Manufacturers need AI guardrails before models touch their data

By Amara Osei

The risk goes up as manufacturers default to AI tools, according to Mason Clutter, AI governance partner at law firm FBT Gibbons. The issue is not whether a model works, but who remains answerable when it does not.

Manufacturers were early adopters of robotics, and many are now moving into artificial intelligence to improve efficiency in turbulent times. The temptation is obvious, as is the uncertainty around security, reputation and regulatory exposure. Clutter said: “It’s really just a question of responsible development and employment — to strike the right balance.”

Start with the use case, not the tool

Clutter said manufacturers need to question and document the rationale for each deployment. Projects often begin at the top of the corporate ladder, while employees further down receive insufficient guidance on where management intends to take them.

A specific use case at the outset gives the project boundaries that a general promise of efficiency cannot. The purpose must be defined well enough to manage risk even when the model’s creators are unsure where the technology will go.

Those choices carry weight for proprietary data, confidential information, intellectual property and regulatory compliance. Increasingly sophisticated models can either bolster or undercut safeguards around each concern.

Buyers should evaluate both practical and ethical consequences before choosing among tools offered by a growing array of vendors. They should ask whether a supplier has its own ethical standards for using customer data.

That includes whether the supplier has promised not to use customer information to train its models. Such assurances need to arrive at the beginning of the vendor relationship, when they can help buyers filter out riskier alternatives.

Assign ownership before access

Clutter recommends a cross-functional governance committee to review prospective models. It should include legal, IT, security operations, and marketing and sales. “Everyone needs to be on the same page before a single model even touches your data,” she said.

The committee also needs one person tasked with overseeing the effort, even when the title changes to fit the company’s structure. Clutter previously served as the Department of Homeland Security’s chief privacy officer, where that responsibility sat with a chief AI officer.

The department did not make those decisions in isolation, she said. Her example makes the point about shared institutional oversight: no AI officer can make consequential decisions without input from the rest of the organization.

Match controls to the risk

Not every manufacturing AI application deserves the same level of scrutiny. A tool that manages predictive maintenance from anonymized sensor data can qualify as a low-risk use case. Automating supplier qualification or quality control carries much higher risk.

That difference should determine which stakeholders review the model and what questions they ask. Clutter’s list includes the kinds of data a tool ingests, where the data is stored, and how its decisions could affect company safety and regulatory compliance.

For higher-risk systems, the right stakeholders need to be involved before deployment. Inviting them after a problem appears turns governance into paperwork, a tidy definition of the wrong thing.

Some organizations are drawing firm red lines that exclude AI from critical tasks. One example is production for a federal government agency, where safeguards are too strict to hand over to an autonomous system. Another is a blanket prohibition on any use of proprietary data in the model.

Put the limits in the contract

Clutter said strong guardrails should always remain a priority. Protection of sensitive data about customers, employees and products belongs in vendor contracts at the point of purchase, not in a policy added after deployment.

At minimum, those agreements should contain clear guidance and restrictions on secondary use of data by the AI vendor. Even so, the primary user remains responsible for ensuring those commitments are upheld.

The organization must also train people and assign ongoing responsibilities for AI models. In practical terms, the tool may assist a decision, but it cannot replace the judgment and expertise of the people accountable for it. Humans stay in the loop.

What does this change for manufacturers and suppliers?

It changes the procurement conversation, not merely the pilot budget. Manufacturers need specific use cases, risk tiers, named responsibility, data-use restrictions and trained employees before models enter production workflows.

Suppliers should expect closer scrutiny when they automate supplier qualification or quality control. For manufacturers, that means knowing what data a tool receives, where it is stored and who owns the resulting decision.

For logistics providers serving these factories, supplier qualification and quality-control automation sit within the commercial relationship. Clutter’s guidance offers no rate or capacity signal, but it identifies where industrial AI decisions can affect that relationship.

As manufacturers press ahead with AI, Clutter’s policy prescription calls for documented use cases, risk tiers, named ownership and contractual data limits before models reach operational workflows. The next test is whether governance keeps pace as those tools enter factory operations.