Qualify your suppliers

No pharma company buys an active ingredient from a supplier it has not audited. Now ask where your AI's data comes from, and watch that standard quietly collapse.

No pharma company buys an active ingredient from a supplier it has not audited. You qualify the supplier. You inspect their process. You demand a certificate of analysis with every batch, and you keep an approved-vendor list that someone is accountable for. A supplier who fails the audit does not get to sell to you, however good the price.

Now ask where your AI's data comes from, and watch that standard quietly collapse.

The data supply chain is real, and in most organisations it is almost entirely unexamined. Licensed datasets. Third-party enrichment. Scraped corpora. Partner feeds. The training data baked inside the model you are renting. Every one of those is a supplier delivering raw material into your line, and most of them have never been qualified by anyone.

Consider the questions you would ask without a second thought about a physical supplier, and how rarely they are asked about data. Who produced this, and by what process. Do they have the right to sell it, and do you have the right to use it. What is its quality, and how do you know. Will the next batch be the same as this one. What happens, and who is responsible, when it turns out to be wrong. For most data sources in most companies, the honest answer to every one of these is a shrug.

The model itself is a supplier, and the largest unqualified one of all. When you build on a foundation model you are building on its training data, a supply you cannot inspect and did not approve. That is not a reason to avoid it. It is a reason to know it for what it is, and to put your own qualified data layer between that model and anything that matters, so that the part you can control compensates for the part you cannot.

Rights are not a separate legal matter bolted on at the end. They are part of quality. A dataset you do not have the right to use is defective, no matter how good it is, in exactly the way an ingredient with no valid certificate is rejected even when it would have worked. Fitness includes the licence to use it. A brilliant input you cannot lawfully deploy is not an asset, it is an exposure.

None of this requires new machinery. It requires the habit you already have, pointed at a new material. An approved-source list for data, owned by a named person. Qualification before use, not after an incident. A certificate-of-analysis reflex, where every significant source arrives with a known provenance and a known quality or it does not arrive at all.

You already know how to do this. You do it every day for materials you can hold in your hand. The only thing missing is doing it for the material you cannot.