Years ago, companies viewed cybersecurity as a technical task limited to protecting devices and networks.

Today, cybersecurity has become part of management itself: companies know their systems, determine who can access them, monitor vendors, record incidents, and test vulnerabilities.

AI may follow the same path.

OpenAI recently called for mandatory national safety requirements in the United States for the most advanced models, including standardized testing, independent evaluations, incident-reporting requirements, and stronger cybersecurity controls. At the same time, it emphasized that these rules should target a limited number of labs capable of developing the most advanced models—not small companies or ordinary researchers.

But what does that mean for companies that do not develop these models and only use them?

Who Is Responsible for the Model Inside the Company?

Suppose a company uses several AI models:

One for customer service, another for data analysis, a third to help employees write code, and a fourth that operates as an agent capable of carrying out tasks within the company’s systems.

As these uses expand, the management question becomes simple but important:

Does the company actually know which models it uses and what they can do?

This is why AI governance may come to resemble cybersecurity.

Rather than simply purchasing the tool, companies will need to know:

What data can the model access?
Which systems can it use?
Does it operate autonomously?
And who is accountable if it makes a wrong decision or causes an incident?

The greater the model’s ability to operate without direct human intervention, the more important these questions become.

Why Does the Vendor Become Part of the Risk?

When a company relies on an external model, it is not buying a fixed piece of software.

The model may change over time, as the developer updates its capabilities, how it works, or its security policies.

This means that vendor risk becomes part of the company’s own risk.

If a particular model is connected to sensitive internal systems, any major change in its capabilities may require it to be reassessed.

For this reason, AI contracts may become more detailed in the future, including terms such as incident reporting, audit rights, transparency around model changes, and the ability to move the system to another vendor if a problem arises.

Why Do We Need Independent Evaluations?

OpenAI is calling for independent evaluations of advanced models, a trend that has already begun to appear in legislation.

On September 9, 2026, California signed two new laws: one establishes a framework for independent bodies capable of evaluating AI systems, while the other creates a registry and standards for AI auditors.

The idea is somewhat similar to financial auditing.

A company can claim that its system is safe, but an independent evaluation gives another party the opportunity to test that claim against standardized criteria.

This could also help companies that use AI, because they would not have to rely solely on vendor promises, but could instead rely on comparable evaluations.

Can Regulation Increase Costs?

Yes.

Every additional test, documentation requirement, audit, and incident-reporting obligation means higher costs.

This could give larger companies an advantage, since they have larger legal, security, and technical teams capable of handling compliance requirements.

But OpenAI itself says that the proposed framework should be based on capability and risk, so that the same rules are not imposed on a small model and a model capable of carrying out high-risk tasks.

This distinction matters, because disproportionate regulation could raise the cost of entering the market and reduce competition, while targeted regulation seeks to focus on systems that carry the greatest risks.

From Using AI to Managing It

As AI becomes more deeply integrated into business, it will no longer be enough for a company to ask:

Do we use AI?

It will need to ask more precise questions:

Which models do we use?
What is their level of risk?
Who monitors them?
What data can they access?
And what do we do if they fail?

This is where AI shifts from being merely a technical tool to becoming an asset that must be managed and monitored like any other infrastructure within the company.

The next phase may not be merely a race to adopt the best model, but a race to build companies that are better able to use AI with confidence, monitor it, and prove that they know what is actually operating within their systems.