Public AI is not your biggest AI risk in itself. Shadow AI is.
The AI Readiness in Procurement report 2026, from Procurement Tactics and Suplari, shows procurement teams using AI constantly while the organisations behind them are nowhere near set up to control it. For anyone who buys, negotiates or manages suppliers, the figures are worth a few minutes of your attention.
What the procurement AI report found
47% of procurers use AI every working day
58% use it 4+ days a week
Only 17% of companies have an enforced AI policy
The dominant tools are general-purpose public models: ChatGPT/GPT-4 (62%), Microsoft Copilot (61%), Gemini (36%) and Claude (19%)
Only 8% use AI that is integrated into their procurement platform
Read together, those figures describe high adoption with little oversight. People are using AI because it helps them get through the work. Most of them are doing it without a sanctioned tool, a rulebook or a record of what went in.
Why this is shadow AI, not innovation
This is the pattern I called out in my recent Shadow AI article. People paste in emails, contracts, notes and client data because it is fast. Then the risks that actually bite appear:
Confidentiality and data leakage, which brings GDPR and trust into play
Hallucinations and confident errors that read well and are still wrong
No audit trail, so no defence when someone asks what was shared and what was relied on
The gap between how much AI is used and how little of it is governed is the problem. High adoption, low visibility, no defensibility and no data security add up to shadow AI.
Why procurement carries more exposure than most teams
Procurement sits on some of the most sensitive commercial data in the business: supplier pricing, bids, contract terms and negotiation strategy. A quote summarised in a public tool, or a contract clause rewritten in a chat window, puts that information outside your controls.
Many supplier contracts and NDAs carry confidentiality terms of their own. Check what yours say before anyone pastes them into an AI tool, and take advice from your legal adviser if you are unsure.
If your team is using public AI tools without policy, logging and controls, you do not have “innovation”. You have a governance gap that someone senior will eventually have to explain.
Four practical steps to close the gap
The fix does not need a long project. If you missed my Shadow AI checklist, these are the four steps:
Write a one-page AI policy. Name the approved tools, the banned ones and what each person may use AI for. Procurement can start with the tasks it already does: summarising supplier responses, drafting emails and comparing bids.
Create a “Never Paste” list. Supplier pricing, bid documents, contract terms, negotiation positions and anything covered by an NDA belong on it. Make the list short enough that people remember it.
Provide an approved alternative, or shadow AI will win. If the only fast option is a public chatbot, that is what your team will use. A private system where your data stays inside your business removes the temptation and keeps the speed.
Make verification mandatory on regulated and contractual work. AI can draft and summarise. A person checks the figures, the clauses and the claims, and signs it off.
Procurement is already using AI
Procurement is not behind on AI. It is already using AI, in the least controllable way possible. The teams that put a policy, an approved tool and a verification habit in place now will keep the speed and lose the exposure.
If you want a private option to offer your team, see how Clarity works, or book a 30-minute coffee date to talk it through.