Your next AI decision may not arrive as a procurement decision. It may arrive as a product update to software you bought years ago.
Consider a SaaS platform assessed and contracted before generative AI became a standard product feature. The supplier now adds meeting summaries, an email-writing assistant or conversational search. The product name and purchase order remain familiar. What the software can do with your information may have changed.
That is why an assurance record from contract award cannot, by itself, answer how the service handles data today.
Where AI appears in familiar software
AI does not always announce itself as a chatbot. It can appear in a CRM that drafts account notes, a help desk that summarises tickets, a document platform that answers questions across files, or a meeting service that turns recordings into actions. Integrations and connected applications can add further processing steps.
There is also the supplier’s own use of AI. A contractor delivering an otherwise ordinary service may introduce an AI tool into its support team, document handling or internal workflow. A review limited to the product you bought can miss AI used elsewhere to deliver that service.
Not every update changes data handling, and a feature being available does not prove it is enabled. Some capabilities require an administrator’s approval, a separate licence or a user action. The task is to establish what applies to the particular service and account, rather than assume either that nothing has changed or that every new feature is in use.
An existing subscription can gain AI
Google documents that, from January 2025, it began adding AI features to Google Workspace Business and Enterprise editions that had previously been offered through Gemini add-ons. Its guidance also distinguishes access to the Gemini app from AI features inside Workspace services: turning off the app does not, by itself, turn off those other features.
This is an example of how an established subscription can evolve, not evidence of a privacy failure or a claim that a particular customer’s data leaves Australia. It shows why buyers need feature-specific controls and account evidence, not just a statement that the organisation does or does not use a named AI product.
The assurance question is what changed
When a material feature or supplier practice changes, revisit the information it can access, the purpose of processing, the providers involved and the applicable processing locations. Check retention, monitoring and support access separately from residency. An Australian storage setting does not establish the location of every new AI processing step.
A promise not to use customer data to train models is relevant, but it does not answer all those questions. Likewise, yesterday’s evidence may remain accurate for the original service while saying nothing about a newly enabled feature.
The OAIC’s guidance on commercially available AI products explicitly rejects a ‘set and forget’ approach to due diligence. It calls for review, staff training and monitoring throughout the product lifecycle. The practical implication is ongoing assurance, not a one-off questionnaire filed at procurement.
Make review part of managing the contract
- Assign an owner to review relevant release notes, service notices and changes to AI terms or sub-processors. Make sure those notices reach someone who can act on them.
- Ask suppliers to identify material changes to AI used in delivering your service, including changes in their own internal tools. Agree notification and review arrangements in the contract where appropriate.
- Recheck account settings and feature access when AI capabilities are introduced or enabled. Establish which information the feature can reach and whether that use is approved.
- Refresh the evidence when a relevant model provider, processing region, integration or retention arrangement changes. Record the source, date, configuration and limits of the new finding.
- Use both scheduled reviews and change-triggered checks. The frequency should reflect the sensitivity of the information and the consequences of a change, rather than waiting for contract renewal.
An evidence record needs a date and a scope
The useful question is not simply ‘Did we assess this supplier?’ It is ‘Does our evidence still describe the service we receive?’
Keep the supplier’s current declaration, the supporting evidence and any unanswered questions together. Retain earlier assessments so changes can be understood, but do not present an old conclusion as current without checking its scope.
You may not be buying a new system. You may still need a new assurance decision.
