Unassessed AI in third-party products

What it is

Suppliers of office software, customer systems, HR platforms and security tools are adding AI features to existing products. They arrive in a routine update, often enabled by default, sometimes under existing contract terms. The product was assessed when it was bought, before the feature existed. The result is AI processing the organisation's data and influencing its work with no intake, no tiering and no entry in the inventory. This is a main cause of an incomplete AI inventory.

How it happens

• A release enables an assistant or scoring feature for all users.
• Administrators accept updated terms without reading the AI provisions.
• The feature sends data to a new sub-processor.
• Nobody is assigned to read supplier release notes for AI changes.

Why it matters

Personal and confidential data may be processed in new ways and places. A feature such as automated ranking of job applicants can bring a legal classification the organisation never considered. None of the organisation's AI controls apply to a system it does not know it has.

Warning signs

• Staff are using AI features nobody approved.
• Supplier release notes are not reviewed.
• The inventory contains only systems the organisation built or bought as AI.
• Contract terms were updated by the supplier unilaterally.

Who owns it

The owner of each supplier relationship is accountable for knowing what the product does. IT administrators control which features are enabled. Governance sets the rule that new AI features are assessed before use.

In practice

An HR platform adds a feature that scores and ranks applicants, switched on by default. Recruiters begin sorting by the score. The organisation has become a deployer of a recruitment AI system without a decision by anyone. The same pattern generalises to any product whose supplier can change what it does after purchase.