …

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: View CSAF Summary Successful exploitation of these vulnerabilities can allow an attacker to cause unauthorized access and exposure of sensitive information when the unauthenticated attacker accesses credentials stored within firmware or system files.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: View CSAF Summary Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Data Center Expert.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories

Summary: View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to gain broad unauthorized access, execute arbitrary commands with root privileges, steal sensitive data, and perform actions on behalf of legitimate users across interconnected systems.

Why it matters: This matters if it changes how teams think about model governance, safety work, monitoring, or regulatory exposure around deployed AI systems.

What to watch: Watch for follow-on technical guidance, deployment constraints, evaluation details, or signs that the announcement changes actual production practice rather than just policy language.

Source:[Critical Advisories] CISA Cybersecurity Advisories