You probably bought your AI

Thesis

Most SMBs and NfPs don’t build models; they use AI inside tools they bought. ISO 42001 still applies, shaped by the role they play, and the part they can’t outsource is the impact on their own people and clients.

Reader

An ops lead or NfP manager who assumes AI governance is for companies that build AI.

Opening failure

An organisation says it “doesn’t use AI”, while its CRM scores leads, its support desk drafts replies and its recruiting tool ranks applicants.

Beats

1. Find the AI you didn’t know you had. This is the visibility problem from piece 8, from the governance side.
2. Your role sets your obligations. Clause 4.1 asks you to determine your roles with respect to your AI systems (provider, producer, customer and so on). A deployer still owns its context and its impacts.
3. Suppliers and customers. Annex A.10 covers third-party and customer relationships: who is responsible for what, and what you ask suppliers for.
4. What you can’t outsource: the impact assessment on the people your use of the tool affects.

Checks to do

Confirm the 4.1 role wording and the A.10 control titles against the standard text.

Market angle

This is the most common real situation for all three markets, and the one most advice skips.

What you can do on Monday

List your ten most-used business tools and ask each vendor which AI features are switched on and what they call.