For many years, the customer due diligence playbook in financial services was predictable. Procurement teams asked for SOC 2 Type II and a PCI DSS certification, since payment data tends to surface across digital channels and tools.
According to Theta Lake, those remain necessary foundations and any vendor that cannot produce them has no business operating in security or compliance use cases. But they are no longer sufficient. AI has fundamentally changed what vendors must do to prove trust to their customers and partners.
The Emerging Need for AI-Specific Assurance
Beyond foundational certifications, customers and partners now need to understand how a vendor’s AI model makes decisions, what data trained it, how any data used or stored is protected, whether a human can intervene, and whether the system can be shut off quickly. Perhaps most critically: can any of that be independently verified, rather than taken on faith that the vendor’s paper claims are true?
That shift is exactly what is driving the rise of ISO/IEC 42001 as the new baseline for AI vendor accountability. The distinction between expertly, independently audited versus self-declared should be non-negotiable. The security and compliance markets have already seen enough vendors describing AI capabilities in glowing terms without anything substantive to back them up.
Security or compliance vendors that want a customer to evaluate their AI features while providing only their own documentation should be questioned. Regardless of how thorough a vendor’s internal documentation may be, without independent validation of controls, the customer is trusting marketing claims rather than verified facts. ISO 42001 gives procurement teams credible, auditable evidence and standards they can reference in a board memo or a regulatory exam without taking the vendor’s word for it. Read the full article.
