Third-Party AI Still Counts as Your AI

Here is a comforting fiction: "We didn't build the AI, we just bought it, so its risks are the vendor's problem."

They are not. When you deploy someone else's AI in your organization — an embedded copilot, a screening tool, an API you built on — its failures happen under your roof, to your customers, under your name. Regulators and the public will come to you first.

ISO 42001 is clear that the management system covers AI you procure and deploy, not just AI you build. In plain English: govern it like you built it.

What does that look like? Before buying, ask the vendor the questions you would ask your own team: what data was it trained on, how was it tested, what are its known limits, how do we monitor it? Put AI responsibilities in the contract, not just the sales deck. Keep monitoring it after deployment, because vendor updates can change behavior overnight.

This is familiar territory if you have ever done vendor management. Same discipline, new subject matter. You would not outsource your finances without oversight. Do not outsource your decisions without it either.

Their model. Your responsibility. Act accordingly.

I explain frameworks; I don't give legal counsel.