Most regulated organisations don't build AI. They buy it. In this episode of Making AI Adoption Auditable, Seán Murphy explains why "the vendor is responsible for that" is rarely the whole answer, and how compliance, risk and internal audit teams can test where their organisation really stands.

He covers the difference between provider and deployer under the EU AI Act, the deployer duties for high-risk systems and why almost all of them depend on the supplier, and the three ways a deployer can end up treated as the provider — including simply using a tool for a new purpose. He then sets out five things to sample: the role decision, the instructions for use, the contract, the silent model change, and whether human oversight is real. The episode closes with the four findings that come up most often and how to write them up for your audit or risk committee.

Every part of AI governance depends on knowing what AI you have. In this episode of Making AI Adoption Auditable, Seán Murphy explains why the first line's AI inventory is rarely complete, and how compliance, risk and internal audit teams can test it independently rather than taking it on trust.

He covers the six places AI tends to hide — from features vendors switch on inside software you already pay for, to meeting note-takers connected to someone's calendar — then five sources for a completeness test: payables, card spend, connected applications, platform settings and targeted conversations with staff. The episode closes with the three findings that come up most often and how to write them up for your audit or risk committee.

The EU AI Act's high-risk rules now apply from December 2027. In the first episode of my new podcast for compliance, risk and audit teams, I explain why that's less runway than it sounds, the three things to test now, and how to get a credible view of AI risk to your committee within 90 days. Twenty minutes, no jargon.