Notifications
Clear all
Topic starter
22/07/2026 4:37 pm
TL;DR: Procurement teams are increasingly asking how AI systems are governed after deployment, because accountability for harmful outputs, data leakage, and incorrect decisions stays with the deploying organisation, according to Drata and RAIDS. The shift turns continuous monitoring, evidence collection, and incident response into buying criteria rather than back-office controls.
NHIMG editorial — based on content published by Drata: AI governance is becoming a sales enabler
Questions worth separating out
Q: How should security teams govern AI in cybersecurity operations?
A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature.
Q: Why does AI procurement now include governance questions?
A: Because buyers understand that a model's behaviour can create legal, operational, and reputational impact after deployment.
Q: What do organisations get wrong about AI transparency obligations?
A: They often focus on model descriptions and miss the operational evidence underneath them.
Practitioner guidance
- Require runtime governance evidence before procurement approval Ask vendors to show monitoring logs, escalation logic, and incident handling for live AI behaviour, not just policy statements and architecture diagrams.
- Map AI ownership to enterprise accountability controls Assign clear ownership for AI outputs, exception handling, and remediation inside the organisation, even when the model is third-party supplied.
- Add AI behaviour review to existing risk and access processes Use the same discipline applied to high-risk access and change management to review AI system drift, anomalous outputs, and approval exceptions.
What's in the full article
Drata's full article covers the operational detail this post intentionally leaves for the source:
- How the procurement questions are being framed inside enterprise buying cycles, including governance evidence requests and approval criteria.
- The interplay between AI governance automation, evidence collection, and runtime monitoring in vendor evaluation.
- The Air Canada chatbot case and how it is being used to shape buyer expectations about accountability and liability.
- How Drata and RAIDS position continuous monitoring and live audit trails in the sales process.
👉 Read Drata's analysis of how AI governance is changing procurement decisions →
AI governance in procurement: what buyers are asking for now?
Explore further
22/07/2026 4:41 pm
AI governance is becoming a procurement control, not just a compliance topic. Buyers are now asking whether a system can be approved, monitored, and explained after it goes live. That shifts governance from a policy artefact to an evidence-backed operating model. For practitioners, procurement is becoming the first place where AI control maturity is tested.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: AI governance is becoming a procurement requirement, not a policy note
