Black-Box AI Won't Survive Client Diligence

On July 15, 2026, Presidio announced that it had earned ISO/IEC 42001 certification, the world’s first AI management system standard. Its CISO, Greg Hedrick, gave the reason in one line: the certification confirms that Presidio’s AI initiatives “are not ad hoc experiments.”

A services firm with Presidio’s customer list does not pay for an audit to decorate a website. It pays because its customers have started asking how it governs AI, and a certificate answers the question before anyone asks it twice. That question is moving down the supply chain, and it will reach MSPs through vendor diligence well before any regulator gets to them.

The questionnaire is coming for everyone

Embedded AI is now standard in the software stack. Grip Security’s 2026 SaaS and AI data report analyzed 23,000 SaaS environments and found embedded AI in every company it looked at. Most of that AI arrived as a feature update. Nobody bought it, so nobody assessed it.

Buyers have started asking. Security questionnaires that spent a decade on encryption at rest and SOC 2 scope now carry new sections: which AI models process our data, whether our data trains anything, who reviews AI-influenced decisions, how we opt out. The companies sending those questionnaires mostly can’t evaluate the answers yet. That doesn’t matter. A vendor with no answer fails the first read, and in a close deal the vendor with clean answers wins the tiebreak.

SOC 2 spread the same way. Few buyers understood the trust service criteria. Asking for the report cost them nothing, and not having one cost the vendor the deal. AI transparency is on that path now: it started as a compliance checkbox and is becoming a sales objection.

The certification wave has started

ISO/IEC 42001 covers the unglamorous machinery: AI risk management, transparency, human oversight, lifecycle monitoring. A certificate says a vendor’s AI use is documented and governed rather than improvised.

Requirements like this roll downhill. The large provider certifies. Then its procurement team starts asking its own suppliers the same questions, and within a couple of budget cycles the questionnaire lands on the desk of a 40-person MSP that has never inventoried its own AI.

Regulation pushes in the same direction without driving it. The EU AI Act’s Article 50 transparency obligations apply from August 2, 2026. The Digital Omnibus on AI, adopted in July as Regulation (EU) 2026/1744, moved the high-risk deadlines back, to December 2027 for stand-alone systems and August 2028 for AI built into regulated products, and left the transparency date where it was. Any client with European customers, parents, or partners inherits those expectations first.

MSPs sit on both sides of this

For an MSP, the black-box problem cuts two ways, and both are worth money.

The first is defensive. Your own stack is full of AI: RMM platforms with AI features, ticket triage automation, documentation assistants, the Copilot licenses your engineers use inside client environments. When a client’s new CFO orders a vendor review, or their cyber insurer sends the renewal questionnaire, you are the vendor under review. An MSP that answers the AI section with silence or hand-waving invites a competitor into the account.

The fix is cheap next to the risk. Inventory the AI in your delivery stack. Write a data-flow statement for each tool: what client data it touches, where that data goes, whether it trains anything. Put human oversight in writing for anything that acts on client systems. Package it as a one-page AI transparency summary that travels with your standard security documentation. The first time a client’s auditor asks and you hand it over the same day, a diligence risk has become proof that you run a tight shop.

The second is revenue. Every client you serve that sells into larger companies will face the same questionnaire, with less preparation than you have. The mid-market manufacturer with two AI-enabled products, the law firm using a research assistant, the healthcare group whose intake runs through a chatbot: none of them can say today which models they use or what data flows in.

Diligence readiness is a service you can package: AI inventory, data-flow mapping, policy drafting, questionnaire response support, and a path to ISO 42001 alignment for clients whose buyers will demand it. The skills are the ones MSPs already use for SOC 2 prep and cyber insurance applications. The subject is new. The motion is not.

Transparency as a wedge

In any deal against another MSP, the AI section of diligence is now a place to win.

Most competitors will treat AI questions the way vendors treated security questions in 2015, as something to get past. Put your AI transparency summary in the proposal before anyone asks for it. Name the AI in your stack and explain the oversight around it. The prospect concludes you run a tighter shop, and the incumbent now has questions it never prepared for.

In two years, “buyers will ask how you govern AI” will sound as obvious as “buyers will demand SOC 2” sounds now. The window that pays is the one before it becomes obvious, while most vendors still can’t produce the answer on request.

Black-box AI is a trust problem for the MSP market more than a technology problem, and trust is what MSPs have always sold. The ones that document theirs first will take deals from the ones that don’t.