MSP s
The next major MSP revenue stream? Greg Jones, Senior Vice President of MSP Success (EMEA & North America) at Kaseya, outlines the opportunities in AI governance-as-a-service
so the risk is understood before someone pastes something into a chatbot. Employee training must be recurring rather than a one-off induction, since most risky AI use isn’t malicious but simply the result of people trying to work faster. And there should be ongoing monitoring: watching for shadow AI, tracking how sanctioned tools are being used and flagging problems as they happen rather than at the next scheduled audit. Supply chain multiplier There’s a further opportunity in supply chain assessment. Companies don’t just need to govern AI more effectively within their own operations. They’re increasingly expected to make sure their partners and suppliers do the same. Compliance is now routinely written into RFPs and tenders as a redline: no demonstrable compliance, no contract. This mirrors how penetration testing has evolved from a service sold direct to individual customers into something that extends to those customers’ customers, checking the whole chain rather than a single link in it. Multiply a typical MSP’s book of 50 to 200 SMB customers by each of those customers’ supplier relationships and the addressable market compounds quickly into thousands of doors an MSP would otherwise have had no reason to open. The potential could be very great in the coming years. Legislative mentions of AI won’t slow down any time soon, nor will the pressure on businesses to prove, continuously, that their use of it is under control. MSPs that can design an offering that specifically enables their clients (and their clients’ clients) to demonstrate compliance on an ongoing basis will be well placed to unlock a new stream of recurring revenue. The key is to take a measured approach. Indeed, any shift into AI governance as a service should be an evolution of the current MSP offering, rather than a hard pivot. www.kaseya.com
reshaping how financial services firms handle operational resilience and third- party risk. HIPAA is being stretched to cover AI use across healthcare. And NIS2 is pulling organisations’ own supply chains into scope. AI governance-as-a-service These changes are highly significant for MSPs. In the managed services world, much of the discourse around AI has centred on supporting development, implementation and automation. But perhaps the biggest long-term opportunity lies elsewhere. As companies embrace AI, they’re realising that many compliance frameworks now demand continuous monitoring. A customer might be compliant on Tuesday but not on Wednesday when someone on their team signs up to ChatGPT and starts uploading sensitive company data. Five minutes after the ‘we’re compliant’ moment, the position can change, regardless of what the paperwork from the day before shows. Frameworks such as NIS2, HIPAA, DORA and GDPR are all looking to address the limitations of point-in-time assessments by requiring organisations to demonstrate continuous compliance. Companies cannot rest on their laurels once a box has been ticked; they must maintain AI compliance around the clock. As a result, AI governance, compliance and business-process assurance services are emerging as natural extensions to the traditional MSP offering, providing a new source of monthly recurring revenue. Next steps But what does this offering look like? Any AI governance-as-a-service solution must be delivered as one connected product, ideally starting with policy development. That means setting out what tools are approved, who may use them and what data can go into them. It also includes AI risk assessments. Underpinning this, there should be data governance reviews, mapping what data an organisation holds and how sensitive it is,
Greg Jones
Artificial intelligence (AI) compliance is evolving quickly. In 2016, there were no AI-related laws on record among G20 countries. Ten years on, the US has passed 25, South Korea 17 and Japan, France and Italy have each passed nine or 10. Stanford’s 2025 AI Index shows that legislative mentions of AI across parliaments around the world have increased ninefold since 2016. It’s telling just how rapidly governments and corporations are taking action to address risks presented by these new technologies, even when they are used by users who harbour no ill intent. The focus on AI regulation is arguably being led by the EU AI Act. Regarded as something of a legislative gold standard, this takes a risk-based approach that bans certain uses of AI outright and imposes strict obligations on high-risk systems. However, it is also influencing other regulations. DORA, for example, is
20
01732 759725
Powered by FlippingBook