Quick answer: Five delivery models can put AI into an Australian business: an AI-led MSP, a traditional MSP with an AI add-on, an AI consultancy, buying direct from a software vendor, or building in-house. They differ less on capability than on accountability. The question that separates them is who is responsible when an AI workflow fails on a Tuesday morning and nobody knows why, and only two of the five have a real answer.
Every one of these models can get AI into your business. They diverge on who carries the result afterwards, which is the part buyers usually discover late.
| Model | What they sell | Who owns the outcome | Governance included | What happens when it breaks | Commercial shape |
|---|---|---|---|---|---|
| AI-led MSP | AI deployment, governance and operation as a named service line | The provider, under the agreement | Yes, and before rollout | Monitored, triaged and remediated as standard, same as any other managed service | Monthly service fee, plus licensing and usage |
| Traditional MSP with an AI add-on | Licences, basic enablement, AI advice through a vCIO | Shared, and rarely written down | Optional extra, usually after rollout | Handled if it touches the network, otherwise out of scope | Licence margin plus hourly work |
| AI consultancy | Strategy, framework design, project build | You, from the day of handover | Designed, not operated | A new engagement, or your problem | Project fee, sometimes a retainer |
| Software vendor direct | Licences and platform access | You | Tenant controls you configure yourself | Vendor support covers the product, nothing covers your workflow | Per seat, per month |
| In-house build | Nothing, this is internal capability | Your team | Whatever your team builds | Your team, at whatever hour it happens | Salaries, infrastructure and opportunity cost |
Read down the “what happens when it breaks” column and the market sorts itself into two halves.
Consultancies, vendors and in-house builds all put the operating risk on you. That is not a criticism, it is the model working as designed. A consultancy is paid to think, a vendor is paid to supply, and an internal team is yours to direct. None of them signed up to watch your AI at 2am.
The two managed models are the ones that carry operating risk, and the difference between them is scope. A traditional MSP with an AI add-on will fix the laptop and the network path, because that is what its agreement covers. It will not notice that an agent has been silently failing a reconciliation step for three weeks, because nobody wrote that into the service description. An AI-led MSP has AI on the agreement as a discipline with deliverables attached, so the failure has an owner before it happens rather than after.
This matters more than it reads, because AI workflows are not stable assets. They drift as the underlying systems change. Permissions get edited, an API version retires, a document template moves, and output quality degrades quietly rather than throwing an error. Without somebody accountable for noticing, most deployments decay inside a year while everyone assumes they are still working.
An AI-led MSP takes operational responsibility for how a business adopts AI. Three things sit at the centre of it. Deployment, meaning the right tools for each team, connected safely to business data. Governance, meaning you know what AI is in use across the organisation, there is a policy, and there is evidence. Outcomes, meaning somebody measures whether it made the business faster and fixes it when it did not.
The “led” part is the load-bearing word. Plenty of Australian providers now use AI somewhere in their own operations and will happily sell you a Microsoft 365 Copilot licence. An AI-led MSP is accountable for the result, with AI named on the service agreement the same way security or backup is. The full service breakdown is in our piece on the five services an AI-led MSP delivers, and if you want a scoring framework to test any provider against, we published six criteria for judging AI capability in an Australian provider.
The destination all of this serves is the client’s, not the provider’s: a business where AI is embedded, governed and measured as part of normal operations. We set out what that end state looks like, and the four maturity stages on the way to it, in our guide to becoming an AI native business.
Nearly every MSP in Australia now claims AI capability, so this distinction is worth being blunt about. An MSP that uses AI has automated parts of its own back office. Good for them. It does nothing for your risk position or your team’s output.
The test takes one meeting. Ask to see their AI governance framework, a sample shadow AI discovery report, and where AI appears on their standard services agreement. A provider doing this work produces all three without hesitation. A provider that recently added AI to their homepage will pivot to talking about their chatbot.
Fewer than about 20 staff, light AI use. Buy direct from the vendor and keep it simple. Set the tenant controls properly and revisit when AI starts touching client data.
Mid-market, 20 to a few hundred staff, AI already in unmanaged use. The managed models are the only two that solve the actual problem, because discovery and control have to happen continuously rather than once. This is the largest group and the one most often sold a consulting project it cannot operate afterwards.
A board mandate for an enterprise AI risk framework. A consultancy or a Big 4 firm is built for that, and the operating layer is a separate conversation. Which part of the market sells what, including law firms and specialist governance consultancies, is mapped in our guide to who governs AI risk across the Australian market.
A genuine internal engineering team and AI as core product. Build in-house and buy governance tooling, not services. If AI is what you sell, the capability belongs to you.
Full disclosure: Epic IT coined this positioning for our own practice, and we describe ourselves as Australia’s first AI-led MSP. Others will adopt the label, which is fine. The criteria matter more than the branding, which is why the table above is written so you can score us with it.
In practice, our AI services line means we deploy and govern the AI our clients actually use, being Anthropic Claude, ChatGPT and Microsoft Copilot, connected to Microsoft 365 and business systems. AI governance runs first, with shadow AI discovery and audit trails built in from day one, and managed AI services carry the ongoing monitoring, training and optimisation. It sits alongside managed IT and security under one agreement, because separating AI from the identity and security layer it depends on never made much sense.
Work out which column you are currently in. Look at how AI entered your business and who has been named responsible for it since. Most mid-market businesses find they bought from a vendor, took advice from a consultancy, and never assigned the operating half to anyone.
Ask for two documents from whoever you think owns it. A sample shadow AI discovery report and their AI acceptable use policy template. A provider doing this work sends both the same day.
Get an independent read before you change models. Our AI readiness assessment maps what AI is already in use across your business, where the governance gaps sit, and what to fix first, so the decision starts from facts rather than a pitch. Contact us on 1300 EPIC IT to book one.
An AI consultancy designs strategy and frameworks, then hands them over, so you own the operating risk from the day of handover. An AI-led MSP runs the operational layer continuously under an ongoing agreement, covering deployment, governance, monitoring, training and support. Many businesses use both, with the consultancy setting direction and the MSP making it real day to day.
Sometimes, and it is usually the cleanest option when they can, because AI governance depends on the identity, security and Microsoft 365 layers your MSP already manages. Ask three questions: how they discover shadow AI, what their acceptable use policy covers, and what audit evidence they can produce about AI usage in your environment. If those answers do not come quickly, the difference between an AI-led MSP and a traditional MSP with an AI add-on is about to become your problem rather than theirs.
Not for a small team with light AI use and properly configured tenant controls. It becomes a problem at scale, because the licence covers the product and nothing covers your workflows, your permissions exposure or the tools staff are using outside the Microsoft stack. Copilot inherits whatever Microsoft 365 permissions you already have, which is where most of the risk actually sits.
If AI is core to what you sell, yes, and buy governance tooling rather than services. For everyone else the arithmetic rarely works. The capability needs engineers, platform ownership and out-of-hours coverage, and it competes with whatever your team is actually paid to build. Most mid-market businesses that try it end up with two or three working automations and nobody maintaining them.
Structures vary. Some providers, including Epic IT, include AI governance and deployment inside a managed services agreement with licensing costs on top. Others price AI as a separate project. Ask for the pricing model in writing and check specifically whether governance, training and ongoing monitoring are included or charged as extras, because that is where the models differ most.
