Norton Calls for Stronger MSP Accountability as AI Heightens Third‑Party Risk

Key Takeaways

• Industry experts urge managed service providers to build governance and risk controls into AI-enabled offerings
• Boards retain fiduciary responsibility for privacy, data handling, and breach accountability
• Small businesses face increasing pressure to question MSP practices amid rising regulatory expectations

AI adoption is quickly shifting how managed service providers operate, adding fresh urgency to risk management. Views shared in recent industry commentary reflect a moment where boards are becoming more aware of the risks tied to AI use, while smaller companies are still struggling with the basics. That mix can create fragility. It can also create an opening for MSPs that come prepared with a clear governance story.

Most businesses are experimenting with generative AI in some form, yet only a fraction have the governance structures to match the pace of deployment. Research from Gartner in 2024 reported that 79% of businesses were using or trialing generative AI, but just 38% had firm policies. This gap highlights a point where MSPs need to step up rather than quietly pass risk through to clients.

Without clear controls, AI-driven services may simply introduce more exposure. Vendors and MSPs, particularly those supporting smaller organisations, are increasingly being asked to help reduce the threat surface. Some MSPs already face scrutiny over the history of inconsistent cyber hygiene among third-party providers. For years, customers could buy IT services without a security layer at all, which seems odd now but was routine.

Then comes AI, which amplifies longstanding gaps. It is no longer enough for MSPs to offer basic monitoring or episodic support. Businesses want to know what models are being used, what data is being ingested, where it is going, and whether any of it leaves the country. AI can no longer be treated like a black box, as unverified automation is not a viable strategy.

Many MSPs are leaning on established governance frameworks to bring structure to their offerings. The NIST AI Risk Management Framework, published by the National Institute of Standards and Technology and accessible through NIST, has become a reference point for assessing AI system integrity, bias, and operational risk. Similarly, the ISO/IEC 42001 standard is being adopted by MSPs that want to document processes and meet regulator expectations. Standards alone are not a complete answer, but they help MSPs demonstrate that AI-enabled services are managed with thoughtful oversight.

Industry trends also show security teams investing more in managed detection and response providers. Analyst research from Forrester in 2023 found that 61% of security decision makers planned to increase spending with MDR or MSSP partners to manage AI-fueled threats and tooling complexity. This aligns with broader industry demands: clients increasingly want verifiable assurance, not vague promises.

Some MSP platforms are adjusting. N-able, ConnectWise, and Kaseya have been embedding AI-driven monitoring and anomaly detection features into their tools. These capabilities are designed to help MSPs measure risk in real time, automate control documentation, and provide alerts when AI models behave unpredictably. Whether these capabilities fully meet customer expectations is still an open question, and the market is not uniform yet.

Corporate governance experts underscore that boards still hold fiduciary responsibility over data privacy and breach accountability. That tension between board-level responsibility and outsourced operational activity can create confusion. What happens when a small company relies entirely on an MSP that has limited governance capability? Who actually evaluates the AI model choices? These questions are starting to surface more often.

Not all companies have the skills to sort through the details. An IDC analysis in 2024 noted that 45% of organisations reported lacking in-house talent to manage AI risks. For many small firms, the founder might handle operations, finance, and strategy with only a few staff. There may not be an IT person at all. Expecting these businesses to independently evaluate AI model behavior or offshore data flows may be unrealistic.

This dynamic is exactly why MSPs need ready-made governance architectures. If they build AI guidance principles into their service offerings with predefined risk profiles, clients will be able to onboard without inheriting extra risk. Providers that lack these controls may start losing opportunities because they cannot show that they are managing AI responsibly. Clients are now asking tougher questions about data residency and algorithmic transparency before signing contracts.

Regulatory bodies are also responding to these shifts. Industry watchers expect data privacy authorities, such as the Office of the Australian Information Commissioner, to continue clarifying what is required around privacy and data protections, including AI use. Privacy principles have existed for years, with cybersecurity layered in, and now AI is being slotted into those existing structures. It might create some friction as smaller businesses try to keep up, but regulators tend to prioritize clarity once new risks become mainstream.

Even with evolving guidance, many organisations want to move faster than their internal due diligence processes allow, seeking assurance at pace and scale. They want to feel confident that an MSP can tell them exactly what inputs an AI system uses and how data is processed. Rushing into AI deployments without that assurance exposes both clients and providers to regulatory penalties and data breaches. MSPs must build this governance muscle to remain competitive.

There is also an emerging cultural shift where AI and cybersecurity preparedness are increasingly viewed similarly to other professional obligations. Businesses know they need legal advice, and they know they need an accountant. Yet cyber security and AI risk still sit in a grey zone for many organisations. They know it is important, but they do not always treat it as a standard operational requirement. In practical terms, that means more companies may begin defaulting to external advisers, which could further raise expectations on MSPs.

The next few years will likely test which MSPs can adapt to this environment. Those that treat AI risk as a core governance function may find opportunity in an increasingly competitive market. Those that rely on vague assurances may struggle as scrutiny intensifies. This illustrates a broader shift: AI is not just another tool. It is becoming a measure of whether a service provider can offer clarity, discipline, and accountable operations in a rapidly changing regulatory landscape.