For three years, the question was whether an organisation used artificial intelligence. The question has already changed. Now it is how it uses it, and who can prove it.

The European AI Act does not concentrate all responsibility in a single actor. It assigns obligations by role: provider, deployer, importer, distributor or other participants within its scope. This architecture makes a contractual and operational question relevant · what evidence each party retains about what it does and what it requires of the others.

Terms of use and internal declarations provide limited evidence. They may assign obligations, but do not in themselves demonstrate that the inventory is complete, that controls operate or that incidents are addressed. Their value depends on the evidence that accompanies them.

A commitment without evidence does not allow a third party to conclude that it is being met.

My hypothesis is that access to certain capabilities, contracts or coverage will increasingly be conditional on evidence of governance. I am not claiming that this condition is universal today or that it will take a single form. It may appear as a provider requirement, a contractual clause, a client assessment, an insurer's condition or a regulatory requirement.

Part of the framework already exists. ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining and improving an AI management system. ISO/IEC 42005 provides guidance for assessing impacts throughout the life cycle. These frameworks help organise the evidence; they do not replace an examination of scope or allow a conclusion, without further auditing, that every control works.

The relevant difference is not just between using and not using AI. It is between being able to reconstruct a use—purpose, data, person responsible, assessment, oversight and incidents—and relying on a general declaration that no one can verify.

Disclosure of interest · I lead IAC. That institutional connection is relevant context for the reader. This piece expresses a personal authorial thesis; it does not constitute accreditation, certification, an offer or a promise of access to AI systems by IAC.