Topic starter
23/03/2026 2:01 pm
TL;DR: Embedded AI features inside trusted SaaS apps are creating invisible data flows that bypass point-in-time TPRM reviews, with Obsidian Security observing 69,749 interactions with corporate data in 30 days. Continuous visibility at the point of use is becoming the only reliable way to govern shadow AI before legal, compliance, and data exposure risks compound.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Shadow AI isn't just new tools, it's hiding in the SaaS you already trust”.
By the numbers:
- In just 30 days, Obsidian Security observed 69,749 interactions between users and corporate data with SaaS embedded AI features.
Key questions
Q: What breaks when hidden AI appears inside approved SaaS applications?
A: Static app categories stop reflecting real risk once vendors embed GenAI or model connectivity into software that was already approved.
Q: Why do embedded SaaS AI features create compliance risk even when the app was already reviewed?
A: Because the review usually covered the product at one moment in time, not the later AI capability that now processes data.
A: A common sign is when a vendor’s terms or sub-processor disclosures list OpenAI or other AI services, while internal security, compliance, and legal teams lack the same visibility.
Practitioner guidance
- Inventory AI-enabled SaaS features separately from application approvals Create a distinct register for SaaS features that can send data to external AI models, rather than relying on the original vendor approval record.
- Monitor AI feature use at the point of interaction Use browser-level telemetry or equivalent runtime observation to identify when users activate embedded AI features on sensitive corporate data.
- Map AI feature access to data processing obligations Align each permitted AI feature with the data processing agreement, internal policy, and contract restrictions that govern what it may see or generate.
Bottom line: Embedded AI inside SaaS turns a previously approved application into a changing data-processing path that existing review cycles may never revisit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:30 pm
Point-in-time approval is no longer a valid governance boundary for SaaS AI. Once a SaaS application is approved, many programmes treat the risk as stable until the next review cycle. Embedded AI destroys that assumption because the vendor can alter how data is processed after approval, while the organisation continues to treat the app as unchanged. The implication is that governance must follow live feature behaviour, not procurement history.
A few things that frame the scale:
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should teams respond when SaaS vendors add AI features after procurement approval?
A: They should treat the feature change as a new governance event, not as a minor product update. Reassess the data involved, the authorisation path, the logging available, and the contractual commitments already in place. The goal is to decide whether the new behaviour remains within policy before users start relying on it.
👉 Read our full editorial: Shadow AI in SaaS is breaking point-in-time governance models