The AI You Never Approved Is Already Scoring Your Suppliers
You can govern the AI your team decided to use. You cannot govern the AI you didn't know was there.
That distinction came up directly at a recent TYS webinar on AI governance in procurement, when an attendee asked a question most governance frameworks aren't built to answer: what about the AI already embedded in the tools you rely on? Not the ones you deployed, but the ones your data providers built? An ESG score. A financial risk score. A number that shows up in your supplier record and gets treated as fact.
Gary Storr, Chief Sales and Marketing Officer at Trust Your Supplier, didn't soften the answer.
"Part of the process is determining where AI solutions are being implemented, and that's becoming increasingly difficult to identify as technology absorbs AI into its very fabric," Gary said. "You have to make the assumption that practically any data point you're receiving today has been processed by some kind of AI. It's your job to talk to your vendors and data providers and ask the simple question: how much of this has been augmented by AI, and how is it being done? Learn what that process looks like, so you can evaluate how you have to govern it, how you have to audit it, and what you need to do to ensure the information you're receiving is something you can verify and trust."
The Governance Model Most Teams Have Built
Most AI governance conversations in procurement start and end with the same question: what are we using AI for, and who approved it? That's a reasonable starting point. It's also incomplete.
A governance model built only around internal AI use assumes the AI touching your supplier data is AI your organization chose. In practice, a growing share of it isn't: the ESG score in your supplier profile, the financial risk rating pulled from a data provider, the sanctions match flagged by a screening tool, any of these can be AI-generated or AI-augmented upstream, before the number ever reaches your system.
You never see that process happen. You just see the output: a score, a flag, a rating that looks exactly as authoritative as data your team verified directly. Nothing distinguishes the two once they land in the same record.
Why This Blind Spot Is Easy to Miss
It rarely gets flagged as a governance gap. Teams that have done real work on AI governance internally often assume the job is done, because the visible AI, the chatbot, the copilot, the internal tool, is accounted for. The invisible AI is a different problem entirely: it doesn't announce itself, it doesn't require sign-off, and it arrives already dressed as data.
This isn't a hypothetical. As Gary put it, assume any data point you receive today has been processed by some kind of AI in some way. That assumption changes how you should treat a number you didn't generate yourself.