A persistent governance gap is emerging in organizational AI implementations, especially among clients of MSPs. Despite the integration of AI in regulated sectors like wealth management and construction, most MSPs are neither engaged at project inception nor maintain oversight through formal policies or audit-ready documentation. Specific examples include deployments using technologies such as Claude, where neither roles for approving AI configurations nor processes for tracking data access are uniformly established.
A key development is the insufficiency of existing evidence and controls around AI use. Fewer than 20% of current client projects have written AI policies, and among 53 surveyed family offices, 80% are using AI without documented policy guidance. Insurers have started to introduce generative AI exclusions (e.g., CG4047), shifting the liability and evidentiary burden onto clients and their MSPs. Auditors now require dated, traceable documentation demonstrating that controls align with enacted policy, especially when AI accesses sensitive platforms like Microsoft 365.
Related discussions further illustrate the depth of this issue. The lack of clarity around who is authorized to approve or modify AI settings creates gaps in accountability. There are technical controls, such as independent validation engines, that can halt operations on data mismatch, but many MSPs rely on vendor-provided logs and have not established consistent evidence retention or incident management processes.
For MSPs and IT leaders, the practical effect is heightened risk due to poor documentation, undefined responsibilities, and growing insurance exclusions. Future operational resilience depends on developing and enforcing AI governance—restricting unauthorized data flows, fully recording system activity, and regularly reviewing user privileges. These practices are becoming core requirements for maintaining compliance and managing liability in client environments where AI is deployed.