The software service owner should coordinate the decision when an approved application gains a new AI feature. The business owner authorizes the proposed use, the administrator establishes what the controls actually enforce, and procurement or specialist reviewers resolve changed terms and information handling. Name one person who brings those decisions together and keeps the operating record current.
Approval needs to describe the capability people can use today. A familiar application name cannot establish permission for a new way to search records, retain conversations or send messages. Equally, every cosmetic update need not reopen the original procurement exercise. Review the change against the scope you already accepted.
Capture the change behind the announcement
Give release notices, employee discoveries and supplier messages a route to the service owner. Use the existing software-change process where it can handle the decision. A separate AI register will add little if nobody connects it to the people administering the application.
Record the difference between the approved arrangement and the arriving capability:
- Affected people and surface. Which accounts, editions, groups and applications receive it? Does the announcement describe the environment your staff actually use?
- Information and output. What can it read or receive, what does it create, and where can that result be stored or shared?
- Action and activation. Can it only suggest something, or also change a record? Who can start it, and can it start automatically?
- Handling and commercial terms. What changes in retention, processing, access, contractual coverage or charges? Who can settle an unanswered question?
- Timing and control. When is it expected, what is already available, and which supported controls can enable, limit or delay the affected use?
Keep the original notice and the current documentation with the record. Mark applicability as unresolved when the supplier has not confirmed it. A rollout announcement gives you something to investigate; a screenshot from another company's account does not prove your configuration.
For the earlier question of whether an existing entitlement can do useful work, evaluate the employee's actual included capability. This change review starts when that capability or its conditions move beyond the recorded decision.
Separate the decision from the configuration work
An administrator may be able to turn a feature on without being authorized to decide whether client information belongs in it. A procurement lead may obtain the applicable terms without being able to prove how a restriction reaches a user. Assign each piece of evidence to someone who can supply it.
| Responsibility | Person or function to name | Evidence needed to close their part |
|---|---|---|
Coordinate the change | Software service owner | A decision, unresolved items, affected scope and next review trigger |
Accept the business use | Process or department owner | Permitted work, acceptable results and a workable alternative |
Configure and verify controls | Application administrator | Relevant settings, scope and an observed check in the intended account |
Resolve changed obligations | Procurement with the relevant information, privacy, security or legal owner | Applicable terms and decisions on the material handling or contract questions |
These are responsibilities to allocate within your organization. One person may cover several, while a consequential change may require more specialist review. Agree delegated authority so a routine change within an accepted boundary can proceed without convening a new committee.
Suppose Claire Bennett owns the customer-implementation service at a payroll provider. Its approved meeting application introduces a summary feature. Jamie Lee administers the application. The team wants action notes from internal project meetings, but customer implementation calls can include payroll details and client-specific restrictions.
Claire needs an answer about those two uses. Jamie needs to establish whether the application can enforce the chosen boundary. Procurement needs to resolve any changed handling terms with the relevant owners. “The application was approved last year” answers none of those new questions by itself.
Choose a permitted use and a practical interim arrangement
The outcome can be broad acceptance, a limited use or a delay. Give the decision enough detail that an employee and an administrator can act on it.
For Claire's team, an internal-meeting trial could be considered with permitted sample agendas, defined participants, agreed storage and a person checking the action notes. Customer payroll meetings remain outside that trial while the relevant authorization is unresolved. A useful trial must also be technically separable from the excluded work. If the available controls cannot maintain that separation, change the trial or keep the capability unavailable through a supported route.
Write down what would change the decision. Permission for a selected internal meeting should not silently grow into permission to summarize every customer call. A later ability to send the notes automatically would require attention to the recipient and sending authority, even if drafting was already accepted.
To make the next step concrete:
- Set the interim boundary. Name the work that may continue, the affected use that must wait and the approved alternative.
- Resolve the material questions. Obtain the applicable product evidence and the decisions of the information or contract owners.
- Try the permitted task. Use approved sample material, check the result and test the restrictions needed for that scope.
- Record the release decision. State who accepted it, what conditions remain and which change requires another review.
Match the review to the consequences. An optional draft from permitted internal notes may need a different review from a connection that searches client records or sends a response. The tools and workflows guide covers the wider input, action and support boundaries.
Verify what the employee can actually do
Visibility, availability and automatic use are different things. Removing a shortcut may leave another access route open. Allowing a feature may still leave the host or user responsible for starting it. Confirm the restriction you need, rather than accepting the nearest similarly named switch.
Microsoft's Copilot Chat management guidance, updated October 22, 2026, explicitly says users can still reach chat on the web when the option not to pin it is selected. It describes app-availability controls separately. A missing navigation item therefore cannot establish that access is blocked.
Zoom's meeting-question controls distinguish feature enablement, automatic start and who may ask questions. They also describe an option to keep the toolbar entry visible for enablement requests while the feature is disabled and locked. An icon can remain without proving that meeting analysis is running. The applicable edition, account and group settings still matter.
In a June 2026 Reddit discussion, a user reported that the feature was off by default in their laboratory. Another Reddit user said IT had enabled it in their environment. These are unverified individual accounts with unknown editions and configurations. They complicate the assumption that every visible change came from the same supplier default.
For Claire and Jamie, the useful evidence is local. Can someone in the excluded customer-meeting group start the feature? Does the permitted internal group have the intended choice? What happens in the browser and desktop application that staff use? Choose the relevant checks from the real scope; do not assume that an administrator's own successful test represents every employee.
A restriction needs three different records
Customer payroll meetings stay outside the trial
Claire permits consideration of internal project summaries. Client payroll details and automatic sending are outside that proposal.
Group controls still need confirmation
Jamie must record applicable settings, inherited restrictions and who can change them for the intended accounts.
The effective boundary remains unverified
An approved check must establish whether the excluded account can start the feature and whether the permitted account has the intended choice.
This record keeps the missing proof visible. Jamie should complete an approved check with representative accounts and sample material, then return the observation to Claire. If the observed behavior conflicts with the decision, keep the affected use restricted while the owner repairs the arrangement. Avoid testing an uncertain boundary with live payroll information.
A vendor's broad control may also have limits. Zoom's universal-toggle guide lists eligibility requirements and excluded account types. Verify the current supported route for your account. A community instruction calling something a universal switch is insufficient evidence that it governs every feature you use.
Keep the decision alive after enablement
Close the change with instructions people can follow:
- Permitted use. Name the feature and the work it may support.
- Checking and storage. Explain who reviews the result and where it belongs.
- Unresolved use. Give affected colleagues an approved alternative and a place to ask for help when a feature appears before its approval is settled.
Where the accepted task has changed, repair the relevant training and try it with a colleague. Changing a policy page while leaving the old walkthrough in circulation creates conflicting instructions.
Keep a review trigger tied to the actual dependency. Revisit the decision when a new source connection, action, retention arrangement, entitlement or control changes its conditions. Periodic review catches missed notices; its interval should reflect the service's consequences and rate of change. The evidence here does not establish one timetable for every application.
Retain a supported way to continue the work if the feature becomes unsuitable. For Claire, the existing checked meeting notes may remain the operating alternative. Rehearse an AI fallback against the task and available capacity before depending on it during an interruption.
The service owner's closing question is practical: does the recorded decision match what the intended employee can do, and does someone own the next change? Keep that answer attached to the maintained application record.
Questions about AI features in approved software
Does an included AI feature inherit the application's approval?
An included feature can operate within an existing approval when its actual use and conditions fit that approval. Confirm the permitted information, actions, handling and users before assuming it does. A license entitlement establishes availability under the subscription; the responsible business and information owners still decide what the organization permits. Start with the record of what changed.
Does hiding the AI button disable the feature?
Hiding an AI button does not necessarily remove access or stop processing. The effect depends on the product and control. Ask the administrator to identify whether the setting governs visibility, availability, automatic activation or a particular data source, then check the intended restriction with an appropriate account. The control examples show why those outcomes need separate evidence.
What if employees already used the new feature?
The service owner should establish which feature, accounts, information and actions were involved, preserve relevant records through the approved route and obtain a decision on continued use. If there is a concern about unauthorized handling or another incident, involve the responsible incident team. Keep the initial observation distinct from the exposure still being investigated; the appearance of a new button alone does not establish a data disclosure.
What if the supplier offers no suitable off switch?
Record the control gap and ask the service owner to assess supported restrictions or an alternative way to perform the work. A policy telling staff not to use a feature does not demonstrate technical prevention. If the required boundary cannot be maintained, the authorized owner must decide whether the affected service or use can continue while procurement pursues an answer. Keep the business consequence and unresolved condition visible.
Must every software update go through a full AI review?
Review updates according to the change they make to the accepted use. A cosmetic adjustment may fit delegated routine change authority. New information access, automated actions or materially changed handling can require specialist decisions and renewed checks. Define those triggers with the service owner, and retain enough evidence to explain why an update stayed within scope or needed a new decision.
