Why vendor governance cannot be delegated to the vendor

Language and AI suppliers may publish security documentation, describe how models are used, provide quality data and maintain their own control frameworks. Where a supplier does this well, it is a valuable governance input and it is worth using.

It also creates a quiet risk. When a supplier presents a well-built control framework, it is tempting to adopt it as the organisation's own. The framework is credible, the alternative is work and the supplier is closer to the operational detail. So governance drifts across the contract boundary, usually without anyone deciding that it should.

Execution and accountability are different things

A supplier can run a control. It cannot hold your accountability for the outcome. If content published in your name misleads a customer or misstates an obligation, the conversation with the regulator, the customer or the board is yours. Contractual recourse may recover cost. It does not recover the decision.

This is not an argument against relying on suppliers. It is an argument for being precise about which parts of governance are delegable. Operating a control is delegable. Deciding what the control should be is not.

What suppliers should provide

A capable supplier is a substantial governance asset. They can describe which models and tools are used at each step, and notify you when that changes. They can produce evidence of review, including who reviewed what and against which instructions. They can report exceptions rather than absorbing them quietly. They can confirm how your content and data are handled, retained and used.

Asking for these is reasonable. Where a supplier cannot describe how its own controls operate, that is a finding regardless of output quality.

What has to stay with you

The decision criteria remain yours. Which content is suitable for machine generation, which requires human review, which must not go near an external model at all. A supplier can advise on feasibility. Only the organisation can decide what it is willing to accept.

Acceptable risk thresholds remain yours, and they vary by market and content class in ways a supplier cannot fully see. Content segmentation remains yours, because it depends on internal knowledge of regulatory exposure, commercial sensitivity and customer impact. Sign-off remains yours, because approval is an assertion by your organisation. Oversight remains yours, because a supplier reviewing its own performance is a report, not independent verification.

The multi-supplier reality

Where an operation uses several parties, for example two language suppliers, an AI platform, an agency for campaign work and internal teams producing content directly, each may govern its own scope competently. None of them governs the space between them.

That space is where inconsistency accumulates: different quality definitions, different review thresholds, different terminology, different evidence formats. No supplier can resolve it because no supplier can see across it. The organisation is the only party with that view, which makes cross-supplier governance an internal function by definition.

A workable division

• The organisation defines content classes, rules and acceptable risk.
• Suppliers operate controls within those rules and report against them.
• The organisation specifies evidence format so submissions can be compared.
• Sign-off authority sits internally and is exercised, not assumed.
• Supplier performance is reviewed against your criteria, not the supplier's.

Ambiguity about who decides is a source of dispute for a supplier as much as for you. Clear criteria let a capable supplier demonstrate that it met them, rather than being judged against expectations that were never written down.