Six questions to ask about an AI platform

AI platforms tend to arrive in a company from the bottom up and get governed, if at all, from the top down and late. The gap between those two produces most of the risk, and it is not a new category of risk. It is the ordinary set of platform questions, asked about a tool that reached production without going through procurement.

The questions below are deliberately about mechanisms rather than vendors, because the vendors and their capabilities will keep changing and the questions will not.

1. Who can sign in, and how do they stop?

The tool federates with the identity provider, or it does not belong on company data. Where it does not support federation yet, that is a documented exception with a named owner and a review date, not a silent state.

The specific failure worth checking for is the one that predates any policy: people signing up individually with their work email address, on the vendor’s consumer tier, before the company had an opinion. Those accounts are outside the tenant, outside the contract, outside deprovisioning, and they are often discoverable. Many vendors can tell an administrator which addresses at a verified domain hold accounts.

2. What can it reach?

This is the question that distinguishes AI tooling from most other SaaS, and it is not about the model. It is about the connectors.

A tool connected to mail, file storage, a code repository, and a ticket system can bring the access granted to those connectors behind one prompt. The relevant question is not whether the vendor is trustworthy. It is what each connector can read on behalf of that user or tenant, whether existing ACLs are preserved, and whether the scopes it requested are the scopes it actually needs.

Enumerate the connectors. Review the scopes each one was granted. Many integrations ask for more than they use.

3. What happens to what goes in?

Retention period, and whether inputs are used to train. Both have contractual answers and tenant-level settings, and the two can disagree. Get the contractual position in writing, then verify the setting is configured to match, then re-check after any plan or tenant change. A tier change can quietly return a setting to its default.

4. What is the written boundary?

A short, concrete statement of what may and may not be put into these tools. Categories, not a list of prohibited words: customer data, credentials and keys, personal data, regulated data, unreleased material.

The value of writing it down is not enforcement. It is that people who want to comply currently have to guess, and most of them are guessing generously.

5. Can you see what happened?

Administrative visibility into who is using the platform, at what volume, and through which integrations. Without it, every other control is an assertion.

This is also the control that answers the question that arrives at the worst moment, after an incident or during a customer security review: some version of "was this data ever put into that tool". A platform that cannot answer it forces you to assume the worst.

6. Does the spend match observed usage?

Seat-based AI tooling accumulates dormant seats quickly, because adoption is enthusiastic and uneven: a subset of people use it constantly, a larger group tried it twice, and the invoice does not distinguish. Licenses also get assigned during a burst of interest and never reviewed.

Review seats against actual activity rather than headcount, and review the tier against the usage pattern rather than the feature list. This is unglamorous and it is consistently where the money is.

The framing

None of this is a reason to slow adoption down. The tools are genuinely useful and the companies that use them well have an advantage over the companies that do not.

But an AI platform is a platform. It gets identity, it gets access review, it gets a data boundary, it gets logging, and it gets a license review, on the same schedule as everything else in the estate. Treating it as a special category is what produces both the unmanaged version and the over-restricted version, and neither of those is governance.

Companion technical note: Where data actually leaves through an AI platform

Explore this expertise: AI Platform Governance

All technical notes