AI Governance: Why Customers Are Starting to Ask Questions Before Doing Business

Artificial Intelligence (AI) is becoming an important part of business operations. As more organisations use AI in their products and services, customers are also becoming more careful about how these technologies are being used.

Similar to the questions businesses started receiving about data privacy and information security, AI-related questions are now becoming part of customer assessments and procurement processes. This change is happening much faster than many organisations expected.

Customers want to understand how AI is used, who controls it, and what steps are taken when it produces incorrect results.

What Are Customers Asking About?

When evaluating suppliers, customers are increasingly asking some important questions:

1. Does Your Organisation Use AI?

Customers want to know whether AI is being used to deliver products or services. Many businesses may not even realise that they are using AI because it is already included in the software and digital tools they purchase.

2. How Is AI Used in Business Decisions?

There is a difference between using AI to suggest ideas and allowing AI to make important decisions. Customers want to understand whether a person reviews AI-generated results or whether the system makes decisions independently.

3. What Data Is Used by AI Systems?

Organisations need to explain what information is provided to AI systems and whether customer data is being used to train AI models. Protecting confidential and sensitive information is an important concern.

4. Is There Human Supervision?

Customers want to know whether employees are actively monitoring AI-generated results, whether they can correct mistakes, and whether they have the authority to make changes when required.

5. What Happens When AI Makes a Mistake?

No AI system is perfect. Businesses should have a process to identify errors, monitor system performance, report problems and take corrective action.

6. Can AI Decisions Be Explained?

Organisations should be able to explain how AI reaches its results, especially when those results affect customers, employees or important business decisions.

Why Are Organisations Finding It Difficult to Answer?

One major reason is that AI is often introduced gradually across different departments.

For example:

• Employees start using AI tools to complete their daily tasks.

• Software providers introduce AI-based features into existing products.

• Developers use AI models to improve business applications.

• Different teams adopt AI tools without informing the management.

As a result, organisations may not have a complete record of where and how AI is being used.

When a customer asks, "Does your organisation use AI to deliver our services?", the business may first need to check internally before providing an answer.

This shows why having a clear AI management process is becoming important.

How Does ISO/IEC 42001 Help?

ISO/IEC 42001:2023 is an international standard that provides a framework for establishing, implementing and maintaining an Artificial Intelligence Management System (AIMS).

It helps organisations:

• Identify and maintain a record of where AI is being used.

• Define responsibilities for managing AI systems.

• Assess potential risks associated with AI.

• Understand the impact of AI on individuals and society.

• Establish appropriate human supervision and monitoring.

• Manage AI-related errors and take corrective action.

• Improve transparency and accountability in AI operations.

By following ISO/IEC 42001, organisations can develop a more structured approach to managing AI and demonstrate that they are taking AI governance seriously.

AI management certification is also gaining attention, much like ISO 27001 certification did for information security.

Where Should Organisations Start?

Before thinking about AI certification, organisations should begin with one simple question:

Where are we currently using AI in our business operations and services?

The assessment should cover not only AI applications developed internally but also AI features available in purchased software, applications and other business tools.

This exercise can help businesses identify areas they may have overlooked and understand their responsibilities towards customers.

As AI-related requirements become more common in customer assessments, regulatory expectations and supplier evaluations, organisations that understand and manage their AI usage will be better prepared for future business requirements.

The first step towards responsible AI is knowing where AI is being used and ensuring that it is properly managed.