A stack of supplier contracts slides from the printer tray with every approval flag already set. No column records the model version, prompt or data cut-off that produced each flag.
Procurement platforms now embed scoring models that evaluate risk and price without exposing the inputs to the contract system. The output appears as a simple pass or fail inside the workflow queue.
Board packs still list only the declared AI tools. The embedded scorers sit inside vendor modules that were never declared during the original procurement round, so they never reach the risk register.
When a model later flags a supplier incorrectly, the audit trail ends at the platform dashboard. Finance cannot retrieve the training slice or the exact threshold that triggered the rejection.
Shadow instances multiply because teams add the scoring toggle during a routine upgrade. Each toggle writes decisions straight into the master vendor file without creating a separate log entry.
Australian regulators now ask for decision provenance on high-value contracts. Most organisations cannot produce it because the model output was never treated as a record that required retention.
Reset the contract system to demand an immutable model receipt on every automated flag. Without that step the board cannot distinguish between human and model error when disputes surface twelve months later.