When: September 9, 11 AM EEST

Where: online via ZOOM

Speakers:

Stefanie Gort, Kiteworks
Ralf Böhler, Kiteworks
Ieva Pavilonytė, Hermitage Solutions Baltics

Employees across the Baltics are already using ChatGPT, Copilot, and AI agents at work, often with no record of what data those tools touched. No log means no audit trail, and no audit trail means nothing to point to if something goes wrong.

Join Kiteworks and Hermitage Solutions for a one-hour session on closing that gap. We’ll cover why shadow AI is the biggest blind spot in most compliance programs, and why CMMC compliance increasingly reaches this region specifically: a growing number of subcontractors and consultants to defense primes now need to protect Controlled Unclassified Information (CUI), even if they’ve never thought of themselves as a “defense company.”

Shadow AI creates two problems at once. The auditability gap: when AI use happens outside any governed system, there’s no log of what was shared, with what tool, or when, so there’s nothing to point to if a regulator, auditor, or customer asks. The control gap: without explicit restrictions, AI tools and agents will use whatever data they can reach. A chatbot or copilot can end up pulling from files or systems well beyond what any one employee should see. We’ll walk through a short self-check you can run against your own organization to see where these gaps actually sit today.

You’ll also see how Kiteworks closes both gaps in practice. Kiteworks tags sensitive data automatically based on context, such as the folder it’s uploaded to or the way it enters the system, and it can also read classification labels from dedicated tools like Microsoft Information Protection, BigID, or Concentric AI. Data is protected with encryption throughout, with the customer holding the keys. That tag feeds directly into the Data Policy Engine (DPE): a single set of policies that decides, in real time, whether a request to view, download, send, share, upload, or tag a piece of data should be allowed, blocked, restricted to a watermarked view, or routed for approval, based on who is asking, what the data is tagged as, and what they are trying to do with it.

The same engine applies to every exchange between people, machines, and systems, across email, file sharing, APIs, and AI agents, and it logs every one of those decisions, turning the audit trail from a promise into something you can hand to an auditor. We’ll walk through the Data Policy Engine live with a financial-services example and a defense-subcontractor CUI example.

AGENDA

• Welcome and introductions. Hosted by Hermitage Lithuania, covering the format, how to submit questions, and what to expect.
• Shadow AI: the auditability and control gap. Why unsanctioned use of ChatGPT, Copilot, and AI agents leaves no log of what happened and no restriction on what it can reach, including a short self-check to run against your own organization.
• CMMC and CUI for the Baltics. Why CMMC compliance increasingly reaches this region: a growing number of subcontractors and consultants to defense primes need to protect Controlled Unclassified Information, even organizations that don’t think of themselves as defense companies.
• Inside the Data Policy Engine. How data gets tagged, how the engine decides in real time whether a request should be allowed, blocked, restricted, or routed for approval, and how every decision is logged, across email, file sharing, APIs, and AI agents, illustrated with by a real scenario.
• Live Q&A