Acceptance criteria
Identify and risk-score an AI application the platform has not seen before, without waiting for a signature, category list or catalog update, and show the evidence behind the classification.
Why it matters
Waiting for a catalog update leaves every new tool ungoverned during the period it is most likely to be tried.
How to verify
An AI tool the vendor has not seen before is classified and risk-scored on first use, with the evidence shown.
OWASP adoption context
Shadow AI is the primary first-encounter discovery scenario; an unfamiliar application should not require a prior catalog entry to become visible.
Framework mappings
Evidence-based first-encounter classification supplies timely software-inventory and risk-assessment inputs without catalog delay. A classification or score is not a maintained, owned inventory or a complete risk assessment.
Evidence behind unfamiliar-app classification helps map third-party AI component risks. The buyer must validate that evidence; signature-free detection is an implementation choice, not a complete risk-mapping process.
New-service classification and scoring inform risk evaluation and supplier review. The buyer must validate scoring evidence and make the subsequent due-diligence and treatment decisions.
First-encounter identity and classification evidence help identify an AI resource for documentation. A one-time classification does not establish continued operational monitoring or support.