§ The CISO Learning Journey · Week 3 · Phase 1 · Awareness · June 9, 2026

Why vendor questionnaires
cannot catch Shadow AI.

By Lindsay Hiebert · Founder · CISSP

Vendor questionnaires (SIG, Vanta, Drata, Secureframe) are vendor self-attestation frameworks — they see what the sanctioned stack reveals, not the AI your employees are running outside the sanctioned vendor list.
Vendor self-attestation (SIG, Vanta, Drata, Secureframe) versus observation-based Shadow AI detection — different framing, different coverage.
Vendor self-attestation · sanctioned-stack-only

The Standard Information Gathering (SIG) questionnaire is the industry’s most-used third-party risk assessment — 21 risk domains, 133 to 810 questions depending on edition, mapped to NIST CSF 2.0, HIPAA, GDPR, SOC 2, ISO 27001, EU AI Act, and 30+ frameworks. Vanta automates the same vendor-attestation pattern continuously: 16,000+ customers, 400+ tool integrations, hourly automated control tests. Drata, Secureframe, and OneTrust do the same. Each is a strong tool for the sanctioned vendor risk-management job it was built for.

Each is also, structurally, a vendor self-attestation framework. SIG, Vanta, Drata, and Secureframe all see the AI tools your security team has onboarded. None of them can see the consultant who pastes a customer contract into ChatGPT, the engineer who installs an AI browser extension on a managed laptop, or the analyst who authenticates to Claude or Gemini with personal credentials outside IT. The 80%+ of enterprise AI usage that is unmanaged is the AI these tools were never designed to detect — because Shadow AI is not a vendor relationship, it is an employee behavior. See the SIG entry in the glossary for the parent acronym, and How SanctumShield works alongside the SIG questionnaire for the full structural critique.

What to do. Keep your vendor-attestation tools — they are doing the vendor-risk job correctly. Layer Shadow AI governance alongside them. SanctumShield runs observation against network logs (paste any firewall, proxy, or DNS export — no integration, no agent, no platform engineer required), matches outbound traffic against 118 continuously-refreshed AI endpoints via multi-LLM agentic synthesis (Claude + Gemini), generates a regulation-anchored AUP, and produces a board-ready Executive Risk Report with a 6-year verifiable URL that underwriters and auditors can confirm. SIG and Vanta cover the vendor program. SanctumShield covers the employee program. Next step: see how SanctumShield layers under Vanta at /vs-vanta.

§ Why this is a legal question, not a tooling preference

Everything above is an argument about method. Underneath it sits an obligation that does not depend on which method you pick. Documented, dated, demonstrable governance is what the law asks for, and the dates have stopped being in the future.

EU AI Act Article 4 — AI literacy
In force since February 2, 2025. National enforcement began August 2, 2026.
EU AI Act Article 50 — transparency
Applies since August 2, 2026.
Colorado SB 26-189
Effective January 1, 2027.
EU AI Act Articles 12, 14 and 17 (provider duties; deployers carry theirs under Article 26)
High-risk regime: December 2, 2027 (Annex III) and August 2, 2028 (Annex I).

Read those together and the shape is consistent. Each one asks an organization to produce something — a measure taken, a disclosure made, a record kept, a review performed — and to be able to show it after the fact. None of them names a product, a platform or a link, and nothing here should be read as saying a law requires one. What a law requires is the record. Making that record dated and third-party-verifiable is simply how you let an auditor, an underwriter or a board confirm it without being handed the contents, or being asked to take your word for it.

And literacy is not one obligation among several. It is the one the others rest on. You cannot exercise due diligence over a system you cannot recognise, and you cannot govern an authority you do not understand you have delegated.

That is why Article 4 sits in the opening chapter of the Act, ahead of the risk tiers, and why it applied eighteen months before the high-risk regime does. The duty is to take measures that support the development of AI literacy among the people operating AI on the organization’s behalf — and the useful version of that is matched to the seat. What a director needs to recognise is not what a developer needs to recognise, and neither is what the person pasting a contract into a browser tab needs to recognise. A single org-wide module satisfies the form and misses the point.

Free board register + eight questions →Literacy matched to the seat →Free Shadow AI Check →
Continue exploring on SanctumShield

The full library — 290 pages of CISO-grade content.

SanctumShield maintains the deepest publicly-available reference set for mid-market agentic-AI governance — primary-source cited, continuously refreshed. Related deep-dives on this article’s topic:

Free Shadow AI Risk Audit

See what your current stack is missing — in 12 questions.

The SanctumShield free Shadow AI Check runs in your browser. No account, no email, no credit card. Twelve questions, instant risk score, three primary findings tailored to what you submit.

Start your AI Governance Audit →

CISO Learning Journey: Week 3 of 27 · Phase 1 (Awareness) · see the full series →

Why Vendor Questionnaires (SIG, Vanta, Drata) Cannot Catch Shadow AI — SanctumShield