Acceptance criteria
Identify AI features inside existing SaaS tools, such as Google AI Mode.
Why it matters
AI features switched on inside approved SaaS create new data flows without a new application to approve.
How to verify
A common SaaS application is identified and cataloged as an AI tool due to its embedded AI features.
OWASP adoption context
Vendor-embedded and platform-integrated AI can be present inside already approved SaaS, so discovering the host application alone is insufficient.
Framework mappings
Discovery of AI features within existing SaaS supplies updates to the software and service inventory and flags supplier-service changes. A discovery finding must feed maintained records and does not itself complete change review.
Identifying embedded AI makes new third-party components and supplier capabilities visible for risk mapping and supplier governance. Existing SaaS approval does not assess the newly discovered AI feature.
Embedded-feature findings keep control information and the supplier-risk picture current. The buyer still needs to review the feature and decide its permitted use.
Discovering an embedded SaaS AI feature identifies an AI resource or component for the resource record. Existing SaaS approval does not establish assessment of that newly discovered feature.