Get featured on the show by leaving us a Voice Mail: https://bit.ly/MIPVM 

In this episode, Mark Smith speaks with Caleb Mattingly about how startups and enterprises should approach AI governance, compliance, and risk as AI adoption accelerates. The conversation focuses on ISO 42001, common misconceptions about AI security, and why compliance is less about badges and more about trust, data quality, and long term viability. You will hear practical perspectives on when compliance becomes essential, how it functions as a sales enabler, and why human oversight still matters more than autonomous agents in high risk environments. 

👉 Full Show Notes
https://www.microsoftinnovationpodcast.com/810   

🎙️ What you’ll learn 

• How ISO 42001 differs from traditional security standards like ISO 27001 
• Why AI compliance is primarily about data quality, bias, and risk anticipation 
• When compliance becomes a sales lever rather than a legal checkbox 
• Why most organisations are not ready for autonomous compliance agents 
• How startups should time compliance investments without killing runway 

✅ Highlights 

• “ISO 42001 does not prove that your AI system is secure at all.” 
• “Most of it is not security related, it’s about data quality and bias.” 
• “AI is only as good as the data that you give it.” 
• “Compliance acts as a sales lever before it acts as a security guarantee.” 
• “AI can make a lot of mistakes very quickly.” 
• “Most companies are not ready for AI agents with admin access.” 
• “SOC 2 in two weeks is not a thing.” 
• “Compliance and security are not one to one.” 
• “Enterprises care about whether you handle their data securely.” 
• “It takes a minimum of five months to get SOC 2 done properly.” 

 🧰 Mentioned 

• International Standards Organization: https://www.iso.org/ 
• ISO 42001: https://www.iso.org/standard/42001  
• ISO 27001: https://www.iso.org/standard/27001  
• SOC 2: https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2 
• EU AI Act: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng 

✅Keywords 
ai governance, iso 42001, ai compliance, startup compliance, data privacy, soc 2, iso certification, ai risk management, enterprise sales, ai regulation, security and privacy, responsible ai 

Microsoft 365 Copilot Adoption is a Microsoft Press book for leaders and consultants. It shows how to identify high-value use cases, set guardrails, enable champions, and measure impact, so Copilot sticks. Practical frameworks, checklists, and metrics you can use this month. Get the book: https://bit.ly/CopilotAdoption

Support the show

If you want to get in touch with me, you can message me here on Linkedin.

Thanks for listening 🚀 – Mark Smith