A common assumption is that if "the AI" made a mistake, the vendor or the tool is to blame. Courts, regulators and auditors do not see it that way. The organization that deploys AI owns its outputs, just as it owns what its employees and its website say.
Why this matters in finance
- AI-drafted figures in reports and filings are your company's statements.
- An AP agent that pays the wrong supplier is your control failure.
- A chatbot that tells a customer the wrong refund or credit policy can bind you.
- Contract clauses that shift liability to the vendor are usually narrow and capped.
Four questions to settle before go-live
- Who is the owner of this AI use, by name?
- What is the human checkpoint, and what evidence shows it happened?
- What can the AI commit the company to (payments, prices, policies, filings), and is that limited?
- How will errors be found and fixed: monitoring, sampling, complaints, a kill switch?
What good looks like
- An inventory of AI uses with owners.
- Approval limits for AI, like a delegation-of-authority matrix for people.
- Customer- and supplier-facing AI that draws only on approved content.
- Contracts with vendors that cover accuracy commitments, logging, incident notice and audit rights, while accepting that accountability stays with you.
Common traps
- Treating a vendor's accuracy claim as your control.
- Letting a pilot become production without anyone noticing the change in risk.
- Customer-facing AI that answers from the open web rather than your approved policies.