Still Your Lawn
So there I was...
This morning I was reading an article after the mile, breaststroke as always, my wife setting the pace and the hummingbirds working the feeder like they were being paid by the visit. Then coffee and granola, and then no more stalling: a week of rain had turned our acre and change into something closer to a hay operation than a lawn, and the Ariens was waiting in the shed. There is no thinking quite like zero-turn thinking. You lay down one straight pass at a time, the tall grass falls, and your mind runs wherever it wants to go.
Mine ran straight back to yesterday.
Yesterday I wrote about the philosophers, and the point was that judgment is conditioning: nobody can swim your mile for you. This morning, Harvard Business Review showed up with the second shoe. The piece, by M. Alejandra Parra-Orlandoni and Paulo Carvão, is about what happens when companies buy their AI instead of building it, and the finding is blunt: when a third-party AI tool fails, courts and regulators go after the organization closest to the end user. Not the model provider. Not the vendor with the impressive logo. You. Peloton, iTutorGroup, Workday, Cigna, the litigation list is already growing, and the pattern in every case is a company that deployed somebody else's model and discovered, in a courtroom, that the risk had never left the building.
The authors name four exposures that boards keep under-managing: you cannot see inside the model you bought, you become liable the moment you customize it, you cannot easily swap the vendor you depend on, and the rules are different in every jurisdiction you operate in. Solid list. But sitting on the mower, I kept coming back to a simpler way of putting it.
I could hire out this mowing. There are two or three good crews working our road, and on a morning like this, with the grass wet to my boot tops, the thought crossed my mind more than once. But here is what hiring them would not change. If the grass gets long enough to hide the rattlesnakes, that is my problem. If the county decides the field is a fire hazard in August, the notice comes to my mailbox, not to the crew's. If a rock goes through a windshield on the road, nobody calls the mower. They call the man whose name is on the deed. I can contract the labor all day long. I cannot contract the ownership. Whoever mows it, it is still my lawn.
That is the whole HBR article in one sentence, and I suspect most executives already know it, the way I know about the rattlesnakes. The trouble is that buying AI does not feel like hiring a lawn crew. It feels like the risk went with the purchase order. The vendor has the PhDs, the vendor has the safety team, the vendor has an indemnification clause somewhere in ninety pages of contract, and so the model ships, and the org chart quietly concludes that someone else is watching the grass grow. Nobody decided that. It is just what happens when a capability arrives with someone else's name on it.
The authors offer real remedies, and they are the right ones: transparency written into vendor contracts, formal governance before anyone customizes a model, systems designed so you can actually change vendors, compliance anchored in frameworks like NIST's rather than improvised. Do those things. But notice what every one of them actually is. Not a transfer of risk. A landowner walking his own fence line. The paperwork does not do the walking for you.
Put yesterday and today together and you get the pair of truths I would want any leader to carry into the second half of this year. You cannot outsource the judgment, because judgment is conditioning and conditioning does not transfer. And you cannot outsource the risk, because risk follows ownership, and ownership is not in the deliverables. What you can buy is help. Coaches for the swimming. Crews for the mowing. Both worth every dollar, so long as everyone stays clear about whose name is on the deed.
The Ariens is back in the shed now, the field looks like a golf course, and I am the one who knows where the wet spots are, because I am the one who crossed them.
So, one question before the day gets going, for anyone whose company deployed a model it did not build. When it fails out there in the tall grass, and the notice comes.
Whose mailbox is it coming to?
Source: You Outsourced the AI, but You Still Own the Risk, Harvard Business Review
#AI #AIRisk #AIGovernance #ThirdPartyRisk #Accountability #Leadership #STIW