{"id":"SPM-006","section":"AI Security Posture Management","requirement":"Discover AI embedded in sanctioned SaaS","acceptance":"Identify AI features inside existing SaaS tools, such as Google AI Mode.","tier":"AT0, AT4","whyItMatters":"AI features switched on inside approved SaaS create new data flows without a new application to approve.","verificationMethod":"LT","verificationTest":"A common SaaS application is identified and cataloged as an AI tool due to its embedded AI features.","formerly":"DIS-010","alsoIn":[],"sort":5,"adoptionContext":"Vendor-embedded and platform-integrated AI can be present inside already approved SaaS, so discovering the host application alone is insufficient.","mappings":[{"frameworks":["csf","iso27001"],"explanation":"Discovery of AI features within existing SaaS supplies updates to the software and service inventory and flags supplier-service changes. A discovery finding must feed maintained records and does not itself complete change review.","kind":"framework","references":{"csf":["ID.AM-02","ID.AM-04"],"iso27001":["A.5.9","A.5.22"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Identifying embedded AI makes new third-party components and supplier capabilities visible for risk mapping and supplier governance. Existing SaaS approval does not assess the newly discovered AI feature.","kind":"framework","references":{"rmf":["MAP 4.1"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"Embedded-feature findings keep control information and the supplier-risk picture current. The buyer still needs to review the feature and decide its permitted use.","kind":"framework","references":{"soc2":["CC2.1","CC9.2"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"Discovering an embedded SaaS AI feature identifies an AI resource or component for the resource record. Existing SaaS approval does not establish assessment of that newly discovered feature.","kind":"framework","references":{"iso":["A.4.2"]},"relation":null,"conditions":[]}],"area":"AI Security Posture Management","areaSlug":"SPM","url":"/r/SPM-006","frameworkRefs":{"ISO27001":["A.5.9","A.5.22"],"ISO42001":["A.4.2"],"NIST-CSF":["ID.AM-02","ID.AM-04"],"NIST-AI-RMF":["MAP 4.1"],"SOC2":["CC2.1","CC9.2"]}}