AI use can begin outside a purchasing process. A browser extension, a new CRM assistant, or an employee’s paid account may process work information before IT knows it exists.
The risk goes beyond a data leak
The organization may not know which supplier receives information, how it is retained, or who can approve an automated action. A decision made with an unreviewed tool may also have no clear owner.
Make the first step manageable
Build an inventory of actual use. Agree on clear rules for sensitive information and supplier approval, then name someone who can connect business needs with IT and privacy requirements. Give employees an approved route to ask for a useful tool, so the process helps them work responsibly.