Why embedded AI changes the governance problem
A traditional technology register often assumes a new capability arrives through a project, procurement event or architecture review. AI can now arrive when an existing SaaS supplier adds summarisation, recommendation, generation or automated decision features to a product already in use.
The product name may stay the same while the data flow, output, level of autonomy or affected people change. That means governance needs to follow the organisational use rather than rely on the label attached to the software.
What to capture
Record the business purpose, owner, affected people, data, supplier, AI capability, deployment state and whether the feature can make or materially influence decisions. Where the organisation does not yet know the supplier behaviour, record Unknown rather than treating the gap as low risk.
How to find it without automated discovery
A first governance baseline can use department attestations, procurement and SaaS reviews, business-owner invitations and known high-risk workflows. Automated discovery may help later, but a credible first step is to make ownership and information gaps visible.