The surge in AI use has heightened cybersecurity risks, including shadow AI – the unauthorized use of AI tools or misuse of approved ones. Illustrating how those risks can manifest, CB Financial Services, Inc. (CB Financial) recently filed a Form 8‑K with the SEC, disclosing that its wholly owned subsidiary had experienced a material cybersecurity incident arising out of the use of an unauthorized AI application. The filing is apparently the first Form 8‑K to disclose a shadow AI incident. This article examines the CB Financial filing, the relevant SEC obligations and how organizations can mitigate the compliance risks associated with shadow AI, with commentary from partners at Debevoise & Plimpton, Wilson Sonsini and Goodwin. See “Unpacking the AI Risks Disclosed in 2025 SEC Filings” (Sep. 10, 2025).