MSPs have long had to navigate difficult conversations with clients, whether around regulatory requirements or sensitive cybersecurity matters. They hold the hands of corporate clients and help guide them across the busy and perilous thoroughfares of cybersecurity.
One such thoroughfare is compliance: building policies, assembling evidence, and helping clients understand what auditors and insurers expect to see.
That conversation now has a new chapter, and many MSPs haven’t caught up yet. Auditors, insurers, and enterprise customers are starting to ask not just whether a business has an AI policy, but whether it can prove AI is actually governed. Those are two very different conversations.
Insurers are raising the evidence bar
Milad Morgan, a broker at Atlas Risk Partners, a commercial insurance brokerage specializing in technology companies, tells Smarter MSP that the evidence bar has already shifted. “An AI policy is a starting document,” he said. “Useful evidence shows which tools are approved, what data they can access, what actions they can take, and who reviews the results.”
He points to Aon’s published underwriting questions as an indicator of where the market is heading, with questions specifically addressing AI use, human oversight, and data and intellectual property controls. “Requirements still vary by insurer,” Morgan noted, “but the direction is clear.”
The fraud dimension is driving some of the urgency on the insurance side. John Gormally, a 28-year cybersecurity veteran and former Digital Marketing Manager at Coeus Consulting, a Phoenix-based MSP that sells compliance services to healthcare, aerospace, legal, and manufacturing clients, says underwriters are connecting AI governance directly to wire fraud risk. “Attackers are already using AI for phishing and deepfakes, and deepfake voice and email are the new wire-fraud play,” he said. “So underwriters want to see a callback procedure before money moves.”
He has watched cyber insurers move toward requiring proof of CIS Controls and 24/7 security operations as conditions of renewal and says AI evidence is heading in the same direction.
On the customer side, the questions are arriving through those super-fun security questionnaires, sarcasm noted. Gormally describes what vendors are now being asked to show: which AI tools staff use and who approved them, what client data goes into those tools, and who can see the output. “A policy PDF no longer closes that question,” he said. “They want an inventory, the controls behind it, and proof someone reviews it.”
In other words, MSPs need to have their AI governance house in order.
The AI governance gap
Dara Gibson, CEO and CISO of Cybersecurity Readiness Advisors, identifies a structural gap that often plays out the same way. “Clients may assume the MSP covers it, and the MSP may assume the client or insurance covers it,” she said, “and then nobody holds the evidence.”
The handoff problem is compounded by agentic AI, AI systems capable of taking actions autonomously, which can fall outside normal identity governance processes. Nobody reviews what the agent is doing, nobody owns the risk, and nobody can produce evidence if an insurer asks.
Gormally sees the same gap from the MSP side. “They sell the policy template and stop there,” he said. “There’s no inventory of AI tools, no signed acceptable-use policy, and no logs.”
He singles out Copilot deployments as a common failure point. “AI doesn’t create the oversharing problem,” he said. “It finds it in seconds.”
When an MSP rolls out Copilot on top of a Microsoft 365 environment with messy permissions, broadly shared files, old accounts that remain active, or no sensitivity labels, the AI assistant can surface those issues immediately. The MSP may have introduced a new layer of risk the client wasn’t prepared to manage.
What a defensible AI governance program looks like
So, what does a defensible AI governance package actually look like for a small business? All three practitioners converge on a similar answer: keep it straightforward, documented, and owned by a named person.
Gormally’s package fits on five pages rather than 50. It starts with an AI tool register listing each tool, its owner, what data it is allowed to access, and whether it operates under business-grade terms.
It also includes:
- An acceptable-use policy that every employee signs annually.
- A simple data rule: client data, PHI, and CUI never go into consumer AI tools.
- An access review before enabling any AI system that can read company files.
- Blocking or logging of unapproved AI tools to provide evidence rather than intent.
- A callback rule for any payment or banking change.
- A named owner responsible for quarterly reviews.
- Loose alignment with the NIST AI RMF so an auditor can recognize the framework being used.
His most practical advice:
“Don’t invent a new framework for AI. The AI tool register sits next to the asset inventory, and the AI acceptable-use policy sits next to security training records. One binder, one owner, ready the day the underwriter asks.”
Gibson’s implementation timeline runs 30 to 60 days and covers governance documentation, tool inventory, an acceptable-use policy, vendor review, fraud controls, an incident response addendum, and training.
Morgan adds the insurance-specific layer: map specific loss scenarios to the actual cyber and tech E&O policy wording. “A governance package can support underwriting,” he said. “It cannot override an exclusion or establish coverage by itself.”
Morgan also flags the MSP-client responsibility split as the detail most likely to create problems when a claim is filed. “The provider says it configured the tool, while the customer assumes the provider is reviewing every output,” he said. “Put that responsibility in writing and show the permissions, approval records and exception logs that support it.”
From AI policy to proof
The underlying principle Gormally returns to is documentation.
“Small businesses don’t need a governance program. They need a paper trail that holds up when an insurer asks.”
For MSPs already selling compliance as a service, the AI governance conversation is an extension of the same work: clear evidence requirements, recurring reviews, documented ownership, and the opportunity to be the provider that shows up with proof rather than promises.
For MSPs ready to deliver that proof, Barracuda AI Data Security provides the inventory, policy enforcement, and audit-ready evidence trail that can turn a governance package into something an insurer or auditor can verify, supporting the same evidence-driven approach Morgan says underwriters are increasingly applying to AI.
Photo: tadamichi / Shutterstock
