Before Trusting an AI Model, Set Rules for the Data Beneath It

← Back · ACT III · Chapter 20: The Buyer Value Practice

Buying the model and calling it done leaves the foundation ungoverned; a standard sets what value must satisfy beneath the model, before anyone certifies anything.

What leadership pictures when it pictures AI readiness is a model resting on data. What readiness actually takes is everything underneath it: agreed definitions, documented lineage, named data owners, quality rules somebody enforces, audit trails, access controls. Most organizations bought the top of that picture and called it a deployment.

That much is not a new observation, and it is worth saying so plainly. Every firm selling an AI readiness assessment publishes some version of it, and they are right about it. The question they tend not to reach is the one that matters here. It is not who maintains each layer, or even who answers when one of them fails. It is what the whole foundation is required to satisfy before a model is trusted to sit on top of it, and a deployment answers none of that. It connects the model and turns it on.

A Deployment Is Not A Foundation

Wiring a model to data is the part everyone can see. What can actually be certified sits underneath it, and a foundation assembled without a governing standard is a set of separate efforts that happen to coexist. Each layer is somebody’s project, held together by attention rather than by a shared condition. It works until one of them fails in a way that touches a number an executive signed, and then it turns out no one was governing the whole, only tending the parts.

A Standard Governs The Foundation, Not Only The Model

Value governed by a standard states what the definitions, the lineage, and the records must satisfy as a condition of the value being recognized at all. That is a different thing from a checklist a team assembles and then has to defend, because the requirement is already in place before anything is trusted above it.

The market has moved part of the way there on its own. ISO/IEC 42001:2023, published on 18 December 2023, is the first international standard for artificial intelligence management systems, and it is written as auditable requirements, so an organization can be certified against it. A certifiable standard is now something a buyer can ask for instead of a demonstration.

It is worth being exact about what that standard is, though, because it is not quite the thing this post argues for. ISO/IEC 42001 is a management system standard. An organization adopts it, staffs it, and is audited against its own implementation of it. In the terms below, it is a standard you host.

Buyer Governed, Not Framework Adopted

Here is the distinction worth holding. A management framework is something an organization adopts, staffs, and keeps implementing, and the foundation is only ever as strong as the program maintaining it this quarter. Value that is buyer governed does not depend on the program. Custody is a structural default, and the foundation stays legible because value that does not conform is not recognized, rather than because a committee kept it tidy before the audit. One is a standard you hold. The other is a standard you host.

That is the same argument an office cannot settle by being created, and it is why a separate channel built to watch the work does not settle it either. Connecting the model was never the deployment. What sits beneath it has to be governed by a standard the buyer holds.

References

ISO/IEC 42001:2023, AI management systems, International Organization for Standardization, published 18 December 2023, Edition 1: iso.org/standard/42001. Publication date, edition, technical committee and certifiable scope read from the ISO catalogue record, September 2026.

Keep reading: ACT III · Chapter 20: The Buyer Value Practice