The real test is accountability, not price
Each sector tests for this differently, but the underlying demand is the same: prove you can be held accountable to the same standard as an in-house team. Banking regulators (the OCC, FDIC and Federal Reserve’s interagency guidance, and the Federal Reserve’s SR 11-7 model risk standard) hold institutions responsible for validating a vendor’s model, not just buying it. In Healthcare, a Business Associate Agreement only protects you if it names your specific AI use case, and Censinet’s vendor compliance research linked 47% of 2025 healthcare breaches to third-party failures, at an average $370,000 added cost. In Energy and Utilities, NERC’s CIP-015-1 standard requires vendors to produce real-time, tamper-proof audit trails rather than after-the-fact explanations.
Capability predicts which partnerships succeed. BCG’s 2025 research found the top 5% of “future-built” companies achieve five times the revenue gain and three times the cost reduction of their peers, a gap BCG attributes to governance maturity rather than spend. That rigour needs to extend to validation, too: Censinet cites a widely deployed sepsis prediction model that claimed an AUC of 0.76 to 0.83 in its own studies but achieved only 33% real-world sensitivity when independently assessed at a major US health system, because it was validated on the vendor’s own data, under the vendor’s own conditions, without independent replication. A due diligence process that cannot surface that gap before signature will surface it after, at a worse time and a higher cost.
The accountability transfer test: six questions to ask
Bring each question into every AI vendor evaluation: if this went wrong, could the partner be held accountable in the way our regulator expects, or would that accountability land back on us? Six checkable questions make it concrete:
- Independent validation. Can they show real-world performance validated by someone other than themselves, not just their own benchmark results?
- Scope-matched contracts. Will they sign a Business Associate Agreement, data processing agreement, or equivalent instrument that names your specific AI use case, not the platform generically?
- Real-time audit trails. Can they produce contemporaneous, tamper-proof records of AI decisions, rather than explanations generated after the fact when someone asks?
- Fourth-party disclosure. Will they name every subcontractor and sub-processor that touches your data or model outputs, without you having to ask twice?
- Their own accreditation. Do they hold their own SOC 2, ISO 27001, security credentials and liability insurance, or are they relying on a subcontracted vendor’s certification?
- Life after go-live. What do they deliver once the system is live: ongoing monitoring and a capability handover to your team, or a support ticket queue and a project close-out email?
A partner who answers all six with specifics, contract clauses, named audit tooling, insurance certificates, has structured itself to carry the accountability your regulator will eventually look for.
Before you sign
None of this argues against buying AI capability rather than building it; the data says buying from the right partner roughly doubles your odds of success. It argues for spending the due diligence effort on the right question, with six concrete answers in writing before the contract is signed.
That is the standard Zartis holds itself to: an AI transformation partner that advises on strategy and governance and then delivers the engineering, carrying accountability for both. If you are running a vendor evaluation for a regulated AI initiative and want a second opinion on where the accountability actually sits, that is worth a conversation before you sign.
