Global Community

I thought about this over the weekend.

Do you expect customers will eventually require suppliers to demonstrate AI Governance just as they require Quality Management Systems today?

I ask because many customers within manufacturing require suppliers be ISO 9001 certified before doing any business with them.

I appreciate any expertise you can offer.

Thanks.  BK

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Billie, my honest read is yes, but it will arrive unevenly rather than as one clean switch. ISO 9001 became a purchasing gate because customers needed a shorthand for "this supplier is in control of its processes", and AI governance is heading the same way now that suppliers are quietly putting AI into design, inspection and decision making. The push will come first from regulated and safety sensitive supply chains and from the large OEMs who carry the liability if a supplier model gets something wrong.

What is different this time is the pace. Quality systems took decades to become a contractual norm, whereas the regulatory pressure on AI, such as the EU AI Act, is moving fast enough that customers may start asking for evidence of governance before a formal certification market fully matures. ISO 42001 gives them a recognisable framework to point at, much as 9001 did, so I would expect the early asks to look like supplier questionnaires and clauses in agreements, then harden into certification requirements for the higher risk categories over time.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------

Thanks for your reply, Dilawar.

I tend to agree with you.  This is the first standard I've seen in a long time that I think will be as game-changing as 9001 was and still is.

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Original Message:
Sent: 07-10-2026 11:33 PM
From: Dilawar Laghari
Subject: AI Governance: The Future

Billie, my honest read is yes, but it will arrive unevenly rather than as one clean switch. ISO 9001 became a purchasing gate because customers needed a shorthand for "this supplier is in control of its processes", and AI governance is heading the same way now that suppliers are quietly putting AI into design, inspection and decision making. The push will come first from regulated and safety sensitive supply chains and from the large OEMs who carry the liability if a supplier model gets something wrong.

What is different this time is the pace. Quality systems took decades to become a contractual norm, whereas the regulatory pressure on AI, such as the EU AI Act, is moving fast enough that customers may start asking for evidence of governance before a formal certification market fully matures. ISO 42001 gives them a recognisable framework to point at, much as 9001 did, so I would expect the early asks to look like supplier questionnaires and clauses in agreements, then harden into certification requirements for the higher risk categories over time.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------

Glad it resonated, Billie. The reassuring part is that 42001 is a management system standard, so a lot of the implementation is governance you already know from 9001, risk thinking, defined roles, competence and control of change. The genuinely new effort sits around data quality, model lifecycle and impact assessment, which is where I think the early adopters will spend most of their time.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------

Original Message:
Sent: 07-17-2026 10:33 AM
From: Billie King
Subject: AI Governance: The Future

Thanks for your reply, Dilawar.

I tend to agree with you.  This is the first standard I've seen in a long time that I think will be as game-changing as 9001 was and still is.

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------


Original Message:
Sent: 07-10-2026 11:33 PM
From: Dilawar Laghari
Subject: AI Governance: The Future

Billie, my honest read is yes, but it will arrive unevenly rather than as one clean switch. ISO 9001 became a purchasing gate because customers needed a shorthand for "this supplier is in control of its processes", and AI governance is heading the same way now that suppliers are quietly putting AI into design, inspection and decision making. The push will come first from regulated and safety sensitive supply chains and from the large OEMs who carry the liability if a supplier model gets something wrong.

What is different this time is the pace. Quality systems took decades to become a contractual norm, whereas the regulatory pressure on AI, such as the EU AI Act, is moving fast enough that customers may start asking for evidence of governance before a formal certification market fully matures. ISO 42001 gives them a recognisable framework to point at, much as 9001 did, so I would expect the early asks to look like supplier questionnaires and clauses in agreements, then harden into certification requirements for the higher risk categories over time.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------

Yes, I believe that's the direction the industry is heading. As organizations adopt AI in their business processes, customers will increasingly want assurance that suppliers have appropriate AI governance, risk management, and security controls in place.

Similar to how ISO 9001 became a standard requirement for quality management, I expect AI governance frameworks, such as ISO/IEC 42001, along with guidance from the NIST AI Risk Management Framework (AI RMF), will become important differentiators-and eventually contractual requirements-in many industries, especially manufacturing, healthcare, finance, government, and critical infrastructure.

Initially, customers may request AI policies, risk assessments, and governance documentation during supplier assessments. Over time, formal AI management system certifications could become as common as ISO 9001 or ISO 27001 for organizations that develop or use AI in products and business operations.

------------------------------
MOHAMMAD SHOAIB ALVI
GRC Consultant.
www.abmnetworks.com
------------------------------

Very well said, Sir!  

I must say that I am looking forward to this new chapter/standard within the ISO universe.  Implementation expertise of 42001 truly stands out to me.  Thanks again.  BK

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Original Message:
Sent: 07-13-2026 11:31 AM
From: MOHAMMAD SHOAIB ALVI
Subject: AI Governance: The Future

Yes, I believe that's the direction the industry is heading. As organizations adopt AI in their business processes, customers will increasingly want assurance that suppliers have appropriate AI governance, risk management, and security controls in place.

Similar to how ISO 9001 became a standard requirement for quality management, I expect AI governance frameworks, such as ISO/IEC 42001, along with guidance from the NIST AI Risk Management Framework (AI RMF), will become important differentiators-and eventually contractual requirements-in many industries, especially manufacturing, healthcare, finance, government, and critical infrastructure.

Initially, customers may request AI policies, risk assessments, and governance documentation during supplier assessments. Over time, formal AI management system certifications could become as common as ISO 9001 or ISO 27001 for organizations that develop or use AI in products and business operations.

------------------------------
MOHAMMAD SHOAIB ALVI
GRC Consultant.
www.abmnetworks.com
------------------------------

Hey Billie,

------------------------------
David New
Executive
Dyadic Consultancy
------------------------------

Dave,

I appreciate that fact you pointed out the gaps, failures, privacy concerns and unintended failures being experienced today by companies with substantial resources.  This is very important!  This is something I need to research for myself now that you've pointed it out.  Thanks for that, as I see opportunity.

I am very excited to see what the minimum declaration and governance for AI use looks like in practice.  When I first became an ISO 9001 auditor, the amount of documentation companies kept was overkill, in my opinion.  Eventually, it balanced.  It makes me wonder if the same will happen with AI Governance, as well?

Thanks again for your feedback.  I do appreciate it!  BK

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Original Message:
Sent: 07-14-2026 06:30 AM
From: David New
Subject: AI Governance: The Future

Hey Billie,

From my experience in regulated industries, AI is increasingly being viewed as a risk management and governance issue rather than simply a technology issue.

The reality is that even some of the largest consulting and technology firms (the so-called 'Big 4') continue to make headlines for AI-related failures, governance gaps, privacy concerns, and unintended consequences. If organisations with substantial resources struggle to govern AI effectively, customers will inevitably begin asking the same questions of their suppliers.

I suspect the evolution will be similar to ISO 9001. It will start with supplier questionnaires, contract clauses, and due diligence activities before maturing into recognised frameworks and, potentially, certification requirements where AI influences quality, compliance, safety, or business-critical decisions.

Whether ISO/IEC 42001 becomes the "ISO 9001 of AI" remains to be seen. Still, I would be surprised if demonstrable AI governance does not become an expected supplier capability within the next few years. At a minimum, organisations are likely to face contractual obligations to declare and govern their use of AI, or formally attest that AI is not being used.

Cheers,

Dave.

------------------------------
David New
Executive
Dyadic Consultancy
------------------------------

Hello Billie King, 

It depends on what Customer needs from the Suppliers. Therefore, related Assurances, Guarantees or Warranties will encourage suppliers to develop, obtain, or maintain such certifications and standards.  

I see as of today in standards Customers look for the quality and that's where we are now in current norms. As for the AI Governance it depends on what customer is looking for or What the supplier is supplying. Yes, we know every organization is using AI in some business areas but still in the context of supplier-customer relationship it depends on the product or service you supply to ask if there is an AI Governance. 

If by any chance you are supplying a product with AI at a big scale or even with a simple edge case, then I am expecting that ISO 42001 will start to show up becoming a new normal as it involves both Customer Data and AI Prescriptions / Predictions which may put customers at risk beside region specific regulations.

------------------------------
Chand B. Shaik
IT Audit Expert, GOSI
Riyadh, Saudi Arabia
https://linkedin.com/in/cshaik
------------------------------

Hello Chand Basha Shaik

Thank you for your thoughtful perspective. I agree that customer expectations will ultimately be the primary driver behind supplier adoption. Historically, we've seen organizations pursue certifications not simply because they wanted them, but because the market began expecting them.

The point that I continue to wrestle with is when AI governance transitions from being product-specific to becoming an enterprise expectation. Today, a customer may only ask about AI governance when AI is embedded directly into a product or service. However, what happens when suppliers begin using AI extensively for engineering, quality planning, process control, purchasing, auditing, or customer support-even though AI isn't part of the final product? Those internal decisions can still influence product quality, consistency, compliance, and ultimately customer risk.

It makes me wonder whether we're heading toward a future where customers won't just ask, "Does your product use AI?" but rather, "How is AI governed throughout your organization?" That shift, in my opinion, is where ISO/IEC 42001 could become far more significant than many organizations currently anticipate.

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------

Original Message:
Sent: 07-16-2026 05:49 AM
From: Chand Basha Shaik
Subject: AI Governance: The Future

Hello Billie King, 

It depends on what Customer needs from the Suppliers. Therefore, related Assurances, Guarantees or Warranties will encourage suppliers to develop, obtain, or maintain such certifications and standards.  

I see as of today in standards Customers look for the quality and that's where we are now in current norms. As for the AI Governance it depends on what customer is looking for or What the supplier is supplying. Yes, we know every organization is using AI in some business areas but still in the context of supplier-customer relationship it depends on the product or service you supply to ask if there is an AI Governance. 

If by any chance you are supplying a product with AI at a big scale or even with a simple edge case, then I am expecting that ISO 42001 will start to show up becoming a new normal as it involves both Customer Data and AI Prescriptions / Predictions which may put customers at risk beside region specific regulations.

------------------------------
Chand B. Shaik
IT Audit Expert, GOSI
Riyadh, Saudi Arabia
https://linkedin.com/in/cshaik
------------------------------

Billie, I think that shift has already started, just not under the name AI governance. When AI sits inside engineering, purchasing or quality planning, the risk usually surfaces as a change control and competence question first. An auditor asking how a supplier validates a process change, or who is accountable for a decision and on what evidence, will land on the model whether or not anyone calls it AI.

Where 42001 earns its place is that it gives that conversation a home. Scope becomes the honest question, because an organisation using AI internally has to decide what actually sits inside the management system rather than pointing at a product. My guess is customers get there through their existing supplier questionnaires first, adding a few questions about internal use, and the certification ask follows once they realise a policy statement on its own tells them very little.

------------------------------
Dilawar Laghari
Auditor, Consultant and Trainer
AuditWorkshop.com
------------------------------

Original Message:
Sent: 07-17-2026 10:59 AM
From: Billie King
Subject: AI Governance: The Future

Hello Chand Basha Shaik

Thank you for your thoughtful perspective. I agree that customer expectations will ultimately be the primary driver behind supplier adoption. Historically, we've seen organizations pursue certifications not simply because they wanted them, but because the market began expecting them.

The point that I continue to wrestle with is when AI governance transitions from being product-specific to becoming an enterprise expectation. Today, a customer may only ask about AI governance when AI is embedded directly into a product or service. However, what happens when suppliers begin using AI extensively for engineering, quality planning, process control, purchasing, auditing, or customer support-even though AI isn't part of the final product? Those internal decisions can still influence product quality, consistency, compliance, and ultimately customer risk.

It makes me wonder whether we're heading toward a future where customers won't just ask, "Does your product use AI?" but rather, "How is AI governed throughout your organization?" That shift, in my opinion, is where ISO/IEC 42001 could become far more significant than many organizations currently anticipate.

------------------------------
Billie King
Supplier Quality Engineer
Hussmann Corp.
------------------------------


Original Message:
Sent: 07-16-2026 05:49 AM
From: Chand Basha Shaik
Subject: AI Governance: The Future

Hello Billie King, 

It depends on what Customer needs from the Suppliers. Therefore, related Assurances, Guarantees or Warranties will encourage suppliers to develop, obtain, or maintain such certifications and standards.  

I see as of today in standards Customers look for the quality and that's where we are now in current norms. As for the AI Governance it depends on what customer is looking for or What the supplier is supplying. Yes, we know every organization is using AI in some business areas but still in the context of supplier-customer relationship it depends on the product or service you supply to ask if there is an AI Governance. 

If by any chance you are supplying a product with AI at a big scale or even with a simple edge case, then I am expecting that ISO 42001 will start to show up becoming a new normal as it involves both Customer Data and AI Prescriptions / Predictions which may put customers at risk beside region specific regulations.

------------------------------
Chand B. Shaik
IT Audit Expert, GOSI
Riyadh, Saudi Arabia
https://linkedin.com/in/cshaik
------------------------------