Enterprise AI Part 7

In this week’s Data Diaries, we close the series at the vendor contract. Last week’s inference-hub thesis pivots from infrastructure to operations, where vendor selection and exit strategy share the same file. This is Enterprise AI, part 7.

AI is just another contractor — a contractor that is not human, that is gullible, and that is extremely fast. Frame the vendor due diligence question that way and the answer clarifies: how do you control a workforce of these contractors before you sign? The Open Worldwide Application Security Project (OWASP) LLM Top 10 (2025) and the OWASP Agentic AI Top 10 (2026) name what your contractor faces every shift — prompt injection, sensitive-information disclosure, memory poisoning. Anthropic disclosed the GTG-1002 campaign on November 14, 2025, documenting AI agents executing 80-90% of the work in a real intrusion — proof that someone can weaponize this contractor at scale.

ISO/IEC 42001:2023 sits on top as the audited management standard; early holders include Microsoft, Cornerstone Galaxy, and Miro. You want the Swiss cheese model — physical, architectural, legal, and network layers stacked so the holes never line up. No single control catches everything, and the gaps in one layer must land where the next layer holds.

Skip the legal review on your service-level agreements and you forfeit contractual remedy when prompts leak into a vendor’s training corpus. Skip the architectural layer — model router, guard model, sane defaults — and your employees route confidential documents to whichever model they prefer that day. Skip the network layer and exfiltration goes unnoticed until a customer reads your IP back in someone else’s product. The Bartz precedent named the cost of getting this wrong, and EU AI Act Article 53 with DSM Directive Article 4 now compel general-purpose AI providers to publish training-data summaries and honor rightholder opt-outs; your due diligence checklist must verify both before signature.

Start discovery this Tuesday. Pull last month’s corporate Amex statements, strike every charge already covered by an SLA, and dig into what’s left — that residue is your shadow-AI inventory. If you carry an enterprise Copilot license and your firewall shows steady traffic to gemini.google.com or claude.ai, your contractor went rogue. Partner with IT, audit by workstation, and treat the find as the security event it is.

Then build the Plan B before you sign the renewal. Run purely on cloud inference and the vendor owns your exit; when they raise prices from five dollars per million tokens to fifteen, you pay. Stand up an inference hub under your control on Article 6’s logic, run mid-size open models with guard models and read-only access to internal resources, and the next price hike becomes “good luck to you.” The strongest vendor control is not needing the vendor.

Run every active AI vendor against five questions before contract:

• ISO/IEC 42001:2023 certification status and scope.
• SOC 2 Type II controls weighted against the NIST AI RMF and MITRE ATLAS Secure AI v2.
• Training-data provenance and rightholder opt-out per EU AI Act Article 53 / DSM Directive Article 4.
• Data and model residency under your jurisdiction’s regulated-sector rules.
• Exit ramp: contractual data return plus portability of fine-tuned model artifacts.

Run the checklist enterprise-wide this week, pair it with the Amex audit, and pilot an inference hub by quarter-end. Mid-market readers, run the five questions on your top three vendors and rewrite the SLA boilerplate before renewal. SMB and agency readers, productize the checklist as a service line — enterprise buyers will pay you to do it.

Across seven weeks we covered measurement discipline, governance, data boundaries, privacy, workforce, infrastructure, and vendor controls. The 6% pull away because they apply discipline; the rest run pilots and wait. Pick one move from each article, put them on the next AI Council agenda, and name an owner by Friday.

Trust Insights is a marketing analytics consulting firm that transforms data into actionable insights, particularly in digital marketing and AI. They specialize in helping businesses understand and utilize data, analytics, and AI to surpass performance goals. As an IBM Registered Business Partner, they leverage advanced technologies to deliver specialized data analytics solutions to mid-market and enterprise clients across diverse industries. Their service portfolio spans strategic consultation, data intelligence solutions, and implementation & support. Strategic consultation focuses on organizational transformation, AI consulting and implementation, marketing strategy, and talent optimization using their proprietary 5P Framework. Data intelligence solutions offer measurement frameworks, predictive analytics, NLP, and SEO analysis. Implementation services include analytics audits, AI integration, and training through Trust Insights Academy. Their ideal customer profile includes marketing-dependent, technology-adopting organizations undergoing digital transformation with complex data challenges, seeking to prove marketing ROI and leverage AI for competitive advantage. Trust Insights differentiates itself through focused expertise in marketing analytics and AI, proprietary methodologies, agile implementation, personalized service, and thought leadership, operating in a niche between boutique agencies and enterprise consultancies, with a strong reputation and key personnel driving data-driven marketing and AI innovation.