Using Third-Party AI Tools? You’re Still Responsible for Its Mistakes

There’s a common misconception that, if you didn’t build the AI, you’re not responsible for it. Unfortunately, that’s not the reality. It’s easy to see why this idea exists. After all, the technology belongs to the vendor. All the training was done by somebody else and the software is presented to you as a finished product. It’s easy to think that the company that built that product would be responsible for something going wrong. 

In the eyes of regulators, though, it's not that simple. In reality, the company using the software is the one expected to explain it. If an AI tool influences a business outcome (like hiring decisions, or interacting with customers via an AI chatbot) then you’re responsible, regardless of how you acquired it. Outsourcing the technology doesn’t mean outsourcing the accountability.

Very few businesses develop their own AI systems. Most get their AI tools in the form of third-party software or cloud platforms. 

The appeal of these kinds of tools is pretty obvious. They’re quick and easy to deploy, they’re relatively inexpensive, and you don’t often need much technical know-how to use them. It’s much easier to buy a third-party chatbot and accept the terms of use than it is to develop your own in-house model, especially if you’re an SME or on a limited budget. In fact, for most businesses third-party tools are often the only realistic option for getting advanced AI capability into your workflow. 

But convenience comes with a trade-off. 

The more AI systems you rely on, the less visibility you tend to have into how they actually work. While most businesses understand what the tool does, fewer understand how the actual model behaves, or how it was trained. As far as governance is concerned, that matters.

It’s easy to assume the vendor carries most of the risk. They trained the model and designed the system after all. 

But once you adopt an AI system, and it becomes part of your workflow, its decisions become part of your business process. If a recruitment platform filters out qualified candidates, that affects your hiring decisions. 

Regulators are more interested on the impact of the system rather than who owns the original code. This is particularly clear in emerging regulatory frameworks. Laws like the EU AI Act focus on how AI systems are used and what effects they have, rather than who originally developed them. That means businesses using third-party AI systems are still expected to demonstrate oversight.

In many businesses, third-party AI systems are treated like any other software purchase. They're bought, they’re approved, and then they’re rolled out to the relevant people. From a governance perspective, that’s usually where the process stops. 

Over time these systems become part of everyday workflows. People begin to rely on them without giving much thought to how the outputs are produced or how the system behaves behind the scenes. 

The problems usually take a while to appear. A model update might subtly change the behaviour of a tool, or a new training dataset might turn out to be less reliable than expected. The system could also simply start influencing decisions more heavily than planned. 

While these things aren’t exactly dramatic problems on their own, if they don’t have the right oversight they can quickly snowball out of control. 

Eventually the organisation is stuck relying on systems it doesn’t fully understand. That’s one of the most common governance issues faced by modern businesses. 

Governance doesn’t require businesses to reverse engineer every AI model they use, but it does require visibility. 

At a minimum, organisations should know which AI systems they rely on and where those systems impact decision making. 

Maintaining a clear inventory of AI tools is often the first step. Many businesses gravely underestimate just how many AI-driven systems they’re relying on for their day to day workflows. 

Vendor oversight also becomes important. This doesn’t mean questioning absolutely everything, but it does mean understanding the basic characteristics of the system. You should know what data is being used to train the underlying model, what limitations the vendor acknowledges and also how to interpret the outcomes of the system. 

Human oversight should be a consistent part of the process, especially where decisions affect customer and employees. 

AI systems change with new updates, or if models are retrained, so continuously monitoring outputs should be a priority. Governance needs to account for changes rather than assuming the system will always behave the same way. 

This kind of oversight is exactly what modern AI governance frameworks are designed to support. Standards like ISO/IEC 42001 focus on building artificial intelligence management systems (AIMS) that allow organisations to maintain visibility and accountability even when the underlying technology belongs to an external vendor. 

Third-party AI tools aren’t going anywhere. In fact, most of us will only increase our reliance on them in the coming years. 

But outsourcing the technology doesn’t remove the responsibility to manage its impact. Once an AI system becomes part of your workflow, its outputs influence your decisions, your customers, and ultimately your business outcomes. 

Those that succeed with AI aren’t necessarily the ones building the most sophisticated models, but the ones that take responsibility for their AI tools, and understand how their decision making will be shaped by the use of those tools.