Gary Cheung · 2 October 2026 · 5-minute read
At a glance
- The risk: Vendor documentation can describe a product without showing that it is suitable for your specific workflow.
- The governance implication: Approval should connect evidence to the intended use, its limits, and the changes that would require a new decision.
- The leadership takeaway: Record why the business is willing to rely on the tool, what remains uncertain, and who can pause or reassess its use.
A vendor can provide a security report, a model description, and a successful demonstration. Your team can review every document and still lack a defensible answer to a basic question: why is this AI suitable for this business use?
The gap is between evidence about a product and evidence supporting your decision to rely on it. Closing that gap takes business judgment. More paperwork alone will not close it.
The Missing Layer: Decision Accountability
Vendor materials can inform an approval, but they cannot make it on your behalf. A product-level report may describe general controls or test results. It does not necessarily establish how the tool will behave with your data, users, workflow, or customers.
That distinction matters when a business moves from “the supplier has documentation” to “we have decided this use is acceptable.” The first is a statement about what the vendor provided. The second is an accountable choice about the conditions under which your organization will rely on the system.
Possessing evidence is not the same as having a defensible decision.
What the Sources Actually Say
NIST’s standards page, updated on 30 September 2026, records the release on 29 July 2026 of an initial public draft on public-facing AI documentation. It describes the “zero drafts” as preliminary contributions toward voluntary consensus standards. This is a documentation-development initiative—not a vendor certification or a final mandatory procurement rule. Read NIST’s source page.
For insurance context, EIOPA’s announcement of 6 August 2025 describes a risk-based, proportionate approach to AI governance. It says the Opinion clarifies existing principles rather than creating new requirements. These are European supervisory materials; their applicability to a particular business requires separate assessment. Read EIOPA’s announcement.
My practical interpretation is straightforward: use documentation to challenge the decision you intend to make. Do not treat possession of documentation as the decision itself.
From Vendor Evidence to Business Use
Imagine a small insurance intermediary considering an AI tool that drafts responses to customers’ coverage questions. The supplier demonstrates fluent answers using simple examples. The business wants to reduce the time staff spend preparing replies.
No automated underwriting or claims decision is planned. Even so, an inaccurate explanation could influence a customer’s understanding of their protection. A demonstration of fluency does not establish that the tool handles exclusions, ambiguous wording, or missing policy information appropriately.
A proportionate first approval might allow staff to use the tool for drafting, with a knowledgeable reviewer checking the relevant policy wording before anything reaches a customer. That is an operating boundary—not evidence that the model is reliable in every situation.
Three Questions Before Approval
1. What evidence relates to our actual workflow?
Ask which product version was tested, what examples were used, and where the tool struggled. Test representative tasks using appropriate, authorized data. Include incomplete information and awkward cases, not only the examples a supplier uses to demonstrate success.
A general accuracy score can be useful background. The leadership question is whether the evidence addresses the errors that would matter in this workflow. A wrong internal summary and a wrong customer explanation may need different approval conditions.
2. What uncertainty are we accepting?
Record what the evidence does not establish. Perhaps performance on unusual policy wording is unknown, or the supplier has not explained how a future update may affect behavior. Decide whether to gather more evidence, narrow the use, or defer deployment.
This makes the commercial trade-off visible. The business owner can explain why a limited use is worthwhile while acknowledging what has not been demonstrated. A risk review should clarify that choice rather than hide it behind a pass mark.
3. What would require us to decide again?
Identify changes that could alter the original approval: a new model version, a broader customer-facing role, access to more sensitive information, or removal of a human reviewer. Agree who must be informed and who can pause the workflow.
A supplier update should not silently expand the business’s original risk acceptance. Whether reassessment is needed depends on the change and its consequences; a routine calendar review may miss the important moment.
A Proportionate Decision Record
For a smaller team, start with one page: intended use; accountable business owner; evidence reviewed; important limitations; permitted operating conditions; and reassessment triggers. Link to the relevant supplier material instead of copying it into another lengthy framework.
The record is not a guarantee of safety or compliance. Its value is making the reasoning inspectable. If a customer problem occurs, leadership should be able to explain the basis for the decision and the limits that were meant to constrain it.
Questions for the Leadership Team
- What specific business use are we approving, and what uses remain outside the approval?
- Which important claims are supported by evidence from our workflow, and which remain assumptions?
- Who owns the decision, and what change would trigger a pause or reassessment?
Closing Thought
Before approving the next AI tool, try writing the one-page decision record. If the rationale depends on “the vendor says it is safe,” you have found the next conversation to have—before launch.
Sources and Further Reading
- NIST: Super Intelligence Standards — standards-development updates and draft materials.
- EIOPA: Opinion on AI governance and risk management — European insurance-sector context.
- The AI Governance Question Regulators Are Forcing — And Most Leaders Can’t Answer.
- AI Governance Is Failing at the Design Phase — Not the Review Phase.
Sources checked 2 October 2026. NIST’s initial draft was released 29 July 2026; its standards page was updated 30 September 2026. EIOPA’s announcement was published 6 August 2025. This article does not claim that NIST’s draft has become a final standard. The example is fictional, and the recommendations are general editorial analysis—not vendor-specific performance findings or legal advice.
About Gary Cheung
Gary Cheung works in information risk management, helping leaders make clear, accountable decisions about technology risk and AI governance.
If you are working through a consequential AI approval, connect with Gary on LinkedIn.
