How can you ensure AI vendors and products are secure and reliable?

When selecting an AI vendor, due diligence is crucial for security and reliability. First, vet the vendor's credentials and reputation. Assess their expertise and ethical standing by looking for indicators like publications, awards, and customer reviews. Avoid those with a history of security issues or poor performance. Second, scrutinize their AI governance—policies and procedures should clearly outline how they manage risks, ethics, and compliance. Transparency and accountability are essential. Third, consider using AI to aid in vendor selection, analyzing metrics like pricing and quality to make data-driven decisions. Finally, establish a strong communication channel with the vendor. Utilize their expertise to optimize the product.

Industry certifications serve as a testament to a vendor's proficiency and commitment to industry standards. They act as a third-party validation, ensuring that the vendor possesses the necessary skills, knowledge, and best practices in their domain. Certifications can significantly reduce the guesswork for businesses in the evaluation process. They offer a benchmark for quality, suggesting that the vendor adheres to recognized standards and remains updated with the latest trends. Furthermore, a vendor with multiple relevant certifications demonstrates a continual investment in learning and excellence, which can be a strong indicator of reliability and expertise in their field.

In addition when deciding on an AI vendor's product make sure that the product adheres to your internal security, risk and governance standards. This will include an end-to-end analysis of the product's data use (type of data, ethical use, and how its stored). There are also organizations which can access the ethics and trustworthyness of the AI product.

I found from my experience that certifications can be tricky to rely on. Information asymmetry and sponsored narratives is a deadly combination that intuitively makes us use certifications as a means to establish trust. Not many may be aware of this, but to give an example, ISO develops certification standards but does not by itself offer the certification. So the certification itself can be called into question sometimes! My recommendation is to triangulate signals from several sources to build your trust. There is no one size fits all here - but I would go with my gut and derive my trust from personal conversations with vendors, and their reference customers. The more conversations, the more signals! Kept me in good stead so far.

Consider asking if the vendor holds certifications like SOC2, which signifies adherence to high standards in security, availability, and confidentiality. SOC2, in particular, is recognized industry-wide and provides assurance that the vendor has robust controls in place. Similarly, ISO 27001 or GDPR compliance can indicate their commitment to international security and privacy standards. It's not just about having these certifications but understanding how they implement and maintain them. Periodic third-party audits or penetration tests can also provide insights into their security posture. Always prioritize vendors that are transparent about their security practices and are proactive in ensuring data safety.

I would say additional to the above, observe, if possible research before investing what is the vendor attitude post sale. Unfortunately, we are all way to used to be contacted by our suppliers only when renewal date is due or when they have a new product which they want us to pay for. I am referring here at everything, broadband, mobile phones, you name it. In my view, a reliable vendor will have a customer care team which will religiously touch base with the customers through-out the contractual period without any intention of selling everything but purely to offer support, check out how the solution is delivering against the expected outcomes and offer advice and share best practices to ensure you take complete advantage of the sol.