Skip to content
AIRAS Cloud

Founder analysis

Approved software is not approval of an added AI capability

AI can arrive through an authorised enhancement to a trusted enterprise service. The question is not only whether the supplier was approved, but whether this particular capability, use and influence were assessed.

Richard Higgins

Richard Higgins · Founder and Chief Executive
Based on his public article of 24 October 2026 · Source checked by the development assistant on 28 October 2026; approval of this HTML adaptation is pending

The ordinary change that creates a new question

A procurement approval describes a service and the evidence available at a point in time. An enhancement can introduce AI-assisted matching, summarisation, recommendations or a new processing arrangement without introducing a new supplier. Access and integration tests may pass while the organisation has not yet established the added capability's purpose, data use or influence on decisions.

Richard Higgins' public article, Solve the AI Problem You Didn't Know You Had, uses recruitment as an illustration. Greenhouse publicly documents Talent Matching and administrator-controlled setup, including that the feature does not automatically advance or reject candidates. The illustration is not a reported incident involving Greenhouse or its customers. A legitimate, disclosed product feature can still require a use-specific governance decision by the deploying organisation.

What supplier approval does—and does not—prove

Existing supplier diligence remains useful evidence. It does not prove that a later AI feature was enabled, disabled, assessed or authorised for a particular workflow. A feature being available is not evidence that a customer uses it. A human retaining the final action also does not by itself settle the nature or influence of the AI capability.

Network and browser controls can restrict identified destinations. They do not, alone, establish how an approved cloud service processes information, complete an AI inventory or create an accountable decision. Governance and technical controls are complementary, not substitutes.

An evidence request that produces a decision, not another list

Missing facts should remain visible as missing facts. A marketing description is not deployment evidence, and confidence that a document mentions AI is not confidence that a use is acceptable. The useful endpoint is a recorded decision with rationale, evidence and a review trigger.

  • Identify the feature and its release or activation evidence.
  • Confirm whether it is included, enabled and actually used; name the business owner.
  • Record the purpose, affected people, data categories, processing arrangements and integrations.
  • Ask what the outputs influence, what people can override and what information they receive.
  • Retain supplier documentation, contractual scope and unresolved questions.
  • Assess the confirmed context; assign controls, reviewers, conditions and implementation owners.

How Shadow AI Defence connects to governed assessment

AIRAS Cloud Shadow AI Defence starts with sources the organisation authorises for review. It identifies candidate capabilities from supporting evidence and metadata. People confirm actual use, and a named human request controls handoff to the governed core intake. Discovery does not write an approval or substitute for ARIE.

ARIE applies version-controlled assessment reasoning to the recorded context. Discovery confidence, regulatory classification and operational risk remain distinct. Authorised people review controls and evidence and decide what happens next. Responsible teams implement restrictions; the platform's record is not proof that a technical restriction has been enacted.

Illustrations are not customer outcomes

The original PDF includes a hypothetical €20 million services business absorbing €500,000 of assumed corrective work. Its financial example explains margin mechanics, not typical incident costs, a reported customer result or a claimed AIRAS saving. It excludes fines, lost revenue, compensation and insurance recoveries. This HTML analysis makes no savings promise.

Legal context depends on intended use, role and applicable provisions. The sources below are those used in the approved public PDF; this page does not claim a new legal review or change a statutory timetable. AIRAS Cloud does not provide legal advice or guarantee compliance. Internal QA is not independent penetration testing, certification or external assurance.

Original article and primary references

Read the original PDF: Solve the AI Problem You Didn't Know You Had

Bring one supplier, one feature, one decision

Start with one recently enabled capability. Can the owner identify the AI assessment and approval record, or does the answer depend on memory? Request a synthetic demonstration to see the evidence-to-decision path without sharing confidential material.