An AI assessment can shape whether a customer or insurer will accept a system, but it does not decide how that system should be used. Dr Aditya Vikram Kashyap argues that organisations must turn assessment findings into clear operating limits, named owners and plans for reassessment when systems change.
Watch Desk analysis
What happened
In a Forbes Technology Council article published on 5 November, Kashyap describes how independent assessments can influence AI deployment through customer requirements and insurance terms. His central distinction is useful: an assessment may affect whether a system is commercially acceptable, but the institution deploying it remains responsible for its own decisions.
The article gives a concrete example of a bank considering an AI agent for payments. If an assessment covers autonomous payments only up to $25,000, raising that limit to $100,000 should require renewed approval and evidence. Connecting a new system or accepting a model upgrade also calls for review if it changes what the agent can do.
Why it matters
An assessment is only useful within the conditions it actually tested. A model upgrade, wider system access, worsening performance or a new pattern of harmful behaviour can make earlier evidence stale. Kashyap argues that organisations need reassessment triggers for both changes and performance deterioration, as well as a way to suspend or deactivate a system that no longer behaves as intended.
The article also notes that assessments vary in reliability. Buyers should examine an assessor’s expertise, independence and commercial interests, and check that reports state the model version, operating conditions, exclusions and limits of the method. The practical point is not to distrust every report. It is to avoid treating a favourable result as a blank cheque.
Our read
This is a useful guide to the gap between “the system passed an assessment” and “we have decided what it is allowed to do”. Organisations adopting AI should make the approval conditions explicit, assign someone to own each one and decide in advance what changes require fresh review. A report can inform that decision; it cannot make it on the organisation’s behalf.
Kashyap also distinguishes these voluntary commercial pressures from a proposal by Lawrence Lessig and Yoshua Bengio for Congress to affirm company liability for harm caused by AI systems and make insurance compulsory. Those are different approaches, with different questions about who sets the rules and how much risk insurers can carry.
What to watch
- Whether customers and insurers begin specifying assessment scope and deployment conditions in contracts.
- How organisations respond to model upgrades, expanded permissions and declining performance.
- Whether policymakers set minimum standards for assessment scope, conflicts of interest and accountability.
Discussion spark: Should an AI assessment merely inform an organisation’s deployment decision, or should customers and insurers be able to make its conditions binding?
Sources and evidence
- AI Safety Reports Could Become Your Company's Deployment Rules – Forbes (5 November 2026, 15:45 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.