Ask any CFO what the company spends on property, people, travel, or cloud infrastructure and you’ll get a quick answer. Ask how many software tools are actually running across the business, and things get murky fast. Zylo’s 2026 SaaS Management Index puts the average enterprise at around 300 SaaS applications, and organisations with more than 10,000 employees can be running upwards of 470.
A huge chunk of those were bought outside any formal process, often on a department credit card with zero compliance review. Nobody used to care much. But between ballooning SaaS spend and incoming AI regulation, procurement has become a problem that lands squarely on the board’s desk.
From Cost Centre to Compliance Risk
For years, buying software followed a boring, predictable routine. A team flagged a need, IT gave the nod, and finance signed off on the contract. That routine has completely fallen apart. SaaS spending now accounts for roughly 70% of total enterprise software budgets, and Gartner projects worldwide software spending will hit $1.44 trillion in 2026, so the numbers involved aren’t trivial anymore. When purchasing happens without oversight at that scale, duplicate subscriptions pile up, contracts auto-renew with nobody checking the terms, security gaps open up quietly, and there’s no clear record of what data each tool processes or where it’s stored.
Regulation has made things trickier. The EU AI Act has been in partial effect since August 2025, requiring providers of general-purpose AI models to meet documentation and transparency obligations. By August 2026, those rules will cover a much wider set of AI systems. For any organisation buying software with AI features baked in, procurement is now a compliance exercise whether they like it or not. An appliedAI analysis of 106 enterprise AI systems found that 40% couldn’t be clearly classified under the Act’s risk tiers. If the buyer didn’t assess the system at point of purchase, the liability still falls on the deployer.
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
What Automated Intake Actually Does
Plenty of organisations have procurement policies. The trouble is those policies exist in a handbook somewhere and don’t actually intercept the purchase when it matters. By the time a contract reaches the procurement team, the tool is already being used across a department, and any real leverage for a proper compliance review has disappeared.
That’s exactly the gap customizable intake management software is built to close. It’s simple in principle. Instead of hoping employees will hunt down the right procurement process on their own, an automated intake system captures every purchase request at the point of need and triggers a workflow that routes it through the correct approval gates, whether that’s budget sign-off, security review, data privacy screening, or legal assessment, before anyone signs a contract.
OECD survey data shows that two-thirds of member countries now use digital tools to promote transparency and oversight in their public procurement systems. Private-sector adoption is catching up. The driver isn’t grand policy ambition, it’s a blunt reality that manual intake processes simply can’t keep pace with how quickly teams pick up new software.
What a Governance-First Procurement Model Will Demand
Organisations that have got this right tend to have a few things in common. They know what they’re running. They’ve centralised their software inventory and can account for every tool. Their intake workflows enforce compliance checks before a contract goes through, not months after the tool has already embedded itself in daily operations. Procurement data feeds directly into budget planning, which means the CFO can see committed spend in real time instead of getting blindsided at renewal.
None of that is a technology problem. The OECD’s own data on digital procurement adoption confirms that the tools and frameworks already exist. Getting large organisations to apply the same discipline to software purchasing that they bring to capital expenditure or third-party risk management is where it actually gets difficult, because it requires changing how dozens of teams behave day to day.
The Boardroom Will Keep Asking
Procurement won’t drop off the governance agenda. The number of tools will keep growing and regulations will keep expanding, while the cost of unmanaged SaaS spending compounds year after year. Large organisations that operate across multiple jurisdictions already know they need to formalise how software gets bought, and the real pressure now is closing the gap between how things work today and what regulators and auditors will expect next year.
Any business that builds automated intake, real-time budget visibility, proper compliance checks, and audit trails into every approval will absorb new regulation without a scramble. Everyone else will struggle. They’ll keep finding problems after the contract is signed, which is exactly the worst time to discover your business is running 400 tools it never properly assessed.
