AI Governance for MSPs: More Than Reselling Copilot
AI is already inside your customers' environments, often before anyone decides who owns it or how it's controlled. In this episode of the MSP Zone, Charles Weaver talks with Ignacio Lopez, a former KPMG auditor, JP Morgan risk manager and Kaseya VSA manager. They cover where the MSP's role begins and ends.
Summarize with AI
Open this article in your favorite AI assistant for a quick summary.
Show Notes
Show Notes: AI Governance for MSPs: More Than Reselling Copilot
Summary
Charles Weaver talks with Ignacio Lopez about why AI is an operational responsibility for MSPs, not just another product to resell. They cover where the MSP's role begins and ends, and what responsible AI governance looks like in practice.
Guest
Ignacio Lopez began his career auditing SOX controls at KPMG, later worked in information risk at JP Morgan, and was a manager at Kaseya VSA. Today he helps organizations and their MSPs put practical AI policies, controls, training, infrastructure and permissions in place.
Website: work-smart.ai
Topics and timestamps
- 0:12 Why AI is an operational responsibility for MSPs
- 2:11 AI and the BYOD era: shadow AI in customer environments
- 5:16 Why AI governance builds on what MSPs already do
- 7:18 Going beyond reselling Copilot licenses
- 12:36 Starting with the AI policy: the client owns it, the MSP helps frame it
- 13:06 Enforcing controls and producing evidence
- 16:43 Why the MSP must not own the policy
- 18:20 Infrastructure projects and recurring service opportunities
- 20:09 Configuration, change management and training
- 24:05 Data access, connectors and subscription tiers
- 26:21 Why AI amplifies cyber hygiene, good or bad
- 30:46 Governance, regulation and the role of evidence
- 36:51 Treating AI like a service account, with human oversight
- 40:27 Start small, then expand step by step
- 43:40 The family doctor model: coordinating specialists
- 46:48 Coming soon: AI costs and surprise token billing
Key takeaways
- The client owns and approves the AI policy. The MSP implements, enforces and documents.
- "Please don't hallucinate" is a request, not a control. Real controls can be enforced and proven.
- Connectors give AI the same access as the user who connects them, so grant access gradually.
- Start with read-only access, review quarterly, and expand over time.
- Strong cyber hygiene comes first. AI amplifies whatever is already in place.
- Evidence matters: keep approvals, logs and monthly reports organized and ready for auditors.