Your Vendor's AI Is Your Responsibility Too

Here's something that surprises small business owners: when your software vendor adds AI to their product, their AI becomes your responsibility too.

That invoicing app that now "smartly categorizes" expenses? The customer platform with the new AI assistant? Your business data flows through those features, and your customers hold you accountable for what happens to it — not the vendor.

So ask your vendors the same questions you'd ask about your own tools: what data does the AI feature use? Can I turn it off? Where does my data go? You don't need a legal department to ask — you need an email. Most vendors have these answers ready; they just don't volunteer them.

This is vendor management in plain English: knowing what the companies you pay are doing with your information. Big companies formalize it with frameworks — ISO/IEC 42001, published in December 2023, gives organizations a way to manage AI responsibly, and it's starting to show up in enterprise contracts. You don't need the certificate. You need the questions.

Your stack is your responsibility, all the way down. Ask the questions.

I explain frameworks; I don't give legal counsel.