§ The CISO Learning Journey · Week 4 · Phase 1 · Awareness · June 16, 2026

The four layers of Shadow AI
in a mid-market organization.

By Lindsay Hiebert · Founder · CISSP

The four-layer Shadow AI risk model: Layer 1 direct AI tools, Layer 2 embedded AI in SaaS, Layer 3 BYOD AI authentication, Layer 4 autonomous agent readiness. Most security tools focus only on Layer 1; SanctumShield audits all four.
Most security stacks see only Layer 1

Most Shadow AI coverage in 2026 focuses on Layer 1 — the consumer AI tools your employees open in a browser tab. ChatGPT, Claude, Gemini, Perplexity. The tools you can name. They are not the whole picture, and in many mid-market organizations they are not even the largest exposure surface.

Layer 2 is embedded AI inside the SaaS you already pay for — Microsoft Copilot inside Microsoft 365, Salesforce Einstein, Slack AI, Notion AI, HubSpot Breeze, Zoom AI Companion, Atlassian Intelligence. The AI you did not separately procure but turned on with a checkbox. Layer 3 is BYOD (bring-your-own-device) AI — employees authenticating to AI services with personal credentials outside any IT control. Layer 4 is agentic AI — MCP (Model Context Protocol) servers, A2A (agent-to-agent) discovery chains, autonomous agents deployed via Claude Agent SDK or OpenAI Agents SDK or Google’s Agent Platform that invoke tools, call other agents, retain memory, and act with delegated authority. Most security tools — DLP (data loss prevention), CASB (cloud access security broker), SSE (security service edge) — enforce perimeter controls at Layer 1. AI-SPM (AI Security Posture Management) platforms like Wiz, Palo Alto AI Access, and Cisco AI Defense observe runtime activity inside Layer 4. Observability is not governance. Enforcement is not governance. Neither produces the regulation-anchored AUP, the Executive Risk Report, the Board Memo, or the third-party-verifiable artifact a board signs and an underwriter files. Layers 2 and 3 sit between perimeter-enforcement and runtime-observability and are, in most mid-market organizations, the bigger, mostly invisible surface.

What to do. Audit all four layers, not just the browser tab. SanctumShield’s multi-LLM agentic assessment covers Layer 1 (direct AI tools registry, 69 pre-rated services), Layer 2 (embedded AI inside SaaS catalog), Layer 3 (BYOD authentication risk model), and Layer 4 (deployed agent governance per Section 14 of the generated AUP) — in a single 10-minute guided assessment, with the regulatory clause anchoring auditors and underwriters require. Next step: see the four-layer model rendered in a real Acme Health audit at /sample-outputs.

§ Why this is a legal question, not a tooling preference

Everything above is an argument about method. Underneath it sits an obligation that does not depend on which method you pick. Documented, dated, demonstrable governance is what the law asks for, and the dates have stopped being in the future.

EU AI Act Article 4 — AI literacy
In force since February 2, 2025. National enforcement began August 2, 2026.
EU AI Act Article 50 — transparency
Applies since August 2, 2026.
Colorado SB 26-189
Effective January 1, 2027.
EU AI Act Articles 12, 14 and 17 — record-keeping, human oversight, quality management
High-risk regime: December 2, 2027 (Annex III) and August 2, 2028 (Annex I).

Read those together and the shape is consistent. Each one asks an organization to produce something — a measure taken, a disclosure made, a record kept, a review performed — and to be able to show it after the fact. None of them names a product, a platform or a link, and nothing here should be read as saying a law requires one. What a law requires is the record. Making that record dated and third-party-verifiable is simply how you let an auditor, an underwriter or a board confirm it without being handed the contents, or being asked to take your word for it.

And literacy is not one obligation among several. It is the one the others rest on. You cannot exercise due diligence over a system you cannot recognise, and you cannot govern an authority you do not understand you have delegated.

That is why Article 4 sits in the opening chapter of the Act, ahead of the risk tiers, and why it applied eighteen months before the high-risk regime does. The duty is to take measures that support the development of AI literacy among the people operating AI on the organization’s behalf — and the useful version of that is matched to the seat. What a director needs to recognise is not what a developer needs to recognise, and neither is what the person pasting a contract into a browser tab needs to recognise. A single org-wide module satisfies the form and misses the point.

Free board register + eight questions →Literacy matched to the seat →Free risk calculator →
Continue exploring on SanctumShield

The full library — 290 pages of CISO-grade content.

SanctumShield maintains the deepest publicly-available reference set for mid-market agentic-AI governance — primary-source cited, continuously refreshed. Related deep-dives on this article’s topic:

Free Shadow AI Risk Audit

See what your current stack is missing — in 12 questions.

The SanctumShield free Shadow AI Risk Calculator runs in your browser. No account, no email, no credit card. Twelve questions, instant risk score, three primary findings tailored to what you submit.

CISO Learning Journey: Week 4 of 27 · Phase 1 (Awareness) · see the full series →

The Four Layers of Shadow AI in a Mid-Market Organization — SanctumShield